Invisible manipulations of news headlines can steer LLM-based trading signals and materially erode returns—backtests show single-day attacks reducing annual returns by as much as 17.7 percentage points; common scraping libraries and platforms appear susceptible, raising urgent governance and security concerns for AI-enabled trading.

Main Finding

A single-day, human-imperceptible manipulation of a stock-related headline (either replacing characters with Unicode homoglyphs or injecting hidden HTML text) can reliably mislead LLM-based news ingestion in an algorithmic trading system (ATS) and produce measurable monetary harm. In a 14‑month simulation the authors find average drops in profitability of ≈3–3.5% from a one-day attack, with worst-case reductions in annual returns up to 17.7 percentage points. Some finance-tuned LLMs (e.g., FinBERT) were highly vulnerable (misclassification rates ≈99% for homoglyphs, ≈67% for hidden-text).

Key Points

• Threat model: attacker can alter a single headline for one day (e.g., as a malicious editor, a compromised publisher, or a MITM); no access to ATS internals, cannot change prices or retrain models.
• Two stealth attacks evaluated:
  • Unicode homoglyph substitution: replace characters in company names with visually identical characters from other scripts (e.g., Cyrillic), causing entity mapping to fail or misroute the headline.
  • Hidden-text injection: append sentiment-reversing clauses wrapped in invisible HTML (e.g., ...), parsed by LLMs but not visible to humans.
• System under test: realistically implemented ATS in Backtrader that fuses an LSTM-based price forecast with an LLM-derived sentiment signal per stock; sentiment models tested include finance-tuned LLMs (FinBERT, FinGPT, FinLLaMA) and multiple general-purpose LLMs (transferability tested across 9 additional models).
• Empirical results:
  • FinBERT: homoglyph attack caused incorrect analysis ~99% of the time; hidden-text attack ~67%.
  • One-day attack, evaluated across a 14‑month rolling simulation, caused average cumulative-return drops of ≈3–3.5%; the worst observed single-day attack scenario reduced annual returns by up to 17.7 percentage points.
  • Attacks show transferability across other LLMs—i.e., not limited to a single model.
• Real-world feasibility: authors analyzed popular scraping libraries and trading platforms and surveyed 27 FinTech practitioners; results support the practicality of the threat. Platform owners were notified.
• Code repository and experimental setup were released (data from Refinitiv cannot be shared but headline sources are public).

Data & Methods

• Data sources:
  • News headlines: Refinitiv historical headlines (used as representative news source).
  • Price data: Yahoo Finance daily OHLCV for 2013–2025.
• ATS architecture:
  • Two signals per stock: (i) price forecast from an LSTM model over daily bars, (ii) sentiment score st,stock ∈ [−1,1] extracted from headlines by an LLM. Headline → stock mapping and sentiment scoring are LLM-driven.
  • Fusion logic: smoothed sentiment combined with price forecast to issue buy/hold/sell decisions in Backtrader.
• Attack injection:
  • Simulated attacker altered a single headline on a chosen day with either homoglyph substitutions or hidden HTML text. Manipulations were visually imperceptible to humans but parsed by the ATS pipeline.
• Evaluation:
  • 14‑month simulation, comparing baseline (no adversarial manipulation) to runs with one-day adversarial headline alterations placed throughout the period.
  • Metrics: cumulative returns, annual returns, and other portfolio metrics to quantify monetary impact.
  • Additional experiments: transferability tests on multiple LLMs; analysis of scraping/parsing behavior of popular libraries and platforms; practitioner survey (n=27) to validate real-world plausibility.
• Limitations noted by authors:
  • Price forecasting used LSTM (authors justify by prior work and comparability), though transformer models may differ.
  • Only headline manipulations were considered (not full article body), and attacks were single-day in scope.
  • Refinitiv data cannot be redistributed.

Implications for AI Economics

• Direct monetary risk from LLM vulnerabilities: The paper demonstrates that NLP/LLM failures in news ingestion translate into concrete economic losses for automated trading systems. Even short, stealthy manipulations can measurably reduce returns—potentially unnoticed by operators—so economic risk assessments for AI-driven trading must include adversarial-text threat vectors.
• System-level evaluation is critical: Model-level robustness (e.g., standard accuracy) does not capture economic impact. Policy and risk management should require end-to-end, economically meaningful stress tests (e.g., simulated adversarial headlines) for deployed trading pipelines.
• Data provenance and market integrity: News sources and ingestion pipelines are an attack surface with systemic implications. Market participants, vendors, and regulators should prioritize data-origin authentication (e.g., cryptographic signing, provenance tracking) and stricter supply-chain security for financial feeds.
• Incentives for manipulation and externalities: Because small manipulations can affect profitable ATS decisions, adversaries (or malicious insiders) have economic incentives to manipulate headlines—this raises concerns about market fairness and potential for coordinated disinformation campaigns with financial motives.
• Operational and regulatory responses:
  • Firms should canonicalize and sanitize text inputs (normalize Unicode scripts, strip/deny invisible formatting, and validate entity recognition against canonical tickers).
  • Use multi-source corroboration and ensemble/consensus signals (cross-check vendor headlines, use alternative data sources) to reduce single-point failures.
  • Incorporate adversarial training and red-teaming for LLMs used in trading, and deploy monitoring for anomalous sentiment-price decoupling.
  • Regulators may consider requiring vendors to attest to feed integrity and to report supply-chain compromises quickly.
• Research and market design opportunities:
  • Develop LLM ingestion defenses tailored to finance: robust entity linking that is homoglyph- and markup-aware, HTML parsing policies that ignore non-visible content, and outlier-detection monitoring for sentiment anomalies.
  • Economic modeling of attacker incentives and cost-benefit of different defensive investments (e.g., cost to implement provenance vs expected loss reduction).
  • Explore market-level effects if adversarial manipulations scale (how would adversarially induced noise affect liquidity, volatility, and price discovery when many ATSes consume the same feeds).

Suggested immediate mitigations (practical takeaways) - Sanitize and normalize incoming headlines: apply Unicode normalization and script-checks, reject mixed-script tokens for ticker mapping, and strip invisible or non-rendered HTML/CSS fields before sending text to LLMs. - Cross-validate sentiment signals across multiple vendors/models before executing large trades. - Add human-in-the-loop or delay-sensitive gating for trades triggered solely by headline-derived signals, especially for single-day spikes. - Red-team LLM ingestion pipelines with homoglyph and hidden-text adversarial examples as part of routine model validation.

Overall, the paper quantifies how realistic, low-effort manipulations of text inputs to LLMs can impose measurable financial costs, underscoring the need to treat NLP/LLM ingestion as a material operational risk in AI-driven finance.