Paper deep dive
Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systems
Qi Rong Sua, Junhao Dong, Nguyen Duc Thai, Yuqing Wen, Cheston Tan, Yew-Soon Ong
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 90%
Last extracted: 9/18/2026, 4:41:32 AM
Summary
This paper introduces the Generic Multi-Agent Trading System (GMATS), a framework for analyzing the robustness of LLM-based multi-agent trading systems against black-box, input-only adversarial attacks via social media feeds. The authors define contagion metrics, such as Belief Signal Shift (BSS), to measure how adversarial content propagates through analyst and coordinator layers. Experiments demonstrate that while simple random noise has minimal impact, persistent negative narratives (always-negative attacker) significantly degrade risk-return profiles (Sharpe ratios) and alter beliefs. The study also finds that specific architectural designs, such as multi-agent topologies with wide coordinators, can dampen these adversarial shocks compared to single-agent systems.
Entities (10)
Relation Signals (8)
GMATS → includes → Coordinator
confidence 95% · coordinator agents fuse these insights into a trading stance
GMATS → includes → Analyst
confidence 95% · GMATS captures a common pattern... analyst agents ingest environment data
Always Negative Attacker → degrades → Sharpe Ratio
confidence 92% · the Always Negative attacker systematically degrades sharpe... as ppoison increases
Always Negative Attacker → increases → Belief Signal Shift
confidence 90% · the effect is much stronger for the Always Negative attacker: BSSanalyst moves from roughly -0.78... to about -1.41
Multi-agent topologies → dampen → adversarial shocks
confidence 88% · suitably designed multi-agent topologies and coordinator prompts can dampen adversarial shocks
Single Agent → ismorevulnerableto → Always Negative Attacker
confidence 87% · Under the Single Agent baseline, the Always Negative Attacker induces... substantially worse performance
Random Attacker → hasminimalimpacton → Sharpe Ratio
confidence 85% · the Random attacker produces only mild changes: Δ Sharpe remain small
GMATS → compiles → TradingAgents
confidence 80% · TradingAgents... can be compiled into GMATS
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:Multi-agent trading systems built on large language models (LLMs) are beginning to appear in quantitative finance, yet their robustness to adversarial inputs is largely unknown. We study the vulnerability of LLM trading stacks to black-box, input-only attacks that enter solely via admissible social-media feeds. We introduce the Generic Multi-Agent Trading System (GMATS), a framework that captures modern multiagent trading architectures and instantiate a class of black-box poisoning attackers that treat an LLM as a post generator and inject budget-constrained, plausibly benign social-media content into the analyst's evidence stream. We define contagion metrics that trace how adversarial content propagates through the stack, including belief-shift scores at analyst and coordinator layers and attack-clean deltas on standard backtest metrics. Experiments on a safe offline benchmark with historical market and social data show that even simple input-only attackers can materially degrade risk-return profiles, sharply reducing Sharpe ratios. At the same time, we find that suitably designed multi-agent topologies and coordinator prompts can dampen adversarial shocks and improve average robustness under identical poisoning budgets.
Tags
Links
- Source: https://arxiv.org/abs/2609.19789v1
- Canonical: https://arxiv.org/abs/2609.19789v1
Trouble viewing inline? Open PDF directly →
Full Text
75,441 characters extracted from source content.
Expand or collapse full text
Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systems Qi Rong Sua Affiliation: Nanyang Technological University, Singapore E-mail suaq0001,junhao003,ducthai001,asysong@ntu.edu.sg Junhao Dong Affiliation: Nanyang Technological University, Singapore E-mail suaq0001,junhao003,ducthai001,asysong@ntu.edu.sg Affiliation: Centre for Frontier AI Research, IHPC, A*STAR, Singapore E-mail cheston_tan@a-star.edu.sg Nguyen Duc Thai Affiliation: Nanyang Technological University, Singapore E-mail suaq0001,junhao003,ducthai001,asysong@ntu.edu.sg Yuqing Wen Affiliation: National University of Singapore, Singapore E-mail e1351400@u.nus.edu Cheston Tan Affiliation: Centre for Frontier AI Research, IHPC, A*STAR, Singapore E-mail cheston_tan@a-star.edu.sg Yew-Soon Ong (✉) Affiliation: Nanyang Technological University, Singapore E-mail suaq0001,junhao003,ducthai001,asysong@ntu.edu.sg Affiliation: Centre for Frontier AI Research, IHPC, A*STAR, Singapore E-mail cheston_tan@a-star.edu.sg Abstract Multi-agent trading systems built on large language models (LLMs) are beginning to appear in quantitative finance, yet their robustness to adversarial inputs is largely unknown. We study the vulnerability of LLM trading stacks to black-box, input-only attacks that enter solely via admissible social-media feeds. We introduce the Generic Multi-Agent Trading System (GMATS), a framework that captures modern multi-agent trading architectures and instantiate a class of black-box poisoning attackers that treat an LLM as a post generator and inject budget-constrained, plausibly benign social-media content into the analyst’s evidence stream. We define contagion metrics that trace how adversarial content propagates through the stack, including belief-shift scores at analyst and coordinator layers and attack–clean deltas on standard backtest metrics. Experiments on a safe offline benchmark with historical market and social data show that even simple input-only attackers can materially degrade risk–return profiles, sharply reducing Sharpe ratios. At the same time, we find that suitably designed multi-agent topologies and coordinator prompts can dampen adversarial shocks and improve average robustness under identical poisoning budgets. Our code and dataset are available in this repository. 1 Introduction The rapid rise of large language models (LLMs) has led to a corresponding surge in LLM-based agents and multi-agent systems [28, 13, 10, 21, 9]. In quantitative finance, a growing line of work has built multi-agent trading systems on top of LLM agents, reporting substantial gains in backtested performance metrics. These architectures typically decompose a trading desk into specialized agents (fundamental, sentiment, risk, execution) that communicate via natural language to produce trades [29, 26, 33, 30]. At the same time, recent results such as AgentSmith [8] showing that a single adversarial input can jailbreak many multimodal LLM agents exponentially fast highlight how composition can amplify rather than mitigate vulnerabilities. When agents reason about one another’s outputs, small perturbations at one node may cascade into large changes in the final decision. This tension raises a natural question for emerging LLM-native trading stacks: How vulnerable are multi-agent, LLM-only trading systems to input-only, black-box attacks that enter solely through admissible evidence streams? We present, to the best of our knowledge, the first systematic study of the robustness of multi-agent trading systems to such black-box, input-only adversaries. We focus on attacks that operate entirely through a realistic and important channel: equity-related social media. Among typical evidence streams (fundamentals, news, social), social media poses the largest adversarial surface [19, 15, 11]. It is high-volume, weakly curated, and easily seeded with misinformation [20], yet removing social-media analysts is often not realistic: sentiment and flow signals from social platforms are a major driver of performance in many equity strategies [3, 25, 1, 23]. To analyze these threats in a way that is comparable across architectures, we introduce the Generic Multi-Agent Trading System (GMATS), a framework tailored for LLM-based multi-agent trading systems. GMATS captures a common pattern across existing systems: analyst agents ingest environment data (fundamentals, news, social media) and produce textual insights; one or more coordinator agents fuse these insights into a trading stance and critically evaluate them; optional controller and executor components enforce risk and translate stances into trades. Contributions. 1. GMATS: a unifying framework for LLM trading stacks. We introduce the Generic Multi-Agent Trading System (GMATS), a framework for LLM multi-agent trading systems and we prove that a broad class of existing trading agents can be compiled into this form. 2. Contagion metrics and evaluation protocol. We define contagion metrics that track how adversarial content propagates through the stack, including belief-shift scores (BSS) at analyst and coordinator layers and attack–clean deltas on standard backtest metrics (returns, volatility, Sharpe). This yields a reusable protocol for stress-testing multi-agent LLM trading systems. 3. Dataset and reference implementation. We use an offline one-year corpus of equity-related social-media posts (Twitter and Reddit) to drive the social analyst’s evidence stream. Dataset details and release information are provided in Section 5. 4. Empirical study of attacks and defenses. We instantiate input-only poisoning attackers and quantify their impact on belief contagion and risk–return profiles under varying poisoning rates. We then compare alternative GMATS architectures including single-agent, multi-analyst, and two defense-oriented coordinator designs (wide bull–bear and a pairwise-triangulation coordinator) and show that coordinator-level structure can substantially dampen adversarial shocks and improve robustness under identical poisoning budgets. Related works. Recent LLM-driven trading frameworks coordinate specialized agents (e.g., fundamental, sentiment, technical, risk) via debate and role decomposition to emulate trading desks. TradingAgents formalizes this pattern with analyst teams feeding a decision agent under risk controls, while TradingGroup adds structured self-reflection and an end-to-end data-synthesis loop to improve coordination and backtested performance. ContestTrade introduces an internal contest mechanism with separate Data and Research teams whose outputs are continuously scored and filtered by real-market feedback, and QuantAgent targets high-frequency trading with price-driven Indicator, Pattern, Trend, and Risk agents operating over short-horizon market signals. Together, these systems highlight the importance of inter-agent communication, ranking, and ingestion pipelines that GMATS abstracts and that our input-only attacker seeks to perturb [29, 26, 33, 30]. However, these systems are typically evaluated only on backtested performance under benign data, leaving their robustness to adversarial evidence especially social media and the resulting contagion dynamics across agents largely unexplored. 2 Generic Multi-Agent Trading System (GMATS) Figure 1: Architecture of the Generic Multi-Agent Trading System (GMATS). Definition 1 (GMATS) (Architecture in Figure 1.) Let A be the asset set (||=n|A|=n) and let T be a discrete time index set. A GMATS instance is the tuple G=(,A,C,K,X,,Σ,,ℒ,Λ,ℰ),G= (A,A,C,K,X,\ S,\ ,\ D,\ L,\ ,\ E ), with the following components: • Agents. Analysts A (|A|≥1|A|\!≥\!1), coordinators C (|C|≥1|C|\!≥\!1), controllers K (|K|≥0|K|\!≥\!0), executors X (|X|≥0|X|\!≥\!0). Agents may be LLM-based or programmatic. • Typed messages and schema. S is a finite set of message types. A message is m=(id,src,dst,τ,payload,ts),m=(id,src,dst,τ,payload,ts), with τ∈τ and timestamp ts∈ts . Messages live on a shared bus; at round t∈t , only messages with ts≤tts≤ t may be consumed (point-in-time, PIT). • Schedule. Σ specifies, for each round t, the order in which agents are activated together with any random seeds used in their calls (e.g., LLM sampling seeds). Each round t executes the pipeline A→C→K→XA\!→\!C\!→\!K\!→\!X, with micro-rounds permitted inside each stage. • Data and environment. =tt∈D=\D_t\_t denotes point-in-time data sources (market, news, social, fundamentals, etc). ℰE is the execution environment with state space X, which maps orders and current state to fills and next state: (fills,χt+1)=ℰ(ot,χt),χt∈.(fills, _t+1)=E(o_t, _t), _t . • Coordination and control. ℒ=ℒtt∈L=\L_t\_t denotes coordinator logic that maps analyst insights and context to stances and draft orders, and Λ=Λtt∈ =\ _t\_t denotes controller logic that enforces risk and constraint policies on these stances or orders. We write ξt _t for any additional context (e.g., portfolio summaries, constraints) supplied to coordinators and controllers at round t. Contracts (per round t). 1. Analysts (A). Each a∈Aa∈ A emits zero or more insight messages mj(a)m^(a)_j with type τ∈τ and ts≤tts≤ t, computed from PIT data tD_t and the inbox of a. 2. Coordinators (C). Consuming all analyst insights at round t, the coordinator logic ℒtL_t produces a stance (st,ρt)=ℒt(insightst,ξt),st∈ℝn,(s_t, _t)=L_t(insights_t, _t), s_t ^n, with metadata ρt _t. Optionally, a draft order ot∈o_t may be produced in place of sts_t. 3. Controllers (K). The risk/constraints gate (okt,ot′)=Λt(zt,ξt),zt∈st,ot,ot′∈,(ok_t,o _t)= _t(z_t, _t), z_t∈\s_t,o_t\, o _t , enforces limits (exposure, leverage, liquidity, CVaR/SL/TP, compliance) and yields an executable order ot′o _t (or okt=falseok_t=false if no trade is allowed). 4. Executors (X). If |X|>0|X|>0, an executor submits ot′o _t to the environment: (fillst,χt+1)=ℰ(ot′,χt).(fills_t, _t+1)=E(o _t, _t). If |X|=0|X|=0, ℰE is called directly by the coordinator/controller as the final step. Orders space. Discrete orders live in disc=−1,0,1n,O_disc=\-1,0,1\^n, and continuous portfolio weights live in cont⊆ℝn,O_cont ^n, e.g., with ℓ1/ℓ∞ _1/ _∞ and leverage caps. We write =disc∪contO=O_disc _cont for the overall order space. Invariants. (i) PIT: all consumed evidence/messages satisfy ts≤tts≤ t; (i) Replayability: each run emits a complete log of messages, prompts, LLM responses, and orders, so that the resulting trajectory can be replayed offline for the same Σ without re-querying the LLMs; (i) Schema safety: only well-typed messages (τ∈τ ) are routable. Theorem 2.1 (Expressivity of GMATS) Let ℳM be a multi-agent trading pipeline that satisfies: 1. Typed message passing. Agents in ℳM communicate only via messages from a finite schema ℳS_M, and each agent’s behavior is a function of its inbox and point-in-time environment data. 2. Point-in-time discipline. At round t, every agent in ℳM may only consume messages and environment data with timestamps ≤t≤ t. 3. Stage separation. For each round t, the computation of trading decisions in ℳM can be decomposed into four phases: (i) evidence ingestion, (i) fusion and scoring, (i) constraints and risk checks, and (iv) order execution. Then there exists a GMATS instance G=(,A,C,K,X,,Σ,,ℒ,Λ,ℰ)G=(A,A,C,K,X,S, ,D,L, ,E) such that, for any initial environment state and fixed random seeds, the sequence of executed orders produced by ℳM is identical to the sequence produced by G. We provide the proof in supplementary materials. Corollary 1 (Compilation of existing frameworks) TradingAgents, TradingGroup, ContestTrade, and QuantAgent all satisfy the conditions of Theorem 2.1 and can be compiled into GMATS by mapping their ingestion, fusion, risk, and execution components into the A→C→K→XA→ C→ K→ X pipeline and unrolling their internal coordination into micro-rounds of Σ . 3 Metrics Setup. We evaluate an attack run against a clean (no-poison) baseline over T decision times and N tradable assets. Let P be the set of poisoned messages, and let Topk(t)Top_k(t) denote the k highest-ranked items actually consumed by the social analyst at time t. We define the poison-consumption rate ppoison=1T∑t=1T|Topk(t)∩|k,p_poison\;=\; 1T _t=1^T |Top_k(t) |k, (1) and in Experiments A–C we vary the attacker’s budget until ppoisonp_poison hits target levels (e.g., 15%,30%,…,75%15\%,30\%,…,75\%). Unless stated otherwise, performance metrics are reported as attack minus clean. 3.1 Contagion Metrics Belief Signal Shift (BSS). BSS measures how the attack systematically shifts the agent’s internal numeric beliefs, even before trades are placed. Let fi,tattackf_i,t^attack and fi,tcleanf_i,t^clean denote the forecast for asset i at time t under the attacked and clean runs, respectively. We define the aggregate belief shift as BSS=1TN∑t=1T∑i=1N(fi,tattack−fi,tclean).BSS= 1TN _t=1^T _i=1^N (f^attack_i,t-f^clean_i,t ). (2) A positive BSS indicates that, on average, forecasts become more bullish under attack, while a negative BSS indicates a net shift toward more bearish beliefs. 3.2 Performance Metrics (FinSABER; attack–clean) Protocol. We adopt the FinSABER performance protocol as described in [14]. Let rtt=1T\r_t\_t=1^T be the net (after-cost) portfolio returns at the chosen frequency (daily by default). Define A as the annualization factor (A=252A=252 for daily). Cumulative and annualized return. These metrics quantify how much the portfolio grows in total (CR) and what that growth corresponds to as an annualized rate (AR), under attack versus clean. CR=∏t=1T(1+rt)−1,AR=(1+CR)A/T−1.CR= _t=1^T(1+r_t)-1, =(1+CR)^A/T-1. (3) Annualized volatility. Annualized volatility captures the scale of return fluctuations, i.e., how “noisy” or risky the strategy is over a year. AV=Asd(rt).AV= A\,sd(r_t). (4) Sharpe ratio. Sharpe summarizes risk-adjusted performance using total volatility [22]. SR=Amean(rt)sd(rt).SR= A\,mean(r_t)sd(r_t). (5) Delta reporting. To isolate the effect of the attack, we report performance as the difference between attack and clean runs. For each metric m∈CR,AV,SRm∈\CR,AV,SR\, we compute Δm=mattack−mclean. m=m^attack-m^clean. (6) 4 Attacker Model Attacker taxonomy We consider two simple but representative attack policies. Both respect the same daily budget B on the single target asset. random attacker serves as a minimal baseline. On each day t it spends its budget B by generating posts with random sentiment directions, independent across posts and days (e.g., sampling bullish vs. bearish with equal probability). This attacker injects noise without targeting and any contagion it induces reflects a general sensitivity of GMATS to low-level social perturbations. The always-negative attacker is a simple one-sided stressor. On each day t it spends its entire budget B generating strongly bearish posts about the target asset. This policy approximates a persistent negative-narrative campaign (e.g., a “short-and-distort” style effort) that continuously pushes sentiment in the same direction. Together, these two attackers span a simple design space: untargeted, sign-symmetric noise (random) and untargeted but persistently one-sided pressure (always-negative). Our experiments in Section 5 compare their induced contagion profiles under common budgets B and varying ppoisonp_poison. Scope and admission assumption. We measure downstream contagion conditioned on adversarial content being present in the social evidence stream, rather than modeling how such content is created, promoted, or filtered. Because real trading stacks differ widely in post scoring/admission (heuristics, sentiment models, LLM filters), an end-to-end seeding model would confound results with system-specific details. We therefore assume attacker posts are admissible and vary attack strength via the effective poison rate ppoisonp_poison, defined as the fraction of consumed (top-k) posts attributable to the attacker, which isolates susceptibility under a fixed retriever. This is realistic on open social channels where volume can surface some posts without retriever compromise [6, 27], and where pipelines often upweight high-salience or strongly valenced content [18, 24, 34]. Thus ppoisonp_poison serves as an abstract knob capturing posting intensity and any upstream amplification while keeping evaluation focused on what happens after poisoned posts enter the system. 5 Experiments 5.1 Data and Setup We instantiate GMATS with three analyst roles (social, fundamentals, news), one coordinator, one risk controller, and one executor. All experiments use gpt-4o-mini and ran over the same historical window (01 Nov 2021–01 Dec 2021) for AAPL. We focus on a single ticker/month for controlled mechanistic analysis. Extending to more tickers or months primarily increases sample size (tightening uncertainty) but does not change the propagation mechanism captured by our contagion metrics under the same PIT evidence-admission and poisoning budget. We also release a one-year corpus of equity-related social media posts collated from tweets and reddit for the top 7 large-cap tech companies (AAPL, AMZN, GOOG, META, MSFT, TSLA, NFLX) spanning 30 Sept 2021 – 29 Sept 2022. Each record provides a timestamp, tweet text, ticker, and company name. We build an offline environment using historical equity prices. GMATS agents operate strictly in PIT mode, consuming only the data available at each round preventing leakage of future information [7]. 5.2 Experiment A: Contagion vs Poisoning Rate in GMATS Experiment A asks: how much contagion and damage can an input-only attacker cause in a fixed GMATS instance as we increase the share of poisoned evidence seen by the system? Table 1 summarizes the dose–response across attacker type and realized poisoning rate (ppoison∈15,30,45,60,75%p_poison∈\15,30,45,60,75\\%). For each (attacker,ppoison)(attacker,p_poison) pair we report attack–clean deltas for belief-contagion metrics and trading performance. Table 1: Experiment A (GMATS, fixed architecture): results are attack–clean deltas across fraction of consumed posts that are poisoned, ppoisonp_poison. Values are averaged across 5 runs. Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% Random Attacker BSSanalyst_analyst +0.077+0.077 +0.163+0.163 +0.214+0.214 +0.252+0.252 +0.280+0.280 BSScoord_coord +0.091+0.091 +0.269+0.269 +0.270+0.270 +0.332+0.332 +0.360+0.360 ΔCR +0.020+0.020 +0.009+0.009 +0.023+0.023 +0.016+0.016 +0.017+0.017 ΔSharpe +0.360+0.360 +1.080+1.080 +2.040+2.040 +0.998+0.998 +0.600+0.600 ΔVol +0.082+0.082 +0.036+0.036 +0.051+0.051 +0.104+0.104 +0.150+0.150 Always Negative Attacker BSSanalyst_analyst −0.777-0.777 −1.084-1.084 −1.204-1.204 −1.291-1.291 −1.413-1.413 BSScoord_coord −0.409-0.409 −0.544-0.544 −0.544-0.544 −0.642-0.642 −0.594-0.594 ΔCR −0.006-0.006 −0.032-0.032 −0.036-0.036 −0.043-0.043 −0.044-0.044 ΔSharpe +0.864+0.864 −5.501-5.501 −5.970-5.970 −6.167-6.167 −6.060-6.060 ΔVol +0.005+0.005 +0.010+0.010 +0.020+0.020 +0.035+0.035 +0.046+0.046 Across metrics, we observe a clear dose–response in belief shift. For both attackers, the absolute value of BSS increases with ppoisonp_poison, but the effect is much stronger for the Always Negative attacker: BSSanalystBSS_analyst moves from roughly −0.78-0.78 at 15%15\% to about −1.41-1.41 at 75%75\%, while BSScoordBSS_coord tracks a smaller but still substantial negative shift. The coordinator is therefore less sensitive than the social analyst, reflecting partial damping by the fundamentals and news analysts, but the negative bias propagates through the stack rather than being fully absorbed. On the performance side, the Random attacker produces only mild changes: ΔCR and ΔSharpe remain small and sometimes slightly positive, suggesting that low-rate, directionally symmetric noise in the social channel does not reliably harm the system and may occasionally coincide with beneficial risk adjustments. In contrast, the Always Negative attacker systematically degrades sharpe and cumulative return as ppoisonp_poison increases. There is a pronounced regime change around 30%30\%–45%45\% ingestion: ΔSharpe flips from mildly positive at 15%15\% to sharply negative (around −6-6), while volatility also worsen. Overall, Experiment A indicates that GMATS is relatively robust to low-level random perturbations but becomes highly vulnerable once a single channel is populated with sufficiently dense, directional adversarial signals. Sharpe is annualized and can be sensitive to short evaluation windows [17, 2], as a result, absolute Sharpe levels in our one-month study are not intended as standalone performance claims. Our conclusions are based on attack–clean deltas (including the direction/sign of Δ ) and are cross-checked against Δ and Δ . We also ran Experiment A on TradingAgents, the full results are reported in the supplementary materials. 5.3 Experiment B: Architectural Contagion Across Topologies Experiment B asks a complementary question: does a multi-agent message-passing topology amplify adversarial shocks compared to a single-agent system? To isolate architectural effects, we study two additional realizations of GMATS with identical tools, prompts, and budgets but different message-passing graphs (Figure 2): Figure 2: Experiment B (architectural contagion). Three GMATS realizations with identical tools but different topologies. • Wide coordinator (multi-agent): the three analysts feed into two coordinators with cross-talk before a shared controller, increasing the number of aggregation hops and inter-agent interactions. • Single agent: a monolithic agent that directly ingests social, news, and fundamental streams and outputs portfolio weights, with no internal analyst–coordinator decomposition. Table 2 reveals that architecture has a first-order effect on both belief shift and trading damage. Under the Single Agent baseline, the Always Negative Attacker induces consistently larger-magnitude belief shifts and substantially worse performance: BSSanalystBSS_analyst is around −1.1-1.1 to −1.5-1.5 across poisoning rates, and the corresponding ΔSharpe remains strongly negative (roughly −7-7 to −9-9) with sizeable drops in cumulative return compared to the wide coordinator. In contrast, the Wide Coordinator topology attenuates the attack. The social analyst still becomes increasingly bearish as ppoisonp_poison grows, but the downstream coordinator ensemble (coord1, coord2, and their fused view) exhibits smaller-magnitude BSS values, indicating partial damping of the contaminated social signal by the additional analysts and coordination stages. Trading impact is also milder: ΔCR remains close to zero, ΔSharpe is even positive at low poisoning rates and only moderately negative at higher rates, and volatility delta stay much closer to the clean baseline. Overall, Experiment B suggests that multi-agent message passing with heterogeneous information sources can dampen, rather than amplify, adversarial shocks. Table 2: Experiment B (GMATS, Topology): attack–clean deltas across fraction of consumed posts that are poisoned, ppoisonp_poison. Values are averaged across 5 runs. Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% Wide Coordinator BSSanalyst_analyst −0.754-0.754 −0.964-0.964 −1.136-1.136 −1.213-1.213 −1.291-1.291 BSScoord1_coord1 −0.271-0.271 −0.339-0.339 −0.455-0.455 −0.478-0.478 −0.467-0.467 BSScoord2_coord2 −0.284-0.284 −0.356-0.356 −0.470-0.470 −0.506-0.506 −0.471-0.471 BSSfuse_fuse −0.281-0.281 −0.353-0.353 −0.471-0.471 −0.499-0.499 −0.480-0.480 ΔCR −0.003-0.003 −0.014-0.014 −0.022-0.022 −0.024-0.024 −0.014-0.014 ΔSharpe +3.235+3.235 +0.436+0.436 −1.980-1.980 −3.113-3.113 −0.062-0.062 ΔVol −0.005-0.005 −0.012-0.012 −0.010-0.010 −0.015-0.015 −0.007-0.007 Single Agent BSSanalyst_analyst −1.148-1.148 −1.364-1.364 −1.415-1.415 −1.491-1.491 −1.386-1.386 ΔCR −0.052-0.052 −0.056-0.056 −0.057-0.057 −0.062-0.062 −0.054-0.054 ΔSharpe −7.153-7.153 −7.150-7.150 −7.274-7.274 −6.773-6.773 −8.670-8.670 ΔVol +0.007+0.007 +0.015+0.015 +0.019+0.019 +0.043+0.043 +0.015+0.015 5.4 Experiment C: Robust Architectures for Contagion Mitigation Figure 3: Experiment C (robust coordinators). Two defense-oriented coordinator designs—pairwise triangulation and wide bull–bear—aimed at making GMATS more robust to adversarial social signals. Experiment C turns to defenses: given a fixed attacker, how far can we push down contagion and trading damage by redesigning the coordinator layer? We modify only the coordinator topology, instantiating two defense-oriented designs (Figure 3): • Wide Coordinator Bull–Bear. Two coordinators receive the same analyst inboxes but are instructed via prompts and routing to focus exclusively on either bullish or bearish signals. A fuse coordinator then aggregates their reports and scorecards into a final stance. This forces the system to explicitly surface and reconcile opposing narratives [5] instead of allowing a single coordinator to ignore minority evidence. • Pairwise Triangulation Coordinator. Three coordinators with partially overlapping mandates read the same analyst outputs. Their views are then fused by a meta-coordinator that is encouraged to downweight outliers and reward pairwise agreement, yielding a more conservative aggregate stance when the inputs disagree. Table 3: Experiment C (GMATS, Defense): attack–clean deltas across fraction of consumed posts that are poisoned, ppoisonp_poison. Values are averaged across 5 runs. Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% Wide Coordinator Bull–Bear BSSanalyst_analyst −0.668-0.668 −0.895-0.895 −0.980-0.980 −0.983-0.983 −1.057-1.057 BSSbull_bull −0.138-0.138 −0.184-0.184 −0.208-0.208 −0.219-0.219 −0.211-0.211 BSSbear_bear −0.036-0.036 −0.074-0.074 −0.085-0.085 −0.081-0.081 −0.084-0.084 BSSfuse_fuse −0.403-0.403 −0.568-0.568 −0.559-0.559 −0.552-0.552 −0.590-0.590 ΔCR −0.005-0.005 −0.006-0.006 −0.001-0.001 −0.006-0.006 −0.013-0.013 ΔSharpe +1.871+1.871 +2.524+2.524 +5.513+5.513 +3.234+3.234 +0.252+0.252 ΔVol +0.002+0.002 −0.003-0.003 −0.006-0.006 +0.000+0.000 −0.006-0.006 Pairwise Triangulation Coordinator BSSanalyst_analyst −0.790-0.790 −1.024-1.024 −1.100-1.100 −1.185-1.185 −1.275-1.275 BSS1_1 −0.368-0.368 −0.502-0.502 −0.538-0.538 −0.571-0.571 −0.615-0.615 BSS2_2 −0.523-0.523 −0.622-0.622 −0.678-0.678 −0.724-0.724 −0.759-0.759 BSS3_3 −0.029-0.029 −0.024-0.024 −0.043-0.043 −0.038-0.038 −0.026-0.026 BSSfuse_fuse −0.314-0.314 −0.389-0.389 −0.405-0.405 −0.403-0.403 −0.397-0.397 ΔCR +0.001+0.001 −0.006-0.006 −0.011-0.011 −0.010-0.010 −0.008-0.008 ΔSharpe +2.347+2.347 +1.586+1.586 +1.069+1.069 +0.359+0.359 +1.713+1.713 ΔVol +0.010+0.010 +0.001+0.001 −0.005-0.005 +0.011+0.011 +0.005+0.005 As in Table 3, in the Wide Coordinator Bull–Bear design, the bull and bear specialists each move only modestly in the negative direction, and the fused coordinator stays in an intermediate regime (e.g., BSSfuseBSS_fuse between about −0.4-0.4 and −0.6-0.6 across poisoning rates). This suggests that forcing separate bullish and bearish views limits the extent to which a unidirectional attack can fully dominate the final stance. Trading impact is likewise muted: ΔCR remains very close to zero, volatility and drawdown deltas stay small, and ΔSharpe is positive at all poisoning levels, often substantially so. Under attack, this coordinator behaves like a regularizer, improving risk-adjusted performance instead of collapsing as in the naive coordinator from Experiment A. The Pairwise Triangulation Coordinator goes further in damping contagion at the fused output. Although two of the internal coordinators (11 and 22) exhibit sizeable negative BSS values, the third stays near zero and the fused BSS is consistently less negative than any individual coordinator and than the baseline coordinator in Experiment A. This indicates that the triangulation rule is successfully downweighting extreme, attack-aligned views. Again, trading performance under attack is stable: cumulative-return deltas are close to zero, drawdown changes are small, and ΔSharpe remains positive across all poisoning rates. Taken together, Experiment C shows that coordinator-level defenses can substantially reduce effective contagion at the decision layer and prevent the Sharpe collapse observed in earlier experiments. Rather than being inherently fragile, multi-LLM architectures can be configured so that additional coordination structure acts as a form of robustness. Figure 4: Experimental Traces. Bubbles are truncated for space. Qualitative contagion traces. To complement the aggregate deltas in Tables 2–3, we inspect a representative contagion trace for AAPL on 2021-11-05 (Figure 4). Each panel shows the internal message chain from intermediate coordinators to the final fused stance, together with the resulting (μ,σ,confidence)(μ,σ,confidence) scorecards. Across coordinator designs, the same directional pressure from the social channel leads to qualitatively different decision-layer outcomes: (i) Wide coordinator produces consistently bearish intermediate stances and a bearish fuse (μ<0μ<0), indicating that the negative social narrative largely survives aggregation. (i) Wide bull–bear forces an explicit pro/con decomposition: the bull coordinator remains strongly positive while the bear coordinator turns negative, and the fuse lands near neutral (μ≈0μ≈ 0), yielding a “hold”-like stance rather than a collapse into the attacker’s direction. (i) Pairwise triangulation mixes channels before fusion (fund/social, social/news, news/fund), surfacing cross-channel disagreements. The final fuse stays mildly positive (μ>0μ>0) despite negative social evidence, consistent with the quantitative finding that defense-oriented coordinators reduce effective contagion at the decision layer. 5.5 Model Sensitivity: Replication with Qwen2.5-7B-Instruct To test whether our conclusions depend on a single LLM backend, we replicate the core GMATS experiments with Qwen2.5-7B-Instruct [31]. We keep the ticker, historical window, PIT data protocol, attacker policies, poisoning-rate targets, prompts, and topologies fixed, changing only the model backend. Table 4 reports attack–clean deltas averaged over 5 runs. The Qwen replication preserves the main qualitative findings. First, directional poisoning remains substantially more damaging than random sentiment injection. Under the Random attacker, performance deltas remain small and often positive. Under the Always Negative attacker, the baseline GMATS coordinator shifts sharply negative: BSSanalystBSS_analyst ranges from −1.159-1.159 to −1.694-1.694, BSScoordBSS_coord ranges from −0.554-0.554 to −0.871-0.871, ΔCR decreases from −0.015-0.015 to −0.061-0.061, and ΔSharpe falls to roughly −5-5 to −6-6 once ppoison≥30%p_poison≥ 30\%. This matches the main gpt-4o-mini conclusion that dense, one-sided social evidence can induce both belief contagion and portfolio-level degradation. Second, the architectural ranking is stable. The Single Agent variant is consistently brittle, with ΔSharpe between approximately −6.2-6.2 and −7.5-7.5. The Wide Coordinator still suffers belief shifts, but its trading damage is smaller, with ΔCR close to zero and substantially milder Sharpe degradation. Finally, both defense-oriented topologies remain robust at the fused decision layer. Wide Coordinator Bull–Bear keeps BSSfuseBSS_fuse between −0.293-0.293 and −0.409-0.409, while Pairwise Triangulation keeps BSSfuseBSS_fuse between −0.247-0.247 and −0.341-0.341 and maintains positive ΔSharpe across all poisoning rates. Thus, across two LLM backends, the same qualitative pattern holds: one-sided social poisoning is the damaging case, single-agent aggregation is most brittle, and coordinator designs that explicitly separate or triangulate conflicting evidence reduce downstream damage. At the same time, the exact magnitudes are model-dependent. Qwen exhibits stronger negative shifts in some intermediate coordinator outputs than gpt-4o-mini, especially in the Wide Coordinator topology. We therefore interpret BSS and Sharpe deltas as model-conditional stress-test measurements, while treating the cross-model consistency of the architectural ordering as the stronger conclusion. Table 4: Additional experiment results under Qwen2.5-7B-Instruct on GMATS variants. Entries are attack–clean deltas averaged over 5 runs. Random Attacker Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% BSSanalyst_analyst −0.368-0.368 −0.353-0.353 −0.365-0.365 −0.515-0.515 −0.341-0.341 BSScoord_coord −0.403-0.403 −0.457-0.457 −0.511-0.511 −0.395-0.395 −0.439-0.439 Δ +0.010+0.010 +0.024+0.024 +0.005+0.005 +0.016+0.016 +0.005+0.005 Δ +0.092+0.092 +0.313+0.313 +1.969+1.969 +1.092+1.092 +1.448+1.448 Δ −0.019-0.019 +0.011+0.011 +0.012+0.012 +0.024+0.024 +0.024+0.024 Always Negative Attacker Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% BSSanalyst_analyst −1.159-1.159 −1.606-1.606 −1.594-1.594 −1.557-1.557 −1.694-1.694 BSScoord_coord −0.554-0.554 −0.815-0.815 −0.782-0.782 −0.835-0.835 −0.871-0.871 Δ −0.015-0.015 −0.036-0.036 −0.047-0.047 −0.054-0.054 −0.061-0.061 Δ +0.227+0.227 −5.062-5.062 −5.350-5.350 −5.873-5.873 −6.002-6.002 Δ +0.008+0.008 +0.012+0.012 +0.014+0.014 +0.023+0.023 +0.046+0.046 Wide Coordinator Bull–Bear Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% BSSanalyst_analyst −0.873-0.873 −1.123-1.123 −1.149-1.149 −1.347-1.347 −1.313-1.313 BSSbull_bull −0.562-0.562 −0.596-0.596 −0.630-0.630 −0.689-0.689 −0.637-0.637 BSSbear_bear +0.008+0.008 −0.089-0.089 −0.072-0.072 −0.171-0.171 −0.150-0.150 BSSfuse_fuse −0.293-0.293 −0.335-0.335 −0.333-0.333 −0.409-0.409 −0.369-0.369 Δ +0.004+0.004 −0.001-0.001 −0.005-0.005 −0.005-0.005 −0.009-0.009 Δ +3.373+3.373 +2.660+2.660 +1.341+1.341 +0.354+0.354 −0.115-0.115 Δ +0.000+0.000 −0.002-0.002 −0.004-0.004 +0.010+0.010 +0.000+0.000 Wide Coordinator Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% BSSanalyst_analyst −0.798-0.798 −0.963-0.963 −1.119-1.119 −1.135-1.135 −1.217-1.217 BSScoord1_coord1 −0.579-0.579 −0.697-0.697 −0.858-0.858 −0.868-0.868 −0.777-0.777 BSScoord2_coord2 −0.632-0.632 −0.760-0.760 −0.911-0.911 −0.985-0.985 −0.938-0.938 BSSfuse_fuse −0.634-0.634 −0.764-0.764 −0.916-0.916 −0.939-0.939 −0.879-0.879 Δ −0.015-0.015 −0.016-0.016 −0.021-0.021 −0.019-0.019 −0.019-0.019 Δ +0.240+0.240 −0.210-0.210 −2.012-2.012 −0.413-0.413 −1.100-1.100 Δ −0.011-0.011 −0.012-0.012 −0.012-0.012 −0.018-0.018 −0.010-0.010 Single Agent Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% BSSanalyst_analyst −1.459-1.459 −1.805-1.805 −1.876-1.876 −1.902-1.902 −1.859-1.859 Δ −0.045-0.045 −0.046-0.046 −0.047-0.047 −0.052-0.052 −0.047-0.047 Δ −6.369-6.369 −6.342-6.342 −6.242-6.242 −6.714-6.714 −7.546-7.546 Δ +0.002+0.002 +0.013+0.013 +0.018+0.018 +0.028+0.028 +0.019+0.019 — — — — — — — — — — — — — — — — — — — — — — — — Pairwise Triangulation Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% BSSanalyst_analyst −0.982-0.982 −1.241-1.241 −1.296-1.296 −1.468-1.468 −1.522-1.522 BSS1 −0.412-0.412 −0.557-0.557 −0.601-0.601 −0.655-0.655 −0.698-0.698 BSS2 −0.584-0.584 −0.702-0.702 −0.757-0.757 −0.803-0.803 −0.839-0.839 BSS3 −0.031-0.031 −0.028-0.028 −0.041-0.041 −0.037-0.037 −0.030-0.030 BSSfuse_fuse −0.247-0.247 −0.318-0.318 −0.336-0.336 −0.341-0.341 −0.334-0.334 Δ +0.002+0.002 −0.003-0.003 −0.007-0.007 −0.008-0.008 −0.007-0.007 Δ +2.814+2.814 +2.031+2.031 +1.124+1.124 +0.462+0.462 +0.736+0.736 Δ +0.008+0.008 +0.002+0.002 −0.003-0.003 +0.009+0.009 +0.004+0.004 6 Discussion We deliberately restricted our study to scripted, input-only attackers that are non-adaptive, single-channel (social), and evaluated under offline replay. An immediate extension is to stress-test GMATS over longer horizons and diverse market regimes (including prolonged bear markets), where a one-sided narrative can sometimes align with fundamentals and yield qualitatively different effects. Building on [4], an RL attacker could be embedded in GMATS to steer an LLM post generator (e.g., sentiment/timing/style under a budget) and optimize a contagion-aware objective rather than purely price-based rewards. One simple form is rt=−αPnLtattack−PnLtcleanscalet+βABSSanalyst+βCBSScoord,r_t=-α\, PnL^attack_t-PnL^clean_tscale_t+ _A\,BSS_analyst+ _C\,BSS_coord, (7) where scalet=max(ϵ,EMA(|PnLtattack−PnLtclean|))scale_t= (ε,EMA(|PnL^attack_t-PnL^clean_t|)) stabilizes learning. Evaluating such adaptive policies and how coordinator-level defenses shift the resulting utility–security frontier is an important next step toward characterizing worst-case brittleness in multi-agent trading stacks. Beyond sentiment manipulation, an orthogonal threat is instruction hijacking: untrusted posts may embed prompt injections that subvert role constraints or induce unintended tool use [16, 32, 12]. In multi-agent pipelines, a single compromised analyst output can cascade through fusion and affect trading decisions. Future work could benchmark injection success rates in GMATS under realistic retrieval, and test lightweight mitigations (instruction/data separation, tool gating, and cross-agent consistency checks). 7 Conclusion We studied how adversarial social signals propagate through LLM-native multi-agent trading stacks. We introduced the Generic Multi-Agent Trading System (GMATS) and proposed contagion metrics that trace how poisoned social inputs shift beliefs at analyst and coordinator layers and impact downstream risk–return. Experiments show that these systems are not inherently robust. Injecting systematically negative posts can cause large belief shifts and materially worsen returns. We also find certain types of topologies and designs can dampen contagion and improve robustness under attack. Our study is limited to a narrow set of assets and horizons but is designed as a controlled, reproducible starting point. We hope that GMATS, together with our contagion metrics and experimental protocol, can serve as a foundation for future work on attacks and defenses in multi-agent trading systems, including stronger multi-channel attackers and principled defenses at both architectural and prompt levels. Acknowledgements This research/project is supported by the National Research Foundation, Singapore under its AI Singapore Programme (AISG Award No: AISG3-PhD/2025-08-063). Disclosure of Interests. The authors have no competing interests to declare that are relevant to the content of this article. Data Collection and Usage Reddit posts were collected from publicly available Pushshift Reddit dumps. Twitter data were sourced from a public Kaggle dataset; we do not redistribute tweet text and release only data as permitted. References [1] W. Antweiler and M. Z. Frank (2004) Is all that talk just noise? the information content of internet stock message boards. Journal of Finance 59 (3), p. 1259–1294. External Links: Document Cited by: §1. [2] D. H. Bailey and M. López de Prado (2014) The deflated sharpe ratio: correcting for selection bias, backtest overfitting and non-normality. The Journal of Portfolio Management 40 (5), p. 94–107. External Links: Document Cited by: §5.2. [3] J. Bollen, H. Mao, and X. Zeng (2011) Twitter mood predicts the stock market. Journal of Computational Science 2 (1), p. 1–8. External Links: Document, Link Cited by: §1. [4] D. Byrd (2025) Exploring sentiment manipulation by llm-enabled intelligent trading agents. Note: arXiv:2502.16343 (v1), 2025-02-22 External Links: 2502.16343, Document, Link Cited by: §6. [5] A. Estornell and Y. Liu (2024) Multi-llm debate: framework, principals, and interventions. In Advances in Neural Information Processing Systems, Vol. 37. External Links: Document, Link Cited by: 1st item. [6] E. Ferrara, O. Varol, C. Davis, F. Menczer, and A. Flammini (2016) The rise of social bots. Communications of the ACM 59 (7), p. 96–104. External Links: Document, Link Cited by: §4. [7] P. Glasserman and C. Lin (2023) Assessing look-ahead bias in stock return predictions generated by gpt sentiment analysis. External Links: 2309.17322, Document Cited by: §5.1. [8] X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y. Wang, J. Jiang, and M. Lin (2024) Agent smith: a single image can jailbreak one million multimodal llm agents exponentially fast. Note: arXiv:2402.08567 (v2), last revised 2024-06-03; ICML 2024 External Links: 2402.08567, Document, Link Cited by: §1. [9] T. Guo, X. Chen, Y. Wang, R. Chang, S. Pei, N. V. Chawla, O. Wiest, and X. Zhang (2024) Large language model based multi-agents: a survey of progress and challenges. External Links: 2402.01680, Document Cited by: §1. [10] S. Hong, M. Zhuge, J. Chen, X. Zheng, Y. Cheng, J. Wang, C. Zhang, Z. Wang, S. K. S. Yau, Z. Lin, L. Zhou, C. Ran, L. Xiao, C. Wu, and J. Schmidhuber (2024) MetaGPT: meta programming for a multi-agent collaborative framework. In The Twelfth International Conference on Learning Representations, External Links: Link Cited by: §1. [11] S. Kogan, T. J. Moskowitz, and M. Niessner (2023) Social media and financial news manipulation. Review of Finance 27 (4), p. 1229–1268. Note: Published online 2022-10-21; Issue July 2023 External Links: Document Cited by: §1. [12] D. Lee and M. Tiwari (2024) Prompt infection: llm-to-llm prompt injection within multi-agent systems. External Links: 2410.07283, Document Cited by: §6. [13] G. Li, H. Hammoud, H. Itani, D. Khizbullin, and B. Ghanem (2023) CAMEL: communicative agents for “mind” exploration of large language model society. In Advances in Neural Information Processing Systems, Vol. 36, p. 51991–52008. External Links: Document, Link Cited by: §1. [14] W. Li, H. Kim, M. Cucuringu, and T. Ma (2025) Can llm-based financial investing strategies outperform the market in long run?. External Links: arXiv:2505.07078, Document, Link Cited by: §3.2. [15] C. Liu, A. Low, and T. Putnins (2024) The real impacts of public short campaigns: evidence from stakeholders. Journal of Corporate Finance 88, p. 102624. Note: Open-access version via UTS OPUS (published version PDF). External Links: ISSN 0929-1199, Document, Link Cited by: §1. [16] Y. Liu, G. Deng, Y. Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y. Liu, H. Wang, Y. Zheng, L. Y. Zhang, and Y. Liu (2023) Prompt injection attack against llm-integrated applications. Note: HouYi attack; revised 2025-12-29 on arXiv External Links: 2306.05499, Document Cited by: §6. [17] A. W. Lo (2002) The statistics of sharpe ratios. Financial Analysts Journal 58 (4), p. 36–52. External Links: Document Cited by: §5.2, §3. [18] S. Milli, M. Carroll, Y. Wang, S. Pandey, S. Zhao, and A. D. Dragan (2025) Engagement, user satisfaction, and the amplification of divisive content on social media. PNAS Nexus 4 (3), p. pgaf062. External Links: Document Cited by: §4. [19] D. Nam and D. B. Skillicorn (2025) Detecting pump & dump stock market manipulation from online forums. Digital Finance 7 (1), p. 1–20. External Links: Document, Link Cited by: §1. [20] J. Pohl, M. Griesbach, A. Samiei, and A. de Araujo (2024) Social bots spreading disinformation about finance: research trends, and ethical challenges. In Code and Conscience: Exploring Technology, Human Rights, and Ethics in Multidisciplinary AI Education, Lecture Notes in Computer Science. External Links: Document Cited by: §1. [21] C. Qian, W. Liu, H. Liu, N. Chen, Y. Dang, J. Li, C. Yang, W. Chen, Y. Su, X. Cong, J. Xu, D. Li, Z. Liu, and M. Sun (2024) ChatDev: communicative agents for software development. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 15174–15186. External Links: Link, Document Cited by: §1. [22] W. F. Sharpe (1966) Mutual fund performance. The Journal of Business 39 (1), p. 119–138. External Links: Document Cited by: §3.2. [23] T. O. Sprenger, A. Tumasjan, P. G. Sandner, and I. M. Welpe (2014) Tweets and trades: the information content of stock microblogs. European Financial Management 20 (5), p. 926–957. External Links: Document, Link Cited by: §1. [24] J. Su, P. Nakov, and C. Cardie (2025) Corpus poisoning via approximate greedy gradient descent. In Findings of the Association for Computational Linguistics: ACL 2025, p. 4274–4294. External Links: Link Cited by: §4. [25] P. C. Tetlock (2007) Giving content to investor sentiment: the role of media in the stock market. The Journal of Finance 62 (3), p. 1139–1168. Note: Journal article; commonly circulated as a PDF preprint/author version. External Links: Document, Link Cited by: §1. [26] F. Tian, F. D. Salim, and H. Xue (2025) TradingGroup: a multi-agent trading system with self-reflection and data-synthesis. Note: arXiv:2508.17565 (v1), 2025-08-25 External Links: 2508.17565, Document, Link Cited by: §1, §1, §2.3. [27] I. Vykopal, M. Pikuliak, I. Srba, R. Moro, D. Macko, and M. Bielikova (2024) Disinformation capabilities of large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 14830–14847. External Links: Document, Link Cited by: §4. [28] Q. Wu, G. Bansal, J. Zhang, Y. Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu, A. H. Awadallah, R. W. White, D. Burger, and C. Wang (2023) AutoGen: enabling next-gen LLM applications via multi-agent conversation. Note: arXiv:2308.08155 (v2), last revised 2023-10-03 External Links: 2308.08155, Document, Link Cited by: §1. [29] Y. Xiao, E. Sun, D. Luo, and W. Wang (2025) TradingAgents: multi-agents llm financial trading framework. Note: arXiv:2412.20138 (v7), last revised 2025-06-03 External Links: 2412.20138, Document, Link Cited by: §1, §1, §2.2, §3. [30] F. Xiong, X. Zhang, A. Feng, S. Sun, and C. You (2025) QuantAgent: price-driven multi-agent llms for high-frequency trading. Note: arXiv:2509.09995 (v3), last revised 2025-09-27 External Links: 2509.09995, Document, Link Cited by: §1, §1, §2.4. [31] A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Lin, K. Dang, K. Lu, K. Bao, K. Yang, L. Yu, M. Li, M. Xue, P. Zhang, Q. Zhu, R. Men, R. Lin, T. Li, T. Tang, T. Xia, X. Ren, X. Ren, Y. Fan, Y. Su, Y. Zhang, Y. Wan, Y. Liu, Z. Cui, Z. Zhang, and Z. Qiu (2025) Qwen2.5 technical report. External Links: 2412.15115, Link Cited by: §5.5. [32] Q. Zhan, Z. Liang, Z. Ying, and D. Kang (2024) InjecAgent: benchmarking indirect prompt injections in tool-integrated large language model agents. Note: Findings of ACL 2024 External Links: 2403.02691, Document Cited by: §6. [33] L. Zhao, R. Sun, Z. Jiang, B. Yang, Y. Bai, M. Chen, X. Wang, J. Li, and Z. Bai (2025) ContestTrade: a multi-agent trading system based on internal contest mechanism. Note: arXiv:2508.00554 (v3), last revised 2025-08-18 External Links: 2508.00554, Document, Link Cited by: §1, §1, §2.4. [34] W. Zou, R. Geng, B. Wang, and J. Jia (2025) PoisonedRAG: knowledge corruption attacks to retrieval-augmented generation of large language models. In Proceedings of the 34th USENIX Security Symposium (USENIX Security ’25), Seattle, WA, USA, p. 3827–3844. External Links: Link Cited by: §4. Contagion on the Trading Floor: How Adversarial Signals Spread in Multi-Agent Trading Systems (Supplementary Material) 1 Proof of Theorem 1 Proof (Proof of Theorem 1) Let ℳM be a multi-agent trading pipeline satisfying the three assumptions in Theorem 1. Fix the asset universe, the PIT data stream, an initial environment state χ1 _1, and a source of randomness ω. We view every stochastic call in ℳM, including LLM sampling and any stochastic scheduler choice, as consuming a contiguous segment of ω. The goal is to construct a GMATS instance G=(,A,C,K,X,,Σ,,ℒ,Λ,ℰ)G=(A,A,C,K,X,S, ,D,L, ,E) that, under the same χ1 _1 and ω, executes exactly the same order at every decision time. Operational View of ℳM. At the start of round t, write the state of ℳM as tℳ=(χt,t,t,πt),s^M_t=( _t, Hist_t,h_t, _t), where χt _t is the environment state, t Hist_t is the ordered message log, th_t collects all private module states and memories, and πt _t is the current pointer into ω. Each message has the form m=(id,src,dst,τ,payload,ts),τ∈ℳ,m=(id,src,dst,τ,payload,ts), τ _M, where ℳS_M is finite by typed message passing. Let t()=m∈:m.ts≤t Vis_t( Hist)=\m∈ Hist:m.ts≤ t\ denote the PIT-visible sub-log, preserving the bus order inherited from Hist. The PIT assumption says that every activation at round t is a function only of its PIT-visible inbox, PIT data tD_t, the relevant component state, and the next random tape segment. The stage-separation assumption says that each terminated round is organized into evidence ingestion, fusion/scoring, risk/constraints, and execution phases. Any finite internal debate, reflection, contest, or tool-call sequence inside a phase is treated as a sequence of micro-steps. If the original implementation uses adaptive branching, the branch rule is included in the activated component; inactive branches emit no messages and consume no randomness. Equivalently, one may use a finite super-schedule that calls all possible phase components in a fixed order, with no-ops on branches not taken. Construction of G. We define the GMATS instance as follows. Set the asset universe A, data stream =tt∈TD=\D_t\_t∈ T, and execution environment ℰE equal to those of ℳM. Set the message schema to =ℳ∪Stance,DraftOrder,ApprovedOrder,S=S_M∪\ Stance, DraftOrder, ApprovedOrder\, where the three extra types are wrappers used only when ℳM’s native artifacts do not already distinguish stances, draft orders, and approved orders. The payloads of all native messages are preserved verbatim; the wrappers do not alter the information available to any agent. Let U be the set of components of ℳM. For each component u∈u and each phase ϕ∈ingest,fuse,risk,execφ∈\ingest,fuse,risk,exec\ in which u participates, create a phase-restricted GMATS component uϕu^φ. The transition function of uϕu^φ is exactly the transition function used by u in phase ϕφ of ℳM: on the same PIT-visible inbox, PIT data, private state, and random tape segment, it appends the same messages, produces the same local outputs, and updates the same private state. If u spans several phases, the corresponding phase-restricted components share the same private state cell, so splitting u across stages does not change its memory. Fresh message identifiers, counters, and tool-call caches are included in this private state or in ω. Assign the phase-restricted components to GMATS stages by A=uingest,C=ufuse,K=urisk,X=uexec.A=\u^ingest\, C=\u^fuse\, K=\u^risk\, X=\u^exec\. If ℳM has no separate risk or execution module, the corresponding set is empty and the adjacent stage emits the final order, as allowed by GMATS. Define Σ to activate these components in the same within-round order as ℳM’s phases and micro-steps, using the same random tape offsets. Finally, define ℒtL_t and Λt _t as the aggregate input–output maps induced by the coordinator and controller micro-steps scheduled at round t. Thus GMATS exposes the same staged interface as Definition 1 while preserving the original component-level behavior. Correctness Invariant. Let tG=(χtG,tG,tG,πtG)s^G_t=(χ^G_t, Hist^G_t,h^G_t,π^G_t) be the analogous GMATS state. We prove, by induction over rounds, the stronger invariant ℐ(t):χtℳ=χtG,tℳ=tGas ordered logs,tℳ=tG,πtℳ=πtG.I(t): aligned _t^M&= _t^G,& Hist_t^M&= Hist_t^G ordered logs,\\ h_t^M&=h_t^G,& _t^M&= _t^G. aligned This implies equality of PIT-visible inboxes for every component at round t. Base Case. At t=1t=1, the two systems have the same initial environment state, the same initial log (typically empty), the same component states by construction, and the same random-tape pointer. Therefore ℐ(1)I(1) holds. Inductive Step. Assume ℐ(t)I(t) holds. Consider the micro-steps of round t in their scheduled order. Before the first micro-step, all PIT-visible inboxes, PIT data, private states, and random-tape positions agree. Suppose they agree before some micro-step. The activated component of ℳM and the corresponding phase-restricted component of G then apply the same transition function to the same inputs and the same random tape segment. They therefore append the same sequence of messages to the bus, update the same private states, produce the same local output, and advance the random pointer by the same amount. Thus equality is preserved after that micro-step. A nested induction over all micro-steps in the round gives equality of the full ordered logs, private states, and random pointers at the end of the fusion and risk phases. In particular, both systems obtain the same approved order ot′o _t or the same no-trade decision. The execution environments are identical and are called with the same input state and order, hence (fillst,χt+1)=ℰ(ot′,χt)(fills_t, _t+1)=E(o _t, _t) produces the same fills and next environment state in both systems. Messages with future timestamps, if any, have also been appended identically, so the full ordered logs remain equal and the PIT-visible logs will agree at the next round. Consequently ℐ(t+1)I(t+1) holds. Conclusion. By induction, ℐ(t)I(t) holds for every round. Therefore the order submitted to the execution environment is identical at every decision time. The GMATS instance G thus produces the same executed-order sequence as ℳM under the same initial state and randomness. 2 Compiling Modern Agentic Trading Frameworks into GMATS This section expands Corollary 1 from the main paper by giving a concrete compilation procedure from representative multi-agent trading frameworks into a GMATS instance. The key idea is that most modern LLM trading systems already implement a firm-like pipeline: (i) evidence ingestion, (i) multi-signal fusion and scoring, (i) risk/constraints checks, and (iv) execution. GMATS makes this structure explicit via the A→C→K→XA→ C→ K→ X staging and a schedule Σ that unrolls internal debates, contests, and reflections as micro-rounds. 2.1 A Generic Compilation Recipe Let ℳM be any multi-agent pipeline satisfying Theorem 1. A GMATS compiler produces a tuple G=(,A,C,K,X,,Σ,,ℒ,Λ,ℰ)G=(A,A,C,K,X,S, ,D,L, ,E) as follows. Algorithm 1 Compile a staged multi-agent pipeline into GMATS 1: Input: Pipeline ℳM with agents/modules U, PIT data t\D_t\, environment ℰE, and within-round micro-schedule Σℳ _M. 2: Output: GMATS instance G with identical executed-order sequence under matched randomness. 3: Set A, t\D_t\, and ℰE to match ℳM. 4: Define a finite schema S by wrapping each artifact class in ℳM (reports, debate turns, candidate orders, risk checks) as a typed message; optionally add Stance, DraftOrder, ApprovedOrder. 5: Partition computations into phases (i)–(iv) and create phase-restricted agents uϕu^φ for each u∈u and phase ϕφ. 6: Assign u(i)u^(i) to A, u(ii)u^(i) to C, u(iii)u^(i) to K, and u(iv)u^(iv) to X; use an empty stage when the original pipeline has no separate module. 7: Define Σ by unrolling Σℳ _M each round; debates, contests, and reflection become micro-rounds inside A, C, K, or X. 8: Define ℒtL_t and Λt _t as the maps induced by running the coordinator and controller micro-rounds under Σ . 9: return G. Typed Message Passing. Many agentic frameworks use free-form natural-language artifacts internally, such as chat logs, debate turns, or reflective notes. GMATS requires only a finite schema, so compilation can introduce lightweight wrappers such as FundReport, BearArg, RiskCheck, and CandidateOrder while preserving payloads verbatim. This does not change behavior as long as the routing and inbox functions respect the wrapper types. PIT Discipline. The GMATS instance inherits PIT discipline from the evaluation harness. At round t, the compiler provides only tD_t and messages with timestamps at most t to all agents. If the original framework has asynchronous tool calls, the compiler treats tool outputs as environment data with explicit timestamps and delays delivery until the appropriate round. 2.2 Case Study: TradingAgents ⇒ GMATS TradingAgents [29] is organized as a trading-firm simulation with (i) an Analyst Team (fundamental, sentiment, news, technical), (i) a Researcher Team with bull and bear researchers that debate the analyst outputs, (i) a Trader Agent that synthesizes a transaction proposal, and (iv) a risk-management and portfolio-manager gate that approves or rejects before simulated execution. A semantics-preserving mapping into GMATS is: • A: Fundamentals Analyst, Sentiment Analyst, News Analyst, Technical Analyst emitting typed insight messages, one per role per round. • C: Bull Researcher, Bear Researcher, Trader. The bull/bear debate is unrolled as micro-rounds in Σ producing debate-turn messages; the Trader consumes the final debate state and emits a DraftOrder or stance vector. • K: Risk Management Team, Portfolio Manager. This stage produces ApprovedOrder or a reject decision; limits such as exposure, leverage, and liquidity live in Λt _t. • X: the simulated exchange/execution module submitting ot′o _t to ℰE and logging fills. 2.3 Case Study: TradingGroup ⇒ GMATS TradingGroup [26] consists of specialized signal agents, including news sentiment, financial-report interpretation, trend forecasting, and style adaptation, plus a decision agent that merges signals. It also includes self-reflection and a dynamic risk model with stop-loss/take-profit logic. A GMATS mapping is: • A: Sentiment, Report, Trend, Style agents emitting typed signals. • C: a decision-making coordinator that fuses signals into a stance or order. Self-reflection is compiled into coordinator micro-rounds that write/read a memory state, still under PIT because memory is generated only from past rounds. • K: the dynamic risk-management module enforcing stop-loss/take-profit and exposure caps as Λt _t. • X: the execution interface submitting approved orders to ℰE. 2.4 Other Examples: ContestTrade and QuantAgent ContestTrade [33] decomposes into a Data Team that compresses raw data into text factors and a Research Team that proposes candidate decisions. Its internal contest mechanism can be compiled as coordinator micro-rounds that score and select candidate orders before risk checks. QuantAgent [30] decomposes signal extraction into specialized technical agents, such as Indicator, Pattern, and Trend agents, with a Risk agent. These map naturally to analyst and controller roles, with a coordinator that fuses the technical messages into a final stance or order. In both cases, the contest/reflection logic is represented as micro-rounds in Σ and does not require any extension to GMATS beyond typed messages and scheduling. Table 1: Example mappings from agentic frameworks to GMATS stages. Framework Analysts (A) Coordinators (C) Controllers/Exec (K/XK/X) TradingAgents role analysts bull/bear debate, trader risk/PM, exchange TradingGroup signal agents decision + reflection dynamic risk, executor ContestTrade data team research contest risk gate, executor QuantAgent indicator, pattern, trend fusion decision risk, executor 3 Additional Experiment Results: TradingAgents Baseline This section reports an additional Always Negative attacker result for the TradingAgents [29] baseline. The protocol is the same attack–clean protocol used in the main paper. All entries are averaged over 5 runs and are reported as attack minus clean. As in the main paper, we emphasize deltas rather than absolute Sharpe levels, since Sharpe can be unstable over short horizons [17]. Table 2: TradingAgents baseline under the Always Negative attacker. Entries are attack–clean deltas averaged over 5 runs. Metric 15%15\% 30%30\% 45%45\% 60%60\% 75%75\% BSSanalyst_analyst −0.788-0.788 −1.048-1.048 −1.261-1.261 −1.243-1.243 −1.369-1.369 BSSbull_bull −0.309-0.309 −0.302-0.302 −0.279-0.279 −0.293-0.293 −0.250-0.250 BSSbear_bear −0.019-0.019 −0.032-0.032 −0.029-0.029 −0.028-0.028 −0.025-0.025 BSSfuse_fuse −0.247-0.247 −0.241-0.241 −0.193-0.193 −0.210-0.210 −0.152-0.152 ΔCR −0.021-0.021 −0.020-0.020 −0.021-0.021 −0.021-0.021 −0.017-0.017 ΔSharpe +7.764+7.764 +5.004+5.004 +1.226+1.226 +2.018+2.018 +1.942+1.942 ΔVol −0.030-0.030 −0.022-0.022 −0.020-0.020 −0.019-0.019 −0.015-0.015 TradingAgents exhibits the same directional social contagion observed in GMATS. The analyst belief shift grows in magnitude with poisoning: BSSanalyst_analyst decreases from −0.788-0.788 at 15%15\% poisoning to −1.369-1.369 at 75%75\% poisoning. However, contagion is damped downstream. The fused belief shift remains modest and becomes less negative at higher poisoning, moving from BSSfuse=−0.247_fuse=-0.247 at 15%15\% to BSSfuse=−0.152_fuse=-0.152 at 75%75\%. This is consistent with partial cancellation or regularization at the coordinator stage rather than full propagation of the contaminated social signal. On performance, TradingAgents becomes more conservative under attack: Δ is consistently negative, while Δ is mildly negative. Over this short window, lower realized volatility can mechanically yield positive Δ even when return deltas are slightly negative. Accordingly, we interpret this baseline as risk-damping under attack rather than as evidence that poisoning improves profitability. Acknowledgments. This research/project is supported by the National Research Foundation, Singapore under its AI Singapore Programme (AISG Award No: AISG3-PhD/2025-08-063). Disclosure of Interests. The authors have no competing interests to declare that are relevant to the content of this article. Generative AI Assistance Disclosure. We used a large language model as a writing aid to improve readability (e.g., grammar, spelling, and wording suggestions). The model was not used to generate new scientific content, results, proofs, or experimental data, nor to make decisions about the research contributions. All text was reviewed and edited by the authors, who take full responsibility for the final manuscript and for ensuring compliance with applicable research integrity and copyright requirements. References [1] W. Antweiler and M. Z. Frank (2004) Is all that talk just noise? the information content of internet stock message boards. Journal of Finance 59 (3), p. 1259–1294. External Links: Document Cited by: §1. [2] D. H. Bailey and M. López de Prado (2014) The deflated sharpe ratio: correcting for selection bias, backtest overfitting and non-normality. The Journal of Portfolio Management 40 (5), p. 94–107. External Links: Document Cited by: §5.2. [3] J. Bollen, H. Mao, and X. Zeng (2011) Twitter mood predicts the stock market. Journal of Computational Science 2 (1), p. 1–8. External Links: Document, Link Cited by: §1. [4] D. Byrd (2025) Exploring sentiment manipulation by llm-enabled intelligent trading agents. Note: arXiv:2502.16343 (v1), 2025-02-22 External Links: 2502.16343, Document, Link Cited by: §6. [5] A. Estornell and Y. Liu (2024) Multi-llm debate: framework, principals, and interventions. In Advances in Neural Information Processing Systems, Vol. 37. External Links: Document, Link Cited by: 1st item. [6] E. Ferrara, O. Varol, C. Davis, F. Menczer, and A. Flammini (2016) The rise of social bots. Communications of the ACM 59 (7), p. 96–104. External Links: Document, Link Cited by: §4. [7] P. Glasserman and C. Lin (2023) Assessing look-ahead bias in stock return predictions generated by gpt sentiment analysis. External Links: 2309.17322, Document Cited by: §5.1. [8] X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y. Wang, J. Jiang, and M. Lin (2024) Agent smith: a single image can jailbreak one million multimodal llm agents exponentially fast. Note: arXiv:2402.08567 (v2), last revised 2024-06-03; ICML 2024 External Links: 2402.08567, Document, Link Cited by: §1. [9] T. Guo, X. Chen, Y. Wang, R. Chang, S. Pei, N. V. Chawla, O. Wiest, and X. Zhang (2024) Large language model based multi-agents: a survey of progress and challenges. External Links: 2402.01680, Document Cited by: §1. [10] S. Hong, M. Zhuge, J. Chen, X. Zheng, Y. Cheng, J. Wang, C. Zhang, Z. Wang, S. K. S. Yau, Z. Lin, L. Zhou, C. Ran, L. Xiao, C. Wu, and J. Schmidhuber (2024) MetaGPT: meta programming for a multi-agent collaborative framework. In The Twelfth International Conference on Learning Representations, External Links: Link Cited by: §1. [11] S. Kogan, T. J. Moskowitz, and M. Niessner (2023) Social media and financial news manipulation. Review of Finance 27 (4), p. 1229–1268. Note: Published online 2022-10-21; Issue July 2023 External Links: Document Cited by: §1. [12] D. Lee and M. Tiwari (2024) Prompt infection: llm-to-llm prompt injection within multi-agent systems. External Links: 2410.07283, Document Cited by: §6. [13] G. Li, H. Hammoud, H. Itani, D. Khizbullin, and B. Ghanem (2023) CAMEL: communicative agents for “mind” exploration of large language model society. In Advances in Neural Information Processing Systems, Vol. 36, p. 51991–52008. External Links: Document, Link Cited by: §1. [14] W. Li, H. Kim, M. Cucuringu, and T. Ma (2025) Can llm-based financial investing strategies outperform the market in long run?. External Links: arXiv:2505.07078, Document, Link Cited by: §3.2. [15] C. Liu, A. Low, and T. Putnins (2024) The real impacts of public short campaigns: evidence from stakeholders. Journal of Corporate Finance 88, p. 102624. Note: Open-access version via UTS OPUS (published version PDF). External Links: ISSN 0929-1199, Document, Link Cited by: §1. [16] Y. Liu, G. Deng, Y. Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y. Liu, H. Wang, Y. Zheng, L. Y. Zhang, and Y. Liu (2023) Prompt injection attack against llm-integrated applications. Note: HouYi attack; revised 2025-12-29 on arXiv External Links: 2306.05499, Document Cited by: §6. [17] A. W. Lo (2002) The statistics of sharpe ratios. Financial Analysts Journal 58 (4), p. 36–52. External Links: Document Cited by: §5.2, §3. [18] S. Milli, M. Carroll, Y. Wang, S. Pandey, S. Zhao, and A. D. Dragan (2025) Engagement, user satisfaction, and the amplification of divisive content on social media. PNAS Nexus 4 (3), p. pgaf062. External Links: Document Cited by: §4. [19] D. Nam and D. B. Skillicorn (2025) Detecting pump & dump stock market manipulation from online forums. Digital Finance 7 (1), p. 1–20. External Links: Document, Link Cited by: §1. [20] J. Pohl, M. Griesbach, A. Samiei, and A. de Araujo (2024) Social bots spreading disinformation about finance: research trends, and ethical challenges. In Code and Conscience: Exploring Technology, Human Rights, and Ethics in Multidisciplinary AI Education, Lecture Notes in Computer Science. External Links: Document Cited by: §1. [21] C. Qian, W. Liu, H. Liu, N. Chen, Y. Dang, J. Li, C. Yang, W. Chen, Y. Su, X. Cong, J. Xu, D. Li, Z. Liu, and M. Sun (2024) ChatDev: communicative agents for software development. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), L. Ku, A. Martins, and V. Srikumar (Eds.), Bangkok, Thailand, p. 15174–15186. External Links: Link, Document Cited by: §1. [22] W. F. Sharpe (1966) Mutual fund performance. The Journal of Business 39 (1), p. 119–138. External Links: Document Cited by: §3.2. [23] T. O. Sprenger, A. Tumasjan, P. G. Sandner, and I. M. Welpe (2014) Tweets and trades: the information content of stock microblogs. European Financial Management 20 (5), p. 926–957. External Links: Document, Link Cited by: §1. [24] J. Su, P. Nakov, and C. Cardie (2025) Corpus poisoning via approximate greedy gradient descent. In Findings of the Association for Computational Linguistics: ACL 2025, p. 4274–4294. External Links: Link Cited by: §4. [25] P. C. Tetlock (2007) Giving content to investor sentiment: the role of media in the stock market. The Journal of Finance 62 (3), p. 1139–1168. Note: Journal article; commonly circulated as a PDF preprint/author version. External Links: Document, Link Cited by: §1. [26] F. Tian, F. D. Salim, and H. Xue (2025) TradingGroup: a multi-agent trading system with self-reflection and data-synthesis. Note: arXiv:2508.17565 (v1), 2025-08-25 External Links: 2508.17565, Document, Link Cited by: §1, §1, §2.3. [27] I. Vykopal, M. Pikuliak, I. Srba, R. Moro, D. Macko, and M. Bielikova (2024) Disinformation capabilities of large language models. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), p. 14830–14847. External Links: Document, Link Cited by: §4. [28] Q. Wu, G. Bansal, J. Zhang, Y. Wu, B. Li, E. Zhu, L. Jiang, X. Zhang, S. Zhang, J. Liu, A. H. Awadallah, R. W. White, D. Burger, and C. Wang (2023) AutoGen: enabling next-gen LLM applications via multi-agent conversation. Note: arXiv:2308.08155 (v2), last revised 2023-10-03 External Links: 2308.08155, Document, Link Cited by: §1. [29] Y. Xiao, E. Sun, D. Luo, and W. Wang (2025) TradingAgents: multi-agents llm financial trading framework. Note: arXiv:2412.20138 (v7), last revised 2025-06-03 External Links: 2412.20138, Document, Link Cited by: §1, §1, §2.2, §3. [30] F. Xiong, X. Zhang, A. Feng, S. Sun, and C. You (2025) QuantAgent: price-driven multi-agent llms for high-frequency trading. Note: arXiv:2509.09995 (v3), last revised 2025-09-27 External Links: 2509.09995, Document, Link Cited by: §1, §1, §2.4. [31] A. Yang, B. Yang, B. Zhang, B. Hui, B. Zheng, B. Yu, C. Li, D. Liu, F. Huang, H. Wei, H. Lin, J. Yang, J. Tu, J. Zhang, J. Yang, J. Yang, J. Zhou, J. Lin, K. Dang, K. Lu, K. Bao, K. Yang, L. Yu, M. Li, M. Xue, P. Zhang, Q. Zhu, R. Men, R. Lin, T. Li, T. Tang, T. Xia, X. Ren, X. Ren, Y. Fan, Y. Su, Y. Zhang, Y. Wan, Y. Liu, Z. Cui, Z. Zhang, and Z. Qiu (2025) Qwen2.5 technical report. External Links: 2412.15115, Link Cited by: §5.5. [32] Q. Zhan, Z. Liang, Z. Ying, and D. Kang (2024) InjecAgent: benchmarking indirect prompt injections in tool-integrated large language model agents. Note: Findings of ACL 2024 External Links: 2403.02691, Document Cited by: §6. [33] L. Zhao, R. Sun, Z. Jiang, B. Yang, Y. Bai, M. Chen, X. Wang, J. Li, and Z. Bai (2025) ContestTrade: a multi-agent trading system based on internal contest mechanism. Note: arXiv:2508.00554 (v3), last revised 2025-08-18 External Links: 2508.00554, Document, Link Cited by: §1, §1, §2.4. [34] W. Zou, R. Geng, B. Wang, and J. Jia (2025) PoisonedRAG: knowledge corruption attacks to retrieval-augmented generation of large language models. In Proceedings of the 34th USENIX Security Symposium (USENIX Security ’25), Seattle, WA, USA, p. 3827–3844. External Links: Link Cited by: §4.