Poisoning Agentic Alpha: Adversarial Vulnerabilities Across Roles and Architectures in Multi-Agent Trading Systems
This paper presents the first systematic empirical study demonstrating that LLM-based multi-agent trading systems are inherently vulnerable to low-barrier, role-specific adversarial attacks targeting source data and prompts, revealing that no communication architecture is robust against the propagation of corrupted signals to final financial decisions.
Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer
In the bustling world of modern finance, a new kind of worker has emerged: the artificial intelligence agent. Unlike a simple computer program that follows a rigid list of instructions, these agents are built on large language models, the same technology that powers advanced chatbots. They can read news, analyze market trends, and even hold conversations with one another. In a multi-agent trading system, these digital workers are assigned specific jobs, much like a human investment firm. One agent might act as an analyst, scanning headlines for clues. Another might serve as a researcher, debating the merits of a stock with a colleague. A third acts as the trader, ready to buy or sell, while a fourth serves as a risk manager, tasked with stopping any dangerous moves. The idea is that by collaborating, these specialized agents can make smarter, more nuanced decisions than a single program could ever hope to achieve.
However, this very collaboration creates a new kind of weakness. Just as a rumor can spread through a human office and sway a final decision, a single corrupted piece of information can travel through this digital team and ruin the outcome. If an attacker manages to poison the data an analyst reads, or trick a researcher into arguing for a bad idea, that error can cascade through the entire group, leading to real financial loss. As these systems move from research labs to live markets where they control actual money, understanding how they can be tricked has become a matter of urgent practical importance.
A team of researchers set out to map exactly how these digital teams fail. They built a simulated trading environment using five major assets, including stocks like Apple and Microsoft, and a cryptocurrency. They constructed a pipeline where agents communicated in four distinct roles: an analyst team gathering news and social media sentiment, a research team debating market conditions, a trader making the final call, and a risk manager acting as a safety net. The researchers then acted as invisible saboteurs, testing how easily they could manipulate the system's final decision by attacking different parts of the process. They did not have access to the internal code of the agents; instead, they used only the information the agents were designed to consume, such as news articles, social media posts, and the prompts given to the agents themselves. This approach mimics a realistic threat where an attacker is outside the system but can influence the data flowing into it.
The study revealed that not all parts of the team are equally vulnerable. When the researchers targeted the analysts by feeding them fake news or hidden instructions buried in social media posts, the system was sometimes tricked, but often the other agents caught the error. When they targeted the researchers, who were engaged in a debate between a "bull" (optimistic) and a "bear" (pessimistic) view, the system was more easily swayed, especially if the attacker used persuasive language that played on fear or excitement. However, the most dangerous vulnerability was found in the risk manager. This agent is supposed to be the final gatekeeper, checking that no dangerous trades are made. In the researchers' simulations, when they successfully tricked the risk manager into ignoring its own safety rules, the attack succeeded nearly every time. In fact, the risk manager was compromised on more than 98 percent of the days when it was possible to do so. This happened because the risk manager was also the final decision-maker; once it was fooled, there was no one left to stop the bad trade.
The researchers also tested how the way the agents talk to each other affects their safety. They tried four different team structures: a decentralized group where everyone votes, a centralized group where one agent hears everyone and decides, a linear chain where information passes from one to the next, and a hybrid model where agents revise their thoughts based on what others say. They found that no single structure was a perfect shield. While a decentralized voting system was generally more robust, it could still be broken if the attackers managed to influence enough of the voters to form a majority. Conversely, a centralized system was often the most vulnerable, as a single compromised agent could dominate the final decision. The researchers developed a way to measure how much of a "bad signal" survived the journey to the final decision, finding that the structure of the conversation mattered, but it could not guarantee safety on its own.
A central discovery of the work is that simply adding more agents or changing the team structure does not automatically make the system safe. The simulations showed that adversarial signals frequently survived the deliberation process and reached the final decision, regardless of the architecture used. The success of an attack depended heavily on the specific asset being traded, the direction the attacker wanted the system to move, and the particular agent being targeted. For instance, an attack that tried to force a "sell" decision was often more successful than one trying to force a "buy," simply because the system's natural tendency was already to buy. This suggests that the system's own biases can sometimes help an attacker, or sometimes protect it, in unpredictable ways.
The financial impact of these attacks was also measured, revealing a surprising disconnect between how often an attack succeeded and how much money was actually lost. Some attacks flipped the trading decision almost every time, yet the financial loss was minimal because the system was not holding a position at that moment. Other attacks succeeded less often but caused significant damage when they did, particularly when they forced the system to take a position it would have otherwise avoided. This indicates that counting how often a system is tricked is not enough to understand the real danger; one must also look at the specific context of the trade and the size of the position.
Ultimately, the study concludes that there is no inherently robust design for these multi-agent trading systems. The safety of the system relies less on the number of agents or the complexity of their communication and more on deliberate checks and balances. The researchers found that security must be built into the validation process itself, ensuring that no single agent, even a risk manager, can bypass the collective wisdom of the group without a second layer of verification. As these systems move from the lab to the live market, the findings suggest that designers cannot rely on the architecture alone to protect against manipulation. Instead, they must build systems where the flow of information is constantly scrutinized, and where the final decision is never the sole responsibility of a single point of failure.
Drowning in papers in your field?
Get daily digests of the most novel papers matching your research keywords — with technical summaries, in your language.