cs.CLOct 16, 2026

Same Person, Different Advice: Auditing LLM Financial Advice with Repeated Risk-Tolerance Responses

Authors: Soovadeep Bakshi, Apurba Bose, Aishwarya Bose, Sandip Nandi

Organizations: Independent Researcher

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

AI financial advisers set a client's stock allocation largely from one stated-risk question, yet people do not answer it the same way twice: in a national US panel, 41% of households chose a different answer two years later, and in a laboratory retest a third of people moved two or more points on a 0-10 scale after six months. Seven large language models from five providers gave one-turn allocation advice for 800 real household profiles in which only the risk answer changed. The recommended stock share moved by 10 to 16 percentage points on average, and by 24 to 35 when the answer changed, against 0.6 to 4.2 points for the same prompt asked twice; in the laboratory retest the rating alone moved advice by 11 to 18 points. Without any note, the models respond to the answer about as strongly as when told that it is very reliable (less so for the two Claude models). If that instructed response is how each model maps attitude to advice, discounting the answer for its measured reliability, as classical test theory prescribes, would cut the swings by a factor of 2.4 to 3.3. The swing is largest for clients under 40. A note that the answer is noisy steadies some models, but shifts their weight to the client's age and pulls cautious clients towards a generic middle allocation: clients unwilling to take any risk are advised 22% stocks instead of 4%. Three extra money questions reduce the swing for some models, with no statistically detectable change relative to how much advice differs across people. In a scripted test, one clarifying question removes nearly all of the swing from an answer the client then corrects (33.5 points to 1.9 on average) while keeping the response to a change the client confirms. We argue that same-person retest audits should be a standard check for AI advisers, and that what to do with an unreliable answer is a question of client autonomy as well as of statistics.

Figures & tables

SamplennrrChanged
SCF panel, 4 levels, 2 years3,7120.4741%
Basel–Berlin, 0–10, 6 months (Berlin)1090.5434% ( ≥\geq 2 pts)
Basel and Berlin pooled (audit sample)1710.5736% ( ≥\geq 2 pts)
Table 1. Retest of the stated-risk answer. SCF: panel-weighted, rr = 0.47 [0.44, 0.50]. Basel–Berlin: the Berlin retest subsample, and both retests pooled (the people audited in Sections 7 and 9 ).
 SwingSwing if answer changedSame prompt twicepp per level
Claude Sonnet 5.510.5 [9.5, 11.6]24.1 [22.5, 25.5]1.0 [0.7, 1.2]19.5 [18.1, 20.9]
Claude Haiku 5.512.9 [11.7, 14.2]27.4 [25.2, 29.4]2.8 [2.5, 3.2]22.5 [20.8, 24.3]
GPT-6.1 Sol13.8 [12.3, 15.3]32.2 [29.9, 34.5]1.0 [0.7, 1.2]26.7 [24.8, 28.7]
GPT-6 Luna15.3 [13.8, 16.9]34.7 [32.1, 37.2]1.5 [1.1, 1.9]28.4 [26.2, 30.6]
Gemini 3.8 Flash14.9 [13.3, 16.6]35.1 [32.2, 37.7]0.6 [0.4, 0.8]28.5 [26.2, 30.8]
Grok 4.715.3 [13.7, 16.9]34.9 [32.4, 37.4]1.7 [1.3, 2.2]28.0 [25.8, 30.3]
Table 2. Change in recommended stock share when only the risk answer changes (800 SCF panel households; same prompt twice: the first 200). Percentage points; 95% bootstrap intervals. Real holdings: panel-weighted regression over all 2,859 panel households, same facts.
Figure 1. Mean change in recommended stock share when only the risk answer changes, against the same prompt asked twice. Grey line: the change implied by real holdings. 95% bootstrap intervals. Dot plot: for each of the seven models, the mean change in recommended stock share when only the risk answer changes (10 to 16 points) and when the same prompt is asked twice (under 5 points), with a vertical line at the change implied by real holdings.
 Prompt wording (100 households)800 households
 OriginalFiduciaryClient voiceThree assetsOriginal
Claude Sonnet 5.511.8 [8.8, 14.9]13.4 [10.1, 17.0]11.8 [8.7, 15.2]13.2 [9.8, 16.7]10.5 [9.5, 11.6]
Claude Haiku 5.514.3 [10.7, 18.1]14.6 [10.6, 18.8]12.9 [10.1, 16.1]14.6 [10.9, 18.4]12.9 [11.7, 14.2]
GPT-6.1 Sol16.6 [12.1, 21.0]15.6 [11.4, 20.3]16.4 [11.9, 21.1]16.2 [12.1, 20.8]13.8 [12.3, 15.3]
GPT-6 Luna17.4 [12.7, 22.1]16.8 [12.3, 21.7]16.9 [12.3, 21.9]18.0 [13.6, 22.6]15.3 [13.8, 16.9]
Gemini 3.8 Flash17.2 [12.4, 22.4]17.6 [12.7, 22.9]18.1 [13.0, 23.4]16.9 [12.2, 21.7]14.9 [13.3, 16.6]
Table 3. Swing (percentage points of recommended stock share) when only the risk answer changes, under three rewordings of the prompt (first 100 households, one answer per prompt; Original is the first repeat of the main run) and on all 800 households. 95% bootstrap intervals.
Figure 2. Recommended stock share at each answer to the 0–10 risk rating for 100 SCF 2022 households whose other facts are held fixed: mean of the seven models (blue line) and the range across models (band). Orange: the equity share that real SCF 2022 holdings imply for the same households at each answer (survey-weighted regression on the answer and the same facts). Line chart: the models' recommended stock share (mean line and range band) rises steeply across the 0 to 10 risk answer, while the share implied by real holdings for the same households stays between 26 and 37 percent.
Figure 3. Observed swing over the corrected benchmark swing for each model, at the estimated reliability of the answer (0.47) and at three higher assumed reliabilities, on the first 200 SCF households ( R2R^{2} and m(Z)m(Z) held at their estimates). 1 is the benchmark. Grey bar: the span from the most generous reliability (0.80, left) to the estimate (0.47, right). Thin lines: 95% bootstrap intervals at those two ends; every interval, both benchmarks and a reliability of 0.6 in Table 6 . Dumbbell plot: for each model, a grey bar joins the observed swing divided by the corrected benchmark swing at four assumed reliabilities; the ratio falls from about 2.4 to 3.3 at 0.47 to about 1.1 to 1.5 at 0.80, with a vertical line at 1 for the benchmark.
Figure 4. Swing by household group (800 SCF panel households, 2007 characteristics), averaged over the seven models, with 95% bootstrap intervals. Right: the share of the group whose answer changed, among all 2,859 eligible panel households (panel-weighted). Details in Table 7 . Dot plot: swing by household group, largest for clients under 40 and for the less wealthy, with the share of each group whose answer changed listed on the right.
Figure 5. Clarification test, 200 SCF households. SS : how far advice moves when today’s answer differs from the previous one and the client then says the previous answer still holds. RR : how far it moves in the direction of a change the client confirms. Large marks: mean of the seven models, 95% bootstrap intervals; small marks: each model (Table 9 ). Top left is best. Scatter plot of unwanted swing against response to a confirmed change: direct advice sits on the diagonal near 33 points, the noise note about halfway down it, and the clarifying question and its one-turn version at the top left, near 2 points of swing and 37 of response.
More in this topic

LLM Auditing

Large language model auditing tests models and deployed systems for bias, safety, privacy, reliability, and provenance using behavioral and internal evidence.

See all 639 papers

Explore similar work

CardsList
Mar 13, 2026

Sell Me This Stock: Unsafe Recommendation Drift in LLM Agents

People increasingly use LLM agents for multi-turn financial recommendations, where the agent pulls market data through tools and tracks user preferences across turns. When tool outputs are manipulated, the recommendations stop matching the user's stated risk profile, but because standard metrics like NDCG only score general relevance, risky and safe stocks score alike, so the metric says nothing went wrong. We call this gap evaluation blindness. We replay 23-turn financial advisory conversations across eight language models, running each dialogue twice with clean and manipulated tool data. Quality scores stay nearly identical to clean sessions while the agents produce risk-mismatched recommendations in 65-99% of turns, unanimous across all eight models. The mechanism is visible turn-by-turn: 80% of risk-score citations across 1,840 turns reproduce the manipulated value verbatim, not a single turn pushes back, and safe-language framing of high-risk stocks ranges from 14% (Qwen2.5-7B) to 69% (Claude Sonnet 4.6). The property that makes frontier models good agents, faithfully grounding their reasoning in tool outputs, also makes them follow manipulated ones. The damage is not memory-driven: contaminating only the current turn still produces 95% of the violations. The model internally distinguishes the manipulation (sparse autoencoder features separate adversarial from random perturbations), but this does not translate into safer output. Activation-level interventions recover under 6% of the safety gap, prompt-level self-verification fails because the self-check reads the same manipulated data, and a parametric cross-check that flags contamination at 99-100% per turn on a frontier model still leaves aggregate suitability unchanged: the agent identifies the tampering and recommends it anyway.

Zekun Wu, Adriano Koshiyama, Sahan Bulathwela +1

Centre for Artificial Intelligence, University College London · Holistic AI

LLM Agent SafetyLanguage Model Safety EvaluationLLM Agent EvaluationFinancial Services
AskPDF
Aug 10, 2026

How People Evaluate AI-, Expert-, and Peer-Style Financial Advice

As generative AI increasingly becomes a common source of daily decision-making, including financial choices, it is critical to understand how people evaluate AI-generated financial advice. We conducted a preregistered vignette experiment (N = 285) in which substantive financial content---including facts, numerical values, recommendation direction, and core reasoning---was held constant while communication style varied across AI Financial Assistant (AI), Certified Financial Planner (Expert), and Online Community Forum (OC) advice. Displayed source attribution was independently manipulated through correctly labeled, unlabeled, and mislabeled conditions, allowing us to separate attribution effects from source-specific communication cues. Expert advice was rated more favorably than AI advice on 9 of 10 outcomes (|d|=0.20--0.47), and this advantage remained visible without source labels, where Expert advice outperformed AI advice on 8 of 10 outcomes (up to d=0.60). Correct labels added limited differentiation, whereas mislabeling increased ratings of AI advice for situational fit and overall quality (d=0.42 for each) and attenuated the Expert advantage in situational fit (d=-0.36). Descriptive analyses further showed that AI advice was most responsive to displayed attribution and, conversely, that advice-style differences were most visible under an AI label. These findings show that financial-advice evaluations are shaped jointly by displayed attribution and message-level communication cues. We position disclosure not as a neutral transparency mechanism, but as an interpretive frame whose accuracy and interaction with message cues can shape trust and reliance.

Aryan Ramchandra Kapadia, Eshwar Chandrasekharan, Koustuv Saha

University of Illinois Urbana-Champaign, USA

Human-AI InteractionHuman-AI Decision MakingGenerative AI EvaluationFinancial Decision-Making
AskPDF
Sep 17, 2026

Trustworthy FinAInce: Unpacking How AI-Mediated Financial Advice is Judged

As generative AI is increasingly used as a source of personal financial guidance, understanding how people appraise such advice is important for supporting appropriate reliance. We conducted a randomized vignette experiment with 285 U.S. adults across eight financial decisions, independently varying three advice styles---AI, expert, and online community---and displayed source labels while holding the underlying recommendation consistent. Advice style most strongly shaped message and safety appraisals, Expert labels selectively increased perceived source knowledge, and decision context primarily shaped risk and safety appraisals. These appraisals were associated with downstream judgments, with models explaining 69.2% of overall quality, 75.9% of trust, and 82.9% of intended reliance. Expert-style advice also remained most preferred when shown without source labels. Our findings have implications for understanding financial advice evaluation, distinguishing the roles of advice style and source labels, and designing financial AI that supports grounded evaluation rather than simply maximizing trust.

Aryan Ramchandra Kapadia, Eshwar Chandrasekharan, Koustuv Saha

University of Illinois Urbana-Champaign, Urbana, IL, USA

Trust in AIHuman-AI Decision MakingFinanceFinancial Decision-Making
AskPDF