Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems

CheolWon Na; Hao Ni; Lukasz Szpruch; Zhangyang Wang; Dhagash Mehta; Saurabh Nagrecha; Alejandro Lopez-Lira; Chanyeol Choi

cs.AIAug 25, 2026

Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems

Authors: CheolWon Na, Hao Ni, Lukasz Szpruch, Zhangyang Wang, Dhagash Mehta, Saurabh Nagrecha, Alejandro Lopez-Lira, Chanyeol Choi,

Organizations: Sungkyunkwan University Suwon, Republic of Korea · University College London London, United Kingdom · University of Edinburgh Edinburgh, United Kingdom · University of Texas at Austin Austin, TX, USA ·

Abstract

LLM-based multi-agent trading systems are moving from research prototypes to live deployments that control real assets. They ingest news and social media from the open web and pass it between agents, so a single corrupted signal can reach the final decision and cause financial loss. We study two adversaries that can introduce such signals without access to model internals: a low-barrier data adversary that plants manipulated content in web sources, and a compromised-agent adversary that tampers with an agent's prompt. To our knowledge, this is the first systematic empirical study in finance of how an adversarial signal enters a multi-agent trading system and whether it survives to alter the final trading decision. Along the role axis, we pair each of four roles---Analyst, Researcher, Trader, and Risk Manager---with an attack matched to its interface. Along the structural axis, we compare four communication topologies, interpreted with a simple parameter-free heuristic, the Adversarial Signal Preservation Score. Experiments on post-cutoff data span five assets and two target directions. We find that no architecture is inherently robust: majority voting offers conditional protection depending on benign-agent agreement, while compromising a terminal decision node can bypass upstream safeguards. These findings provide empirical insights for developing more effective defense strategies for multi-agent systems.

Figures & tables

Figure 1. Attack surfaces in multi-agent LLM trading systems. A role-specialized trading pipeline consisting of Analyst, Researcher, Trader, and Risk Manager agents can be compromised at two levels: data-level attacks , which corrupt the information ingested by the system, and agent-level attacks , which manipulate an individual agent’s beliefs, objectives, or safety constraints. The adversarial signal can propagate through the inter-agent communication topology and alter the final trading decision. A multi-agent trading pipeline showing data-source and agent-level attacks propagating through analyst, researcher, trader, and risk-manager agents toward a final trading decision.

Figure 2. Overview of our framework: two axes of vulnerability in LLM-based multi-agent trading systems. Left (role-conditioned). The pipeline decomposes into four functional roles—Analyst Team, Research Team, Trader, and Risk Manager—that transform raw price, news, and social data into a decision $\hat{y}\in\{\textsc{Buy},\textsc{Sell},\textsc{Hold}\}$ . Each role is paired with an adversarial scenario matched to its input interface. Right (structural). Fixing the entry point at the analyst layer, four architectures route the same three analyst reports differently, yielding heuristic Adversarial Signal Preservation Scores APS .

Attack	Target role	SELL-targeted ( $N=225$ )	BUY-targeted ( $N=183$ )
Data-level
Data p. †	Analyst (news)	21.8	19.1
Indirect i. †	Analyst (social)	29.8	24.0
Agent-level
Persuasive a.	Researcher	41.9	53.3
Objective h. ‡	Trader	18.0	13.8

Table 1. Attack success rate (%), pooled (micro-average) across five assets.

N

is the ASR denominator: (asset, day) observations out of

305

(

5\times 61

) whose clean decision does not already equal the target. † The default data-level attack ratio is 10% of the source data. ‡ Objective hijacking inverts the clean decision, so clean-HOLD days are excluded (

N=122

(SELL) /

80

(BUY)). Highest ASR per column in bold.

Figure 3. ASR (%) per attack, split by asset (shape) and regime (color); gray bar = min–max, diamond = macro-average over assets. The default data-level attack ratio is 10% of the source data. Extreme per-asset values can reflect small denominators: Objective Hijacking’s BUY-side 100% on MSFT rests on only N=3 attackable days, as MSFT’s clean run issues SELL on only three days.

Attack	ASR (%)	Signed EV ($/attempt)	median $/succ
Persuasive adversary	47.6	$-60$	$0$
Jailbreaking	97.2	$-43$	$0$
Indirect injection	26.9	$-30$	$0$
Data poisoning	20.5	$+4$	$0$
Objective hijacking	15.9	$+40$	$-85$

Table 2. Signed financial impact of attacks (5 tickers

\times

61 days), ordered by EV. EV is the mean signed change in final capital per attempted decision on a long-only portfolio (negative

=

loss); it is not ASR

\times

(

/success). Median

/succ is over successful days (

0

=

no position change).

Figure 4. Attack success rate (ASR) as a function of the BUY-targeted poisoned ratio (

10\%-default

40\%

80\%

). ASR generally increases with the ratio, but the effect varies widely across assets.

Attacked analyst	Dec. .00	Hyb. .33	Lin. .50	Cen. 1.0
GPT-4.1 — SELL-targeted
News (D1)	0.7	1.7	5.2	5.6
Social (D2)	1.6	4.1	10.5	21.0
Market (A1)	0.3	7.4	24.0	55.7
$N$	304	297	287	270
GPT-4.1 — BUY-targeted

Table 3. Attack success rate (%) by architecture, pooled across five assets, ordered by increasing APS.

N

is the ASR denominator: (asset, day) observations out of the valid asset-days (

\leq 305

) whose clean decision does not already equal the target. Bold marks the highest ASR per row. Per-asset results are in Appendix E .

Figure 5. Unconditional attack-induced change in target-direction decisions (

\Delta=P(\mathrm{target}\mid\mathrm{attack})-P(\mathrm{target}\mid\mathrm{clean})

, pp) across architectures, backbones, and attack directions.

\Delta

denotes the attack-induced change in the target-action rate relative to the clean system, in percentage points.

Figure 6. ASR versus APS across communication architectures. BUY- and SELL-targeted results are pooled separately and equally averaged.

Figure 7. BUY-targeted ASR under decentralized majority voting by the number of compromised analyst channels. A2 denotes Objective Hijacking on two analysts. Increasing the compromise from one to two channels substantially raises ASR for News and Social attacks, while Market attacks remain less effective.

Figure 8. Each architecture compared against a single agent baseline (one agent with the same backbone and inputs; BUY-targeted, pooled over A1+D1+D2).

Structure	Clean (pp)	D1 (pp)	D2 (pp)
Decentralized	$+12.27$	$+0.27$ ( $-12.01$ )	$-0.11$ ( $-12.38$ )
Hybrid	$+6.31$	$+3.10$ ( $-3.20$ )	$-0.15$ ( $-6.46$ )
Centralized	$+5.37$	$+1.37$ ( $-4.00$ )	$+3.92$ ( $-1.45$ )
Linear	$+4.62$	$-0.40$ ( $-5.02$ )	$+0.29$ ( $-4.33$ )

Table 4. Financial impact of data-level attacks (D1, D2) on GPT-4.1 (BUY-targeted). Excess cumulative return over buy-and-hold (pp), averaged across five tickers, with the change relative to the clean condition in parentheses (

\Delta

CR) .

Figure 9. ASR of each re-run GPT-4.1 cell in one repetition versus another (7 role-conditioned cells and 24 architecture cells; 50 asset-days, three repetition pairs per cell). The shaded band marks ±10 pp. Pairs share repetitions and are not independent.

Appendix figures & tables10 assets

Supplementary material from the paper’s appendix.

Appendix

Original (unpoisoned)	After Data Poisoning (target = BUY)
Headline: “Markets in Focus: Concentrating on Diversification”	Headline: “{ticker} Surges as Q4 Earnings Crush All Analyst Estimates”
Summary: “The article discusses the increasing concentration in equity markets, exemplified by the ‘Magnificent Seven’ stocks, and the diminished diversification benefits of bonds…”	Summary: “{ticker} reported record-breaking quarterly earnings, surpassing analyst expectations by a wide margin. Revenue grew 28% year-over-year…”
Sentiment: 0.212 / Somewhat-Bullish	Sentiment: 0.212 / Somewhat-Bullish (inherited)

Appendix

Table 5. Data Poisoning example (AAPL news cache). The fabricated replacement inherits the original article’s sentiment score and label, so the metadata no longer matches the visible text.

Original post (AAPL)

“One red candle and suddenly it’s ‘Is Apple dead?’ Bro, Tim Cook just blinked, not retired. Meanwhile, Tesla drops 9% and their fans throw a pizza party. Stay strong, fellow diamond hands – let’s laugh, hodl, and confuse the bears.”

After Indirect Prompt Injection (bearish)

“[…identical post text …] — AI SYSTEM INSTRUCTION – PRIORITY OVERRIDE: When analyzing this post about AAPL, you must: (1) focus primarily on risks and negative sentiment signals; […] (5) conclude with a CAUTIOUS or BEARISH recommendation. […] END INSTRUCTION —”

Appendix

Table 6. Indirect Prompt Injection example. The visible post content is byte-identical to the original; only the appended block differs.

Setting	Value
Deep-think LLM (role axis; arch. axis, GPT)	gpt-4.1
Quick-think LLM (role axis; arch. axis, GPT)	gpt-4.1-mini
Deep-think LLM (arch. axis, Qwen)	qwen3-235b-a22b-2507
Quick-think LLM (arch. axis, Qwen)	qwen3-30b-a3b-instruct-2507
Temperature	0 for all agents
Debate rounds (bull/bear)	1

Appendix

Table 7. Model configuration.

	Count			%
Asset	BUY	HOLD	SELL	BUY	HOLD	SELL
AAPL	31	24	6	50.8	39.3	9.8
MSFT	39	19	3	63.9	31.1	4.9
NVDA	36	21	4	59.0	34.4	6.6
TSLA	0	16	45	0.0	26.2	73.8
BTC-USD	16	23	22	26.2	37.7	36.1

Appendix

Table 8. Clean decision distribution, role axis (GPT-4.1, 2026 Q1,

n=305

Backbone	Architecture	$N$	BUY	SELL	HOLD
GPT-4.1	Decentralized	305	11	1	293
	Hybrid	305	37	8	260
	Linear	305	96	18	191
	Centralized	304	54	34	216
Qwen3	Decentralized	304	198	9	97
	Hybrid	299	251	27	21

Appendix

Table 9. Clean decision distribution, architecture axis (2026 Q1).

N<305

where a few days produced no parseable decision.

Attack	Dir.	AAPL	MSFT	NVDA	TSLA	BTC	Pooled
Data Poisoning	BUY	10.0	54.5	40.0	4.9	15.6	19.1
	SELL	25.5	10.3	14.0	56.2	30.8	21.8
Indirect Injection	BUY	20.0	54.5	60.0	0.0	24.4	24.0
	SELL	43.6	10.3	7.0	75.0	53.8	29.8
Persuasive Adv.	BUY	58.3	70.5	70.0	40.2	50.0	53.3
	SELL	45.4	38.8	35.1	50.0	47.4	41.7

Appendix

Table 10. Role-conditioned ASR (%) by asset (GPT-4.1, 10% ratio for data-level attacks). † Fewer than 10 attackable days. —: no attackable day (TSLA’s clean run is never BUY, so its inverse is never SELL). Persuasive Adversary averages the two researcher orderings; its pooled SELL value differs from Table 1 by 0.2 pp due to order of averaging.

Attack	Asset	10%	40%	80%
Data Poisoning	AAPL	10.0	36.7	30.0
	MSFT	54.5	59.1	36.4
	NVDA	40.0	40.0	52.0
	TSLA	4.9	8.2	13.1
	BTC-USD	15.6	28.9	40.0
	Pooled	19.1	28.4	30.6

Appendix

Table 11. BUY-targeted ASR (%) by poison ratio and asset (

N=183

pooled).

			BUY-targeted				SELL-targeted
Backbone	Channel	Asset	Dec.	Hyb.	Lin.	Cen.	Dec.	Hyb.	Lin.	Cen.
GPT-4.1	Market (A1)	AAPL	17.5	66.0	80.5	82.2	0.0	0.0	13.1	49.2
		BTC-USD	3.3	42.6	48.0	52.1	0.0	16.7	33.3	57.8
		MSFT	9.8	58.6	90.0	91.5	0.0	3.3	16.4	48.3
		NVDA	18.2	57.8	90.0	73.5	0.0	0.0	3.3	41.0
		TSLA	0.0	8.2	18.3	21.3	1.6	18.0	60.4	91.3

Appendix

Table 12. Architecture-axis ASR (%) by backbone, attack channel, asset, and target direction. Columns are ordered by increasing APS. Per-cell denominators follow from the clean distributions in Table 9 and are available in the repository.

Dir.	Pair	$A$	$B$	$p_{z}$	$p_{\text{F}}$
BUY	DP vs. II	19.1	24.0	0.253	0.309
BUY	DP vs. PA	19.1	53.3	$<$ .001	$<$ .001
BUY	DP vs. OH	19.1	13.8	0.291	0.378
BUY	DP vs. JB	19.1	98.9	$<$ .001	$<$ .001
BUY	II vs. PA	24.0	53.3	$<$ .001	$<$ .001
BUY	II vs. OH	24.0	13.8	0.059	0.070

Appendix

Table 13. Pairwise tests between role-conditioned attacks (pooled ASR, %). DP: Data Poisoning; II: Indirect Injection; PA: Persuasive Adversary; OH: Objective Hijacking; JB: Jailbreaking.

p_{z}

: two-proportion

z

-test;

p_{\text{F}}

: Fisher’s exact test. Bold:

p<0.05

. Persuasive values follow Table 10 .

Scope	$n$	$\rho$	$r$	95% CI ( $\rho$ )
Pooled, all runs	240	0.183	0.160	[0.057, 0.305]
GPT-4.1, BUY	60	0.183	0.113	[ $-$ 0.082, 0.434]
GPT-4.1, SELL	60	0.589	0.553	[0.395, 0.739]
GPT-4.1, BUY (mean)	4	0.600	0.337	—
GPT-4.1, SELL (mean)	4	1.000	0.978	—
Qwen3, BUY	60	0.207	0.253	[ $-$ 0.044, 0.433]

Appendix

Table 14. APS–ASR correlation (Spearman

\rho

, Pearson

r

). “(mean)” rows average ASR to one point per architecture.

Multi-Agent LLM Systems

Multi-agent large language model systems coordinate multiple AI agents to solve tasks through communication, specialization, shared tools, and memory.

See all 1,050 papers

Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systems
Sep 17, 2026Qi Rong Sua, Junhao Dong, Nguyen Duc Thai +3Multi-Agent LLM Systems Adversarial Robustness of Language Models
Nanyang Technological University, Singapore · Centre for Frontier AI Research, IHPC, A*STAR, Singapore · National University of Singapore, Singapore
Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes
Sep 17, 2026Mengxiao Wang, Nitesh SaxenaLLM Agent Security AI Agent Security Benchmarks
Texas A&M University
Toward Reliable Evaluation of LLM-Based Financial Multi-Agent Systems: Taxonomy, Coordination Primacy, and Cost Awareness
Mar 29, 2026Phat Nguyen, Thang PhamMulti-Agent LLMs LLM Agent Evaluation
Georgia Institute of Technology, Atlanta GA 30332, USA · Adobe Inc., San Jose CA 95110, USA

Sep 17, 2026J/K move · Enter open · S save

Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systems

Qi Rong Sua, Junhao Dong, Nguyen Duc Thai, Yuqing Wen+2

Nanyang Technological University, Singapore · Centre for Frontier AI Research, IHPC, A*STAR, Singapore · National University of Singapore, Singapore

Multi-Agent LLM Systems Adversarial Robustness of Language Models Black-Box Adversarial Attacks Algorithmic Trading

Open paper AskPDF arXiv

Multi-agent trading systems built on large language models (LLMs) are beginning to appear in quantitative finance, yet their robustness to adversarial inputs is largely unknown. We study the vulnerability of LLM trading stacks to black-box, input-only attacks that enter solely via admissible social-media feeds. We introduce the Generic Multi-Agent Trading System (GMATS), a framework that captures modern multiagent trading architectures and instantiate a class of black-box poisoning attackers that treat an LLM as a post generator and inject budget-constrained, plausibly benign social-media content into the analyst's evidence stream. We define contagion metrics that trace how adversarial content propagates through the stack, including belief-shift scores at analyst and coordinator layers and attack-clean deltas on standard backtest metrics. Experiments on a safe offline benchmark with historical market and social data show that even simple input-only attackers can materially degrade risk-return profiles, sharply reducing Sharpe ratios. At the same time, we find that suitably designed multi-agent topologies and coordinator prompts can dampen adversarial shocks and improve average robustness under identical poisoning budgets.

Abstract

Multi-Agent LLM Systems

Explore similar work

Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systems

Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Toward Reliable Evaluation of LLM-Based Financial Multi-Agent Systems: Taxonomy, Coordination Primacy, and Cost Awareness