LLM‑based multi‑agent trading systems let specialized agents collaborate through structured dialogue to produce trading decisions, and they are moving quickly from research prototypes to live deployments that control real assets. The same inter‑agent communication that boosts performance also creates an attack surface: a corrupted signal can travel through the information flow and eventually cause real financial loss.
Instead of assuming the attacker can reach internal modules, we restrict the threat model to what is practically reachable—the source data and prompts consumed by agents. This low‑barrier, democratized threat is called a role‑specific adversary.
We conduct the first systematic empirical study in the financial domain to trace how an adversarial signal enters a multi‑agent trading system and how far it survives toward the final decision. Along the role axis we decompose a typical trading pipeline into Analyst, Researcher, Trader and Risk Manager, and assign each role an attack matched to its interface. Along the structural axis we apply data‑level and agent‑level attacks to four communication topologies, and introduce the Adversarial Signal Preservation Score (APS) as a post‑hoc metric to explain why some designs are more robust.
Experiments span five assets, two backbone models and two target directions. A central finding is that no architecture is inherently robust; every design shows significant signal preservation under certain attacks. These insights guide the design of safer, more robust agentic trading systems.
Blogger's Review: The paper offers a practical security evaluation framework by dissecting roles and communication structures, reminding developers to address both input sanitization and topology resilience when building multi‑agent trading platforms.