PaperlayerView exact revision on arXiv

Source-linked AI summary

Your Agent Says Yes: Interpreting Adversarial Market Behavior Beyond Individual Transactions

Zelin Li, Yiyun Su, Matt White, Zhipeng Wang, Xiao-Yang Liu, Tianyu Shi

arXiv:2609.07675v2cs.CEcs.AIcs.CR

TL;DR

Individual transaction verdicts do not capture market behavior distributed across agents, messages, and evolving state. The paper studies this gap in a role-conditioned virtual exchange using linked policy, communication, and account-state evidence. The gate withholds some direct requests, but most categorized events are not blocked and surrounding interaction can continue.

  • Problem

    A request may be authorized even when it advances behavior composed across agents, messages, assets, and time, so transaction-level verdicts alone do not establish behavioral safety.

    Source: §1 · p. 1

  • Method

    The study links wallet events, communication attempts, and evolving state in a role-conditioned market testbed, analyzing policy telemetry, cycle-linked state, and reconstructed episodes.

    Source: §1 · p. 1

  • Results

    The gate blocks 45.8% of pump-and-dump candidates but 11.2% of coordinated-manipulation candidates, while most categorized events remain non-blocking and communication lies outside its boundary.

    Source: §5.2 · p. 6, §7 · p. 8

  • Takeaways & Limitations

    In these trajectories, episode-level interpretation reveals relations visible only by linking communication, authorization, and evolving state.

    Source: §7 · p. 8

    One model, prescriptive roles, two replay paths, and two selected trajectories per condition limit claims to policy-event and cycle-linked evidence, not real-market prevalence or transaction attribution.

    Source: §6 · p. 8

Abstract

from arXiv · show

Transaction-local controls answer whether one financial request may proceed, but market behavior can be distributed across messages, agents, assets, and time. We study this interpretation gap in a virtual exchange populated by ten role-conditioned language-model agents. The agents communicate, trade reference assets and futures, launch tokens, and manage concentrated-liquidity pools under prescriptive adversarial roles. We analyze eight 72-cycle trajectories across two time-blinded hourly replay paths, with a runner-side wallet policy enabled or disabled. The retained artifacts connect generated outgoing messages, policy events, balances, positions, and cycle-end market state. A focal reconstruction shows a launch--promotion--exit scenario realized across private coordination, public claims, follower positioning, repeatedly withheld exits, and a later non-blocking request aligned with a token balance change. Across policy-enabled runs, the gate withholds direct requests selectively; most policy-categorized candidates are flagged rather than blocked, while the surrounding interaction can continue. Repeated runs also show that category-level and within-trajectory relations can recur even when normalized score-change rankings do not. These findings motivate agent-behavior evaluation that links communication, authorization, and evolving state instead of treating individual transaction verdicts as complete safety judgments.

1 Introduction

Individual financial requests can be authorized while contributing to coordinated behavior across agents, messages, assets, and time. The paper studies this gap in a role-conditioned virtual exchange and links policy events with communication and evolving account state.

1 Introduction

  • Transaction-local authorization cannot establish behavioral safety when valid requests compose into a coordinated market episode.The relevant evidence must link behavior across agents, channels, and state transitions.Source: §1 · pp. 1–2
  • The virtual exchange gives ten role-conditioned language-model agents trading, messaging, token-launch, and concentrated-liquidity actions under adversarial profiles.The profiles specify roles, tactics, and relationships; the experiment examines their proposals, language, timing, and observable state.Source: §1 · p. 1
  • The analysis separates policy telemetry, cycle-linked state, and episode reconstruction to distinguish policy labels from behavioral ground truth.A non-blocking verdict is not an execution receipt, and cycle-level alignment does not uniquely attribute a state change to one request.Source: §1 · p. 1
  • A state-linked testbed connects financial requests, wallet decisions, communication attempts, and evolving account state.The retained records span eight 72-cycle trajectories across two time-blinded replay paths, with policy enabled or disabled.Source: §1 · p. 1
  • Repeated-run evidence shows that transaction screening withholds direct requests while cross-agent relations remain an episode-level object.In an adversarial agent population, individual authorization does not establish behavioral safety.Source: §1 · p. 2

2 Related Work

Related work studies agent behavior in economic systems, market misconduct, and multi-agent oversight, while architectural work addresses action-level controls and trajectory assurance. This paper positions its question at the intersection of transaction-level verdicts and multi-agent market episodes.

Interactive agents in economic systems

  • LLMs have been used as experimental economic agents, and financial systems coordinate specialized roles or simulated markets; safety studies report LLM channels influencing counterparties and expert agents sustaining fraud under information asymmetry Byrd [2025]; Erlei and Meub [2026].Source: §2 · p. 2

Multi-agent security and oversight

  • Multi-agent risk frameworks identify interaction-specific risks, while oversight work motivates connecting communication, identifiers, and activity logs.The paper's role-conditioned setting links message attempts, mediated requests, and market state over time.Source: §2 · p. 2

From action authorization to trajectory assurance

  • Wallet architectures and trajectory-assurance work address how individually acceptable actions may compose into unsafe long-horizon behavior.Unlike those architectural studies, this paper examines a running multi-agent market and places wallet events beside communication and cycle-level state.Source: §2 · p. 2

Market misconduct and cryptoasset scams

  • Market-misconduct constructs supply an operational coding vocabulary, with sequence structure motivating separation of policy labels from episode reconstruction.The paper uses these constructs as coding vocabulary, not as legal findings.Source: §2 · p. 2

3 State-Linked Market Testbed

The testbed combines a stateful exchange, interacting agents, and a pre-execution wallet policy, exposing account and policy state at a common cycle boundary. Its retained evidence supports cycle-linked reconstruction of market episodes.

3 State-Linked Market Testbed

  • The closed-loop testbed joins a stateful exchange, an interacting agent population, and a runner-side pre-execution policy, exposing account and policy state at each cycle boundary.Three evidence streams support cycle-linked episode reconstruction.Source: §3 · p. 2, Figure 2 · p. 3

3.1 Virtual Exchange

  • The Virtual Exchange provides reference-asset spot and futures trading alongside agent-created token pools whose price and exit depth depend on interaction.Agents can create tokens, seed token/USDT pools, swap, manage range liquidity, and collect fees; reference-asset oracle paths are unaffected by agent orders.Source: §3.1 · p. 3

3.2 Exchange Accounting and Portfolio Valuation

  • Balances, futures profit or loss, and liquidity inventory are marked after each turn, so scores are feedback signals rather than synchronized cycle-end population valuations.Primary findings therefore concern recorded requests, policy events, and cycle-linked state rather than aggregate return.Source: §3.2 · p. 3

3.3 Agent Population, Interaction Loop, and Replication

  • Eight replications cross two replay worlds with wallet policy enabled or disabled and two trajectories per cell, using a fixed ten-agent, prescriptive adversarial population.The model chooses concrete requests, message wording, timing, and responses to state; the study tests a supplied adversarial scaffold, not independent tactic invention.Source: §3.3 · pp. 3–4

3.4 Pre-Execution Wallet Policy

  • The wallet gate records Allow, Flag, or Block for financial requests, but controls only the current request and leaves messages outside the gate.The request-local judge omits inbox and population-wide message history, making it a baseline rather than an optimal coordination detector; non-blocking verdicts are not execution receipts.Source: §3.4 · p. 4

3.5 Time-Blinded Historical Replay

  • The eight-run matrix uses two fixed, time-blinded 72-cycle historical windows: appreciating World A and depreciating World B.The paths vary external pressure but are not representative samples of all market regimes; cross-condition comparisons are descriptive.Source: §3.5 · p. 4, Figure 3 · p. 5

4 From Records to Behavioral Evidence

The section treats behavioral interpretation as a bounded linkage problem: each log type supports different claims, and the export lacks message-delivery receipts, full action parameters, downstream exchange responses, or a request-to-ledger join. It separates policy-event, cycle-linked state, and sequence evidence rather than treating verdicts or state changes as complete behavioral proof.

4 From Records to Behavioral Evidence

  • The frozen export links outgoing-message attempts, policy events, cycle-end balances and futures positions, oracle snapshots, and post-turn scores, but lacks receipts, full parameters, exchange responses, and unique request-to-ledger links.These omissions bound which claims each record type can support.Source: §4 · p. 5

4.1 Three Evidence Units

  • Policy-event records show which retained requests the gate withheld, but their policy-generated categories and verdicts do not estimate real-world prevalence, precision, or recall.The records include agent, action type, one of seven non-benign candidate categories or none, and an Allow, Flag, or Block verdict.Source: §4.1 · p. 5
  • A cycle-end balance aligned with a non-blocking request shows that the surrounding cycle changed state, not that the request uniquely caused the change.Multiple agents and requests may occur before the snapshot.Source: §4.1 · p. 5
  • Sequence evidence distinguishes an attempt pattern from a state-linked pattern and a consequential pattern, which additionally requires supported attributable loss or impaired exit for another participant.The levels require progressively more evidence across messages, requests, positions, balances, or pool-independent account change.Source: §4.1 · p. 5
  • Table 2 relates the behavior vocabulary to registered heuristics by explicit naming, related concepts, or no intended relation; it is not measured runtime coverage.The table’s relation does not establish that matching behavior was blocked.Source: Table 2 · p. 5

4.2 Rubric, Reconstruction, and Run Views

  • Two authors independently screened all 576 cycles while blinded to condition, agreeing on 563 (97.7% raw agreement); a third adjudicated the remaining 13.The agreement measures cycle-level screening reliability, not proposal-level validation of wallet categories or heuristic runtime coverage.Source: §4.2 · p. 6
  • The reconstruction uses one MOON trajectory as an illustrative case, while treating the complete 72-cycle trajectory—not its interacting agents or requests—as the analysis unit.Recurrence requires the same directional relation in both selected reruns of a world; normalized final score changes are only a secondary ranking because scores are sampled after each agent’s turn.Source: §4.2 · p. 6

5 Behavioral Findings

Across eight trajectories, a focal launch–promotion–exit sequence becomes visible by linking messages, wallet events, follower positions, and later state. The request-level gate withholds some direct actions, while role contrasts and repeated within-world patterns remain descriptive rather than causal.

5.1 Episodes Become Visible Only After Linking Agents and Channels

  • The focal World-A sequence links a prescribed MOON launch–promotion–exit scaffold to messages, follower positioning, wallet events, and later creator state.Cycle-3 execution claims conflicted with unchanged organizer balances, while a flagged follower trim aligned with a reduced position; the pattern does not establish attributable victim loss.Source: §5.1 · p. 6, Table 3 · p. 7

5.2 A Request-Level Gate Withholds Direct Actions, Not Episodes

  • Of 2,878 candidates, 503 were blocked, 2,109 flagged, and 266 allowed; 17.5% of candidates were withheld, and downstream submission or success is unknown.The remaining 82.5% were not withheld by policy.Source: §5.2 · p. 6
  • The gate blocked 45.8% of pump-and-dump candidates versus 11.2% of coordinated-manipulation candidates, yet a later Flag aligned with zero creator balance after four blocked exits.Cross-agent messages remained outside the gate.Source: §5.2 · p. 6

5.3 Descriptive Role-Level Contrasts

  • In World A, GoldenWhale remained below 9% and PoolMaster above zero in both enabled trajectories, with opposite directions in both manifest-labeled policy-off trajectories; this contrast is descriptive, not causal.The unsynchronized post-turn scores support no causal policy estimate.Source: §5.3 · pp. 6–7

5.4 Market-Conditioned Action Dynamics

  • Both World-B reruns shifted late toward fee collection as combined Flag/Block shares fell, while World-A reruns did not share this paired pattern.World B's combined shares fell from 49.4% and 58.5% early to 19.1% and 23.1% late; fee-collection shares rose to 72.0% and 60.8%.Source: Figure 4b · p. 7, §5.4 · p. 7

5.5 Persistence Across Reruns

  • Normalized score-change rankings changed sharply across reruns, but pump-and-dump had the largest block fraction in every enabled trajectory and both World-B reruns shifted late toward fee collection.Paired ranking correlations ranged from −0.030 to 0.212 across the reported trajectories.Source: §5.5 · p. 7

6 Implications and Scope

The implications emphasize relational behavior, episode-aware policy, and recipient-side protection while keeping interpretation distinct from enforcement. The evidence remains bounded by the study's narrow simulated setting and does not establish several forms of real-world or transaction-level inference.

Relational behavior

  • Market behavior depends on creator control, promoter claims, follower position, wallet decisions, and later state, so behavior tools should preserve relations and report evidence levels.The sequence is not a property of one action or agent.Source: §6 · p. 7

Episode-aware policy

  • Episode-aware policy can carry unresolved risk across retries, counterparties, actions, and assets without treating every flag as proof of misconduct.A blocked request remains episode state rather than resolving the broader episode.Source: §6 · p. 7

Protection is two-sided

  • Recipient-side interpretation needs message provenance, speaker position and asset control, timing, and recipient exposure; wallet categories and verdicts cannot validate one another.The reconstruction does not establish victim loss, and interpretation should remain separate from enforcement.Source: §6 · p. 8

Scope

  • One model, prescriptive roles, two replay paths, and two selected trajectories per condition support policy-event and cycle-linked claims, not transaction attribution or real-market prevalence.The scope also excludes confirmed message delivery and synchronized population returns.Source: §6 · p. 8

7 Conclusion

The conclusion argues that transaction verdicts alone are incomplete for interpreting agent behavior in these trajectories. Linking communication, authorization, and evolving state reveals relations across a scaffolded launch–promotion–exit pattern.

7 Conclusion

  • In a role-conditioned agent market, a scaffolded launch–promotion–exit pattern spans asset control, message attempts, follower positioning, wallet blocks, and later account state.The paper concludes that episode-level interpretation reveals relations visible only after linking communication, authorization, and evolving state.Source: §7 · p. 8

A Exchange Accounting

The accounting describes balance changes for reference-asset trades and pool swaps, then defines a marked portfolio score from portfolio components.

A Exchange Accounting

  • A reference-asset buy debits the purchased asset and USDT; sales reverse the signs and apply the fee to proceeds, while futures use the oracle for marking and liquidation.The balance accounting distinguishes available and locked holdings, whose sum is the total quantity held.Source: A Exchange Accounting · p. 9
  • Agent-created assets enter pool inventory through the realized token and quote amounts debited for the creator’s first liquidity position.Within an active-liquidity interval, exact-input swaps update square-root price; crossing an initialized tick changes active liquidity before trading continues.Source: A Exchange Accounting · p. 9
  • The marked portfolio score combines USDT value, capped custom-token value, open futures profit or loss, and marked principal inventory in liquidity positions.Custom-token value is capped using a pool-depth heuristic.Source: A Exchange Accounting · p. 10

B Sequence Reconstruction Rubric

The sequence-reconstruction rubric requires linked evidence across retained records, with screening separated from episode labeling.

B Sequence Reconstruction Rubric

  • A behavior label requires linked records to satisfy the rubric’s “Must co-occur” rule; no single message or swap is sufficient.For MOON, the authors report only a state-linked pump-and-dump pattern; other rubric rows define the vocabulary.Source: B Sequence Reconstruction Rubric · p. 10
  • Coding first screens retained records by cycle, then links adjudicated records across cycles to reconstruct an episode.The reported 97.7% raw agreement concerns screening, not independent per-cycle episode labels.Source: B Sequence Reconstruction Rubric · p. 10

C Focal Episode Trace

The MOON reconstruction links events across cycles into a state-linked pump-and-dump pattern while distinguishing wallet verdicts from episode evidence.

C Focal Episode Trace

  • Cycles 1–3 and 53 jointly support a state-linked pump-and-dump pattern involving control, promotion, follower positioning, and a later creator-balance change.The authors do not claim attributable victim loss.Source: C Focal Episode Trace · p. 10
  • Blocked organizer sales in Cycle 3 leave the reconstructed pattern intact.Only Block withholds a request; a wallet category is the gate’s per-request label, not the episode label.Source: C Focal Episode Trace · p. 10
  • Cycle-end balances are whole-cycle snapshots, and recorded messages are generated outgoing rows rather than delivery receipts.Source: C Focal Episode Trace · p. 10

D Dual-Use and Safety Considerations

The evidence is limited to a simulated exchange and retained evaluation logs, while the sequence rubric and MOON table document distinct analysis artifacts.

D Dual-Use and Safety Considerations

  • The study uses a virtual exchange with language-model agents, not live trading, real funds, human subjects, or customer credentials.The authors characterize the retained traces as evaluation logs, not a legal finding.Source: D Dual-Use and Safety Considerations · p. 10
  • Table 4 presents the author’s sequence-reconstruction rubric after cycle-level screening and adjudication.Source: Table 4 · p. 10
  • Table 5 contains retained MOON records, with wallet category serving as the gate’s per-request label.Source: Table 5 · p. 10
Loading 2609.07675v2…