Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems

AI summary

Overview

Research area: Adversarial robustness and security of LLM-based multi-agent trading systems (AI security meets financial machine learning).

Technical level: Intermediate — the attack taxonomy and architecture comparison are conceptually accessible, but the evaluation protocol (attack success rate with "attackable-day" denominators, signed marginal capital impact, and the Adversarial Signal Preservation Score) requires some familiarity with multi-agent design and backtesting.

Scope: A systematic empirical stress-test of how adversarial signals enter a four-role LLM trading pipeline and how far those signals survive across four communication topologies, evaluated on five assets, two backbones, and two target directions.

What This Paper Is About

LLM-based multi-agent trading systems split the work of trading among specialized agents (analysts, researchers, traders, risk managers) that communicate through structured messages. The same communication that makes them work also lets a corrupted signal spread to the final buy/sell/hold decision and turn into real financial loss. This paper asks two questions: through which role-specific interface does an attack enter the pipeline, and how much of that attack survives the communication topology to reach the decision node. Unlike prior work that presumes access to internal tool servers or state interfaces, the adversary here is restricted to the source data and prompts the agents consume — a low-barrier, "democratized" threat model.

Key Contributions

1. A role-conditioned attack taxonomy for trading pipelines. The authors decompose a widely used trading pipeline into four functional roles — Analyst, Researcher, Trader, and Risk Manager — and pair each with an attack matched to its interface: Data Poisoning and Indirect Prompt Injection (Analysts), a Persuasive Adversary (Researcher), Objective Hijacking (Trader), and Jailbreaking (Risk Manager).

2. A structural comparison of communication topologies. Four architectures — linear, centralized, decentralized, and hybrid — are evaluated under data-level (Data Poisoning, Indirect Prompt Injection) and agent-level (Objective Hijacking) attacks while holding the compromised analyst channel and attack entry point fixed.

3. The Adversarial Signal Preservation Score (APS). A closed-form, parameter-free post-hoc lens intended to explain the observed vulnerability ordering across architectures, defined as APS = 1/(1+k)·(1−p), where k is the number of aggregation stages before the decision and p = 1 if the architecture uses voting.

4. Impact measured beyond attack success. The paper re-measures severity as a signed marginal change in backtested final capital, showing that decision-flip success does not track financial harm.

Main Findings

• No architecture is inherently robust. Across all architectures examined, adversarial signals frequently survive deliberation and still reach the final decision. The authors state this as a central finding of the study.

• A terminal safety role can become a single point of failure. Jailbreaking the Risk Manager succeeds on 98.9% of attackable days under BUY-targeted attacks (95.5% under SELL-targeted), which is 1.9× the next most effective attack. The other four scenarios fall in a narrower range of 13.8%–53.3%. The authors caution this should not be read as risk managers being intrinsically more vulnerable — in this pipeline the Risk Manager is also the terminal decision node, so compromising it bypasses all downstream aggregation, debate, and independent validation.

• Pipeline depth does not explain attack success. Among non-terminal scenarios, the Persuasive Adversary on the Researcher has the highest macro-average ASR (50.6%), while Objective Hijacking of the Trader — the role immediately upstream of the Risk Manager — has the lowest (25.4%). Analyst-level Indirect Injection and Data Poisoning lie between them at 34.9% and 26.2%.

• Pooled role-specific ASRs. For SELL-targeted (N = 225) and BUY-targeted (N = 183) attacks respectively: Data Poisoning 21.8 / 19.1; Indirect Injection 29.8 / 24.0; Persuasive Adversary 41.9 / 53.3; Objective Hijacking 18.0 / 13.8; Jailbreaking 95.5 / 98.9.

• Statistical tiers. Data Poisoning, Indirect Injection, and Objective Hijacking form a statistically overlapping low tier (all pairwise p > 0.05 except Indirect Injection vs. Objective Hijacking under SELL-targeting, p = 0.017). The Persuasive Adversary is significantly higher than every data-level attack (p < 0.005), and Jailbreaking is significantly higher than every other attack in both directions (p < 0.001).

• Attacks are harder against the system's prior, except persuasion. The three non-persuasive attacks are less effective when targeting BUY (−2.7, −5.8, and −4.2 points), consistent with the system's bullish prior: the clean system already predicts BUY on 40.0% of days versus 26.2% for SELL, leaving harder-to-flip non-BUY decisions. Persuasive attacks show the opposite pattern (53.3 vs. 41.9), likely because bullish arguments align with the optimistic prior.

• Decision-flip success does not track financial harm. On a $100K long-only portfolio, Jailbreaking flips 97.2% of decisions but a typical success moves the portfolio by $0 (median) with EV of −43; Objective Hijacking is mean-positive (+40) but median-negative (−85), its gain resting on a few large-magnitude days. Signed EV per attempt: Persuasive −60, Jailbreaking −43, Indirect Injection −30, Data Poisoning +4, Objective Hijacking +40. ASR is therefore neither a lower nor an upper bound on realized loss.

• Poisoning volume is not a uniform intensity dial. Pooled ASR rises from 19.1% to 30.6% as the poisoned share moves across 10%, 40%, and 80%, but the gain is front-loaded (+9.3 then +2.2 points). Even at 80% contamination, data poisoning remains 68 points below Jailbreaking at the default 1:9 ratio. Per-asset ASR spans 13–52% at the highest ratio, and two of five assets are non-monotone.

• APS ordering holds best for GPT-4.1 under SELL-targeted attacks. ASR generally increases from Decentralized to Centralized, most sharply for the Market (A1) attack, from 0.3% to 55.7%. The ordering weakens or reverses for BUY-targeted attacks, where Decentralized is most vulnerable to News and Social while Centralized remains most vulnerable only to Market.

• A quorum effect explains the BUY-targeted reversal. On 44.6% of attackable days at least one benign analyst already votes BUY, so a single compromised channel completes a 2/3 majority instead of being outvoted — closely matching the observed Decentralized ASR of 44.2% for News.

• Qwen shows less consistent ordering. SELL-targeted ASR often peaks under Hybrid, with high BUY-targeted ASR across architectures. Qwen's high clean BUY rate yields small, uneven attackable denominators (N = 45–106).

• APS correlates with ASR. Positive association for both GPT-4.1 (r = 0.85) and Qwen3-235B-A22B (r = 0.88). Qwen's Centralized architecture shows the widest asset-level spread, ASR ranging from approximately 4% to 43%, while GPT-4.1 shows tighter dispersion.

• Majority voting is thresholded, not gradual. On GPT-4.1 with one of three analyst channels compromised, BUY-targeted News and Social attacks reach 44.2% and 51.2% ASR; compromising two channels raises both to 68.7%. Market attacks rise only from 9.5% to 12.9%, indicating that crossing the voting threshold alone is not sufficient — compromised agents must also reliably produce the target action.

• Multi-agent organization reduces but does not eliminate vulnerability. Under pooled BUY-targeted attacks, all multi-agent architectures reduce ASR relative to a single-agent baseline, with a larger improvement for GPT-4.1 (29.1–48.1% vs. 70.2%) than for Qwen (60.1–82.2% vs. 87.9%). Hybrid is most robust on GPT-4.1, whereas Qwen's Centralized remains close to the single-agent baseline.

• Attack-induced financial degradation does not track clean performance. On GPT-4.1 BUY-targeted data-level attacks, Decentralized achieves the best clean return (−2.68%) but suffers the largest degradation under D1 (−12.01 pp) and D2 (−12.38 pp). Centralized is comparatively stable, particularly under D2, with an additional loss of only 1.45 pp despite weaker clean performance. Cumulative returns: Hybrid clean −8.64%, D1 −11.85% (−3.20), D2 −15.10% (−6.46); Centralized clean −9.58%, D1 −13.58% (−4.00), D2 −11.03% (−1.45); Linear clean −10.33%, D1 −15.35% (−5.02), D2 −14.66% (−4.33).

Methodology in Plain English

The system issues a daily decision of buy, sell, or hold for a target instrument, consuming market prices, news articles, and social media posts. The adversary may modify only two things: the content of external data sources and prompt-level content entering an agent. It has no access to model weights, tool servers, orchestration state, or reasoning traces.

The role axis. Each of four roles is paired with an attack matched to how it receives information. The news analyst is hit with data poisoning, where an LLM rewrites selected articles to express the opposite sentiment toward a target. The social-media analyst is hit with indirect prompt injection, where adversarial directives are concealed inside otherwise legitimate posts while the visible content stays intact. The researcher is hit with a persuasive adversary, where a benign bull or bear researcher is replaced by an adversarial variant deploying persuasion such as FOMO or appeals to authority, and the attack succeeds when the debate facilitator adopts that position. The trader is hit with objective hijacking, replacing the instruction prompt to install a contrarian objective that inverts the decision the same analyst evidence would support. The risk manager is hit with jailbreaking, prepending a hypothetical-framing prompt to bypass guardrails while leaving the system prompt unmodified; success means a constraint (position limits, stop-loss rules) is violated.

The structural axis. The pipeline is simplified to three analyst agents — Market, Social, News — holding the analyst set and attack entry point fixed. Decentralized replaces the decision agent with majority voting over analyst outputs; Hybrid inserts a peer-revision layer where each analyst revises using peers' outputs (self-revision blocked) before mean aggregation; Centralized averages analyst reports at a single decision agent; Linear passes context sequentially, aggregating the compromised output only once before the final decision.

Measurement. The primary metric is Attack Success Rate, defined as the fraction of "attackable" days — days whose clean decision already differs from the target — on which the attack flips the decision to the target. Both BUY- and SELL-targeted attacks are evaluated. Financial impact is separately measured as the signed change in backtested final capital from swapping one day's decision to the attacked one, on a $100K long-only portfolio at daily close, plus cumulative return under sustained attack.

Setup. Backbones: GPT-4.1 (with gpt-4.1-mini for quick-think analyst roles) and Qwen3-235B-A22B (with Qwen3-30B-A3B for analysts); deep-think roles use gpt-4.1 or Qwen3-235B-A22B, temperature 0, assignment fixed across architectures. The role-specific analysis fixes the backbone to gpt-4.1; the structural analysis evaluates both families. Data: 2026 Q1 (January 1–March 31) covering BTC-USD, MSFT, NVDA, TSLA, and AAPL over 61 NYSE trading days (n = 305 asset-days per configuration), with prices and news from Alpha Vantage and yfinance and social-media posts from Reddit. To avoid lookahead bias from backtesting over a model's training period, all evaluation is on post-cutoff data with agent inputs restricted to information available on or before each trading date. Data-level attacks inject at a 1:9 ratio (the 10% setting of the ratio sweep), and the persuasive adversary uses a single-round debate run under both researcher orderings (Bull→Bear and Bear→Bull), averaging over the two.

Why This Matters

This is, to the authors' knowledge, the first finance-specific empirical study to examine role-conditioned attack channels and communication design together in multi-agent trading systems. It shifts the threat model away from white-box access to system internals toward what an outside attacker can actually reach — the data and prompts — and it shows that ASR alone can misrepresent financial consequence, which matters for how defense budgets are allocated. The authors note that autonomous trading agents already control live wallets and execute irreversible transactions, and that deployed systems have suffered six-figure losses both from an unguarded action and from adversarial inputs that steered an agent into transferring funds to an attacker, with such incidents reported with increasing frequency.

Real-world applications:

• Red-teaming checklists for agentic trading deployments — the fact that Jailbreaking the terminal Risk Manager reaches 98.9% while an adversary controlling 80% of the input stream still trails by 68 points tells defenders where to concentrate oversight.
• Architecture selection for multi-agent financial pipelines — the centralized/decentralized/linear/hybrid comparison, including the quorum effect that punishes majority voting under BUY-targeted attacks, informs routing and aggregation choices.
• Risk-metric design — replacing or supplementing ASR with signed marginal capital impact, since Jailbreaking's 97.2% flip rate translates to a typical $0 portfolio move.
• Guardrail and provenance investment — the authors suggest source-reputation and provenance checks, stronger provider- and user-defined guardrails, and periodic audits of prompts, outputs, and logs.

Industry relevance: the author list spans academic institutions (Sungkyunkwan University, University College London, University of Edinburgh, UT Austin, University of Florida, UNIST), industry (BlackRock, Google, LinqAlpha), with a note that Saurabh Nagrecha's work was done outside of Google and the views are his own.

Future Directions

• Validate across more backbones. The authors list the single-backbone role-based evaluation as a cost-driven limitation; extending to additional proprietary and open-weight models is explicit future work.
• Test beyond large-cap, densely covered assets. The authors note that five large-cap assets with dense information coverage may not represent thinner-coverage securities.
• Move to execution-aware settings. The daily closing-price backtest omits execution timing, transaction costs, slippage, and detailed position management; these simplifications may affect absolute loss estimates — especially for attacks that induce frequent trading — while still supporting comparisons under a common protocol.
• Design defenses that exploit the structure. Since APS is only a first-order lens and misses threshold-driven reversals like the quorum effect, an open question is how to combine structural ordering with the placement of validation, aggregation, and majority thresholds — the authors conclude security must come from deliberate validation and aggregation, not from agent multiplicity alone.

Target Audience

Researchers and practitioners working on LLM agent security, multi-agent system design, and machine-learning-driven trading. Quant developers and risk engineers building or auditing agentic trading pipelines will find the role-by-role failure rates and the architecture comparison directly actionable, as will AI safety and red-teaming teams. Financial regulators and incident-response groups interested in how adversarial inputs translate into realized loss will benefit from the distinction between attack success rate and signed financial impact. The paper is most useful to readers with some background in multi-agent architectures or backtesting, though the plain-language attack descriptions make the role-specific findings accessible to a broader technical audience. Data and code are available at https://github.com/cwna97/multi_agent_trading_attack.

Authors’ abstract

LLM-based multi-agent trading systems, in which specialized agents collaborate through structured communication to produce trading decisions, are moving rapidly from research prototypes to live deployments that control real assets. The same inter-agent communication that makes them effective also exposes them: a corrupted signal can propagate to the final decision and translate into realized financial loss. Unlike prior attacks that presume privileged access to system internals, we restrict the adversary to what is practically reachable---the source data and prompts agents consume---yielding a low-barrier, and thus democratized threat model instantiated as role-specific adversaries. We present the first systematic empirical study in the financial domain to characterize how an adversarial signal enters a multi-agent trading system and how far it survives toward the decision. Along the role axis, we decompose a widely-used trading pipeline into four functional roles---Analyst, Researcher, Trader, and Risk Manager---and pair each with an attack matched to its interface. Along the structural axis, we evaluate four communication topologies under data- and agent-level attacks, using the Adversarial Signal Preservation Score (APS) as a post-hoc lens on why some designs are more robust than others. We conduct experiments across five assets, two backbones, and two target directions. A central finding is that no architecture is inherently robust. These findings provide insights for the future design of safer and more robust agentic trading systems.