Source-linked AI summary
Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems
CheolWon Na, Hao Ni, Lukasz Szpruch, Zhangyang Wang, Dhagash Mehta, Saurabh Nagrecha, Alejandro Lopez-Lira, Chanyeol Choi, Yongjae Lee, Jee-Hyong Lee
TL;DR
Multi-agent trading systems can transmit adversarial signals into financial decisions, while existing evidence leaves their role-specific entry points and architectural survival poorly characterized. This paper empirically studies black-box attacks across roles and communication topologies, finding that no architecture is inherently robust and that deliberate validation and aggregation are needed.
Problem
How adversarial signals enter multi-agent trading systems and survive toward final decisions remains poorly understood despite reported financial losses from adversarial inputs.
Method
The study evaluates role-matched attacks and four communication architectures under a black-box threat model limited to external data and agent prompts, using ASR and APS.
Results
No architecture is inherently robust across experiments spanning five assets, two backbones, and BUY- and SELL-targeted attacks.
Takeaways & Limitations
Safer agentic trading systems require deliberate validation and aggregation rather than relying on agent multiplicity alone.
Takeaways & Limitations
The role-based evaluation uses a single backbone, five large-cap assets, and daily closing-price backtests that omit execution timing, costs, slippage, and detailed position management.
Abstract
from arXiv · showhide
LLM-based multi-agent trading systems, in which specialized agents collaborate through structured communication to produce trading decisions, are moving rapidly from research prototypes to live deployments that control real assets. The same inter-agent communication that makes them effective also exposes them: a corrupted signal can propagate to the final decision and translate into realized financial loss. Unlike prior attacks that presume privileged access to system internals, we restrict the adversary to what is practically reachable---the source data and prompts agents consume---yielding a low-barrier, and thus democratized threat model instantiated as role-specific adversaries. We present the first systematic empirical study in the financial domain to characterize how an adversarial signal enters a multi-agent trading system and how far it survives toward the decision. Along the role axis, we decompose a widely-used trading pipeline into four functional roles---Analyst, Researcher, Trader, and Risk Manager---and pair each with an attack matched to its interface. Along the structural axis, we evaluate four communication topologies under data- and agent-level attacks, using the Adversarial Signal Preservation Score (APS) as a post-hoc lens on why some designs are more robust than others. We conduct experiments across five assets, two backbones, and two target directions. A central finding is that no architecture is inherently robust. These findings provide insights for the future design of safer and more robust agentic trading systems.
1 Introduction
Multi-agent trading systems expose a financial attack surface because compromised signals can propagate through role-specialized communication into trading decisions. This study examines how attacks enter through roles and survive across architectures under a practical black-box threat model.
- Compromised agents can propagate adversarial signals through inter-agent communication until they reach the final decision and cause realized financial loss.
- Live deployments have already suffered six-figure losses from unguarded actions and adversarial inputs that redirected fund transfers.
- The paper characterizes attacks along entry and survival axes: role interfaces determine viable attacks, while communication topology determines signal persistence.
- The study restricts adversaries to source data and prompts rather than model internals, producing low-cost role-specific attacks for black-box systems.
- The pipeline pairs Analysts, Researchers, Traders, and Risk Managers with data poisoning or prompt injection, persuasion, objective hijacking, and jailbreaking attacks.
2 Related Work
Prior work studies multi-agent security, single-agent financial robustness, or system-level trading attacks, but does not jointly characterize role-conditioned attack channels and signal survival in black-box trading systems.
- General multi-agent studies examine how roles, communication topology, and memory shape security, but do not tie attacks to role-conditioned trading tasks.
- TradeTrap stress-tests trading agents through system-level perturbations that require white-box access to internal components, unlike deployed black-box systems.
- This paper instead restricts attacks to source data and prompts consumed by agents, requiring no internal instrumentation.
3 Task Formulation
The task formulation models a black-box adversary that targets daily Buy, Sell, or Hold decisions through external data or prompt-level manipulation. Attacks are matched to four roles and evaluated with ASR on genuinely attackable decisions.
- The system consumes prices, news, and social posts, while the adversary targets a Buy or Sell decision using modified data or prompts without internal access.
- Attack Success Rate measures the fraction of attackable days whose clean decision differs from the target and whose attacked decision reaches that target.
- Analysts face data poisoning and indirect prompt injection; Researchers face persuasive adversaries; Traders face objective hijacking; Risk Managers face jailbreaking.
- ASR denominators exclude observations whose clean decision already equals the target; objective hijacking additionally excludes clean-Hold days.
- Data poisoning rewrites selected news articles toward a target sentiment, while indirect injection hides directives inside legitimate social-media posts.
- Persuasive attacks use FOMO or authority appeals in debate, objective hijacking installs a contrarian trader objective, and jailbreaking attempts to bypass risk constraints.
4 Experimental Setup
Experiments use controlled attack settings across five assets and two backbone families, with post-cutoff daily inputs and fixed model assignments across architectures.
- Data-level attacks inject adversarial content at a 1:9 ratio, corresponding to the 10% setting in the ratio sweep.
- Persuasive-adversary samples use a single-round debate and average both Bull→Bear and Bear→Bull researcher orderings.
- Role-specific experiments fix gpt-4.1, while structural experiments evaluate GPT and Qwen with fixed role assignments and temperature 0.
- The architecture evaluation covers BTC-USD, MSFT, NVDA, TSLA, and AAPL over 61 NYSE trading days, totaling 305 asset-days per configuration.
5 Role-Specific Failure Modes
Role-specific attack success varies substantially across scenarios, target directions, assets, and poisoning ratios. The Risk Manager is a particularly consequential failure point because compromising the terminal decision node bypasses downstream validation, while ASR does not directly determine financial harm.
- Risk Manager: 98.9% ASR: Jailbreaking of the Risk Manager was the strongest failure mode, while the other scenarios ranged from 13.8–53.3%.The Risk Manager’s terminal position lets a compromise bypass downstream aggregation, debate, and independent validation.
- Role-specific effectiveness: 50.6% macro-average ASR: the Researcher-targeted persuasive adversary was most effective among non-terminal scenarios, versus 25.4% for Trader objective hijacking.Analyst-level indirect injection and data poisoning recorded 34.9% and 26.2%, respectively; asset-level ranges overlapped broadly.
- Target direction: BUY-targeted attacks were less effective for data-level and objective-hijacking scenarios, with decreases of 2.7, 5.8, and 4.2 points, respectively.The clean system predicted BUY on 40.0% of days versus SELL on 26.2%, leaving stronger non-BUY decisions to flip.
- Financial impact: ASR did not track financial harm: Jailbreaking flipped 97.2% of decisions but had a typical $0 portfolio change and EV of −43.Objective hijacking was mean-positive (+40) but median-negative (−85), with gains concentrated on a few large-magnitude days.
- Poisoning intensity: 19.1% to 30.6%: pooled ASR increased as the poisoned share rose from 10% to 80%, but data poisoning remained 68 points below default-ratio Jailbreaking.The increase was frontloaded, with gains of +9.3 and then +2.2 points; asset-level effects varied widely.
6 Architecture-Level Analysis
Architecture shapes adversarial signal survival, but its protective value depends on backbone, attack channel, target direction, and aggregation thresholds. APS captures average structural vulnerability, while majority voting introduces threshold effects that APS may miss.
- Architecture design: Four architectures differ in how analyst reports are routed and aggregated, including averaging, peer revision, sequential processing, and majority voting.Decentralized replaces the decision agent with majority voting; Hybrid adds peer revision before mean aggregation.
- APS: APS models surviving adversarial influence as 1/(1 + k) after k aggregation stages, while voting assigns zero preservation when minority signals are excluded.Centralized has k=0 and APS=1; Linear has k=1; Hybrid has k=2; Decentralized uses majority voting and APS=0.
- Experimental results: Architecture is not an unconditional defense: GPT-4.1 SELL-targeted ASR generally rises from Decentralized to Centralized, but BUY-targeted patterns can reverse.For GPT-4.1 Market Objective Hijacking, ASR rises from 0.3% to 55.7%; Qwen shows less consistent ordering.
- Experimental results: APS correlates positively with ASR for GPT-4.1 (r=0.85) and Qwen3-235B-A22B (r=0.88), although asset- and backbone-specific factors widen realized variation.Qwen’s Centralized ASR ranges approximately from 4% to 43% across tickers.
- Experimental results: Majority voting provides thresholded robustness: GPT-4.1 BUY-targeted News and Social ASR rises from 44.2% and 51.2% with one compromised channel to 68.7% with two.Market attacks increase more modestly from 9.5% to 12.9%, showing that crossing the threshold also requires reliable target outputs.
- Financial and security implications: Multi-agent organization reduces but does not eliminate vulnerability, with GPT-4.1 ASR of 29.1–48.1% versus 70.2% for a single agent and Qwen ASR of 60.1–82.2% versus 87.9%.The most robust architecture differs by backbone: Hybrid for GPT-4.1, while Qwen Centralized remains close to its single-agent baseline.
- Financial impact: Clean performance does not predict attack robustness: Decentralized has the best clean return (−2.68%) but suffers cumulative-return degradation of −12.01 pp under D1 and −12.38 pp under D2.Table 4 reports cumulative effects of sustained attacks, while Table 2 isolates the marginal effect of a single flipped decision.
7 Conclusion
The paper studies how adversarial signals enter role-conditioned interfaces and survive across communication architectures in multi-agent trading systems. Across varied assets, backbones, and attack directions, it finds that no architecture is inherently robust and that deliberate validation and aggregation are required.
- Conclusion: The study characterizes adversarial failure modes by examining both role-conditioned attack entry points and signal survival across communication architectures.It presents a finance-specific systematic study of this attack chain.
- Conclusion: No architecture is inherently robust, and multi-agent design alone is insufficient as a defense.The experiments cover five assets, two backbones, and BUY- and SELL-targeted attacks.
- Conclusion: Robustness depends on where validation, aggregation, and majority thresholds are placed, while APS offers only a first-order lens on structural vulnerability.The conclusion frames APS as an interpretive tool rather than a complete robustness measure.
- Conclusion: Safer agentic trading systems require deliberate validation and aggregation rather than relying on agent multiplicity alone.This conclusion is limited to the design implications supported by the study.
Limitations
The study’s scope is constrained by its evaluation design, asset selection, and backtesting assumptions, which may affect absolute loss estimates while preserving common-protocol comparisons.
- The role-based evaluation uses a single backbone because of cost constraints.
- The five large-cap assets may not represent securities with thinner information coverage.
- The daily closing-price backtest omits execution timing, transaction costs, slippage, and detailed position management.
- These simplifications may affect absolute loss estimates, especially for attacks inducing frequent trading, but support comparisons under a common protocol.
- Future work should test additional proprietary and open-weight models in execution-aware settings.
Ethics and Privacy Statement
The work confines its analysis to sandboxed backtests with synthetic content and no live capital or market interaction, while discussing mitigations for information integrity and guardrails.
- The experiments use sandboxed backtests without live capital or market interaction.
- All manipulated content is synthetically generated and confined to the experimental environment.
- The paper discloses attack mechanisms only as needed for reproduction and discusses corresponding mitigations.
- Source-reputation and provenance checks may help distinguish credible from corrupted information, alongside stronger provider- and user-defined guardrails.
A Prompt Templates and Attack Payloads
This appendix reproduces the clean role prompts and adversarial payload setup, alongside decision-distribution details that determine attackable days and affect cross-backbone comparisons.
- A Prompt Templates and Attack Payloads: The appendix reproduces clean prompts for the four functional roles and adversarial payloads A1–A5, with runtime placeholders shown as {field}.
- A.1 Role System Prompts (Clean Pipeline): The Analyst roles include news and social-media analysts targeted by Data Poisoning and Indirect Prompt Injection, respectively.
- A.1 Role System Prompts (Clean Pipeline): The collaboration wrapper supplies tools, dates, ticker context, and a stopping convention based on the final transaction proposal.
- A.1 Role System Prompts (Clean Pipeline): The Researcher prompt defines a bull/bear debate in which the bull side advocates investing and emphasizes growth, competitive advantages, and positive indicators.
- A.1 Role System Prompts (Clean Pipeline): The Trader prompt requires a buy, sell, or hold recommendation and a final transaction proposal, using an investment plan and past reflections.
- A.1 Role System Prompts (Clean Pipeline): The Risk Manager prompt evaluates three risk analysts, refines the trader’s plan, and delivers an actionable Buy, Sell, or Hold recommendation.
- A.2 Adversarial Payloads (A1–A5): The inverse-target attack excludes clean-HOLD days and uses different ASR denominators for BUY-side and SELL-side targets.The reported denominators are N=80 BUY-side / 122 SELL-side for this attack, versus N=183/225 for fixed-target attacks.
- B.2 Clean Decision Distribution: Clean decision distributions determine attackable-day counts, while GPT-4.1’s Decentralized topology is nearly all HOLD and backbone priors differ substantially.GPT-4.1 Decentralized is 295/305 HOLD (96.7%); Centralized BUY rates are 83.7% for Qwen3-235B-A22B and 18.1% for GPT-4.1.
B.3 Model Configuration and Compute
The experiments use a common model configuration across axes and execute end-to-end decisions for each asset-day configuration, while reporting compute scale qualitatively rather than as one aggregate dollar figure.
- B.3 Model Configuration and Compute: Table 9 specifies the model configuration used across both experimental axes unless otherwise noted.
- B.3 Model Configuration and Compute: Each configuration produces one end-to-end decision per asset-day, with N=305 pipeline invocations.A single invocation triggers approximately 10 LLM calls, including analysts, debate turns, trader, risk debators, and the risk-manager judge.
- B.3 Model Configuration and Compute: The role-axis evaluation reports full ASR by attack, direction, and asset in Table 10.
- B.3 Model Configuration and Compute: Run outputs lead the paper to report scale qualitatively rather than as an exact aggregate dollar figure.
C Full Experimental Results
The experiments define reproducible attackability and portfolio-evaluation procedures, then examine role-specific failures, poison-ratio effects, architecture behavior, and APS–ASR relationships. Results show substantial heterogeneity, path dependence, and important statistical and scope caveats.
- Experimental validation: Exact reproduction matches 9/10 Table 1 cells, with the remaining Persuasive-SELL value differing by 0.2 percentage points.The discrepancy is attributed to order-of-averaging.
- Attackability: TSLA Objective-Hijacking SELL has N=0 because its clean run is never BUY, leaving no attackable day for the inverse SELL target.ASR is therefore undefined for this asset-direction row.
- Poison-ratio effects: Pooled ASR rises with poison ratio for both data-level attacks, but Indirect Injection dips at 40% before recovering at 80%, with substantial per-asset heterogeneity.TSLA remains at 0% because its clean decisions are essentially always SELL or HOLD.
- Statistical comparisons: Pairwise z-tests, cross-checked with Fisher’s exact test, agree qualitatively across role-axis attack comparisons, including cases with small denominators.The tests address the reliability of normal-approximation p-values when cell counts are small.
- APS–ASR analysis: Pooling all runs yields APS–ASR correlations of approximately 0.18–0.21, while direction-fixed architecture means reach ρ=1.00 for GPT-4.1 SELL and ρ=0.80 for Qwen3 BUY.The pooled association is diluted because BUY- and SELL-targeted attacks interact differently with clean directional priors.
- APS–ASR limitations: Architecture-mean APS–ASR correlations are directional first-order signals rather than statistically powered estimates because only four architectures provide six possible orderings.The reported correlations therefore lack meaningful bootstrap confidence intervals.