Newest papers

Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

Mengxiao Wang, Nitesh Saxena · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.26438 · cited by 0 works (OpenAlex) · open-access PDF

Indonesian

Karena mereka membaca feed yang sama di bawah kebijakan yang hampir identik, satu posting yang diproduksi dapat mendorong mereka ke dalam perdagangan yang sama pada saat yang sama. Kami menyajikan benchmark serangan sistematis untuk injeksi informasi terhadap agen perdagangan LLM. Tidak seperti injeksi prompt, yang menargetkan instruksi model, injeksi informasi menghentikan bukti yang dipercaya agen. Benchmark meliputi lima vektor injeksi dan tujuh kategori peristiwa pada saat yang sama. Kami menyajikan lebih dari ~10.000 keputusan penilaian untuk injeksi informasi terhadap 15 saham AS. Lima temuan muncul. (i) injeksi prompt mencapai tingkat keberhasilan peer-to-peer 14% (RAS), tetapi injeksi informasi menghentikan bukti yang dipercaya agen, tetapi dua panel 30 kata mencapai 100% pada semua 15 saham, mengubah perdebatan LLM-security yang

Machine translation (Meta M2M100); the English original follows.

Abstract

Large language model (LLM) agents now trade real capital using news as evidence, yet they cannot reliably tell fabricated headlines from real news. Because they read the same feeds under near-identical policies, a single fabricated post can push them into the same trade at the same moment. We present a systematic attack benchmark for information injection against LLM trading agents. Unlike prompt injection, which targets the model's instructions, information injection targets the evidence the agent trusts. The benchmark spans five injection vectors and seven event categories, evaluated over ~10,000 decisions on 15 U.S. stocks. Five findings emerge. (i) Prompt injection achieves 14% attack success rate (ASR), but fabricated news reaches 62% and two 30-word templates reach 100% on all 15 stocks, inverting the usual LLM-security intuition. (ii) For fact-poisoning templates, surface form matters more than content, since removing credibility cues such as a named source or a "BREAKING" tag drops ASR from 100% to 0% while the fake claim remains identical. (iii) Success depends on the agent's state, with a fake indicator panel scoring 91% against an agent about to hold but 12% against one about to buy. (iv) Attacks generalize across model vendors and remain effective when blended, unlabeled, into real news feeds. (v) Most attacks evade standard defenses, since model scaling stops shallow vectors but not fact poisoning, peer debate fails, and only hierarchical aggregation reduces ASR.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Credibility, Computer science, Benchmark (surveying), Computer security, Event (particle physics), Language model

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange