Multi-agent trading systems built on large language models (LLMs) are gradually entering quantitative finance, yet their robustness to adversarial inputs remains largely unexamined. This work investigates the vulnerability of LLM trading stacks to black‑box, input‑only attacks that enter solely through admissible social‑media feeds.
We introduce the Generic Multi‑Agent Trading System (GMATS) framework, which abstracts modern multi‑agent trading architectures and instantiates a class of black‑box poisoning attackers. These attackers treat the LLM as a post generator and inject budget‑constrained, plausibly benign social‑media content into the analyst’s evidence stream.
We define contagion metrics that track how adversarial content propagates through the stack, including belief‑shift scores at the analyst and coordinator layers and attack‑clean deltas on standard backtest metrics. Experiments on a safe offline benchmark using historical market and social data show that even simple input‑only attackers can materially degrade risk‑return profiles, sharply reducing Sharpe ratios. At the same time, suitably designed multi‑agent topologies and coordinator prompts can dampen adversarial shocks and improve average robustness under identical poisoning budgets.
Review: The study highlights a hidden risk in LLM‑driven trading pipelines when exposed to seemingly innocuous social signals, and it offers practical mitigation strategies that are valuable for real‑world deployments.