Adversarial News and Profit Loss: Manipulating News Headlines in LLM-Driven Algorithmic Trading
Adversarial News and Lost Profits: Manipulating Headlines in LLM-Driven Algorithmic Trading
Quick read
Based on 论文全文 （AI 生成）; refer to the original
The researchers propose two types of human-invisible news headline manipulation techniques that can mislead LLM-driven algorithmic trading systems (ATS), reducing cumulative returns by up to 17.7 percentage points in a 14-month backtest. The techniques include Unicode homoglyph substitution, which disrupts stock name recognition; and injecting hidden text with display:none into headlines, which reverses sentiment polarity. The authors implement an ATS in Backtrader that combines LSTM price prediction with LLM sentiment analysis. On FinBERT, the homoglyph attack causes 99.1% of headlines to fail to correctly associate stocks, and the hidden text flips sentiment polarity in 65.6% of headlines. A single-day attack reduces cumulative returns by about 3.5% on average. Tests across 10 models show O3 is the most robust, while finance-specific models are the most vulnerable.
- LLM 被越来越多用于金融新闻情感分析，驱动算法交易系统（ATS）做买卖决策。若攻击者篡改新闻标题，使其对人眼不可见但被 LLM 读取，可能误导交易并造成金钱损失；此前尚无工作量化这种系统级经济影响。
- 作者设定攻击者无法直接接触 ATS，但能在某一天篡改与某只股票相关的新闻标题，采用两种人眼不可察觉的手段：Unicode 同形字替换（破坏股票名识别）和隐藏文本注入（用 display:none 等翻转情感）。他们用 Backtrader 实现一个融合 LSTM 价格预测与 LLM 情感（FinBERT 等）的 ATS，在 14 个月真实数据上做回测。
- 在无攻击时，LSTM+LLM 的 ATS 累计收益高于仅 LSTM。单日攻击即可误导 LLM：同形字使约 99% 标题无法正确映射股票，隐藏文本使约 66% 标题情感翻转；平均使年化收益下降约 3 个百分点，最坏下降 17.7 个百分点，且 ATS 仍保持盈利。跨 9 个 LLM 测试显示攻击可迁移，O3 相对更稳健。对 27 名 FinTech 从业者的调查支持该威胁模型的现实性。
- 作者不声称结果具有普遍性：ATS 的交易频率、历史窗口、券商、训练数据等都可能不同，真实系统行为也可能不同。攻击方式、同形字和隐藏文本的实现方式还有很多，输入清洗等防御存在权衡，无法覆盖全部攻击面；作者建议后续在不同 ATS 设置中复现并评估。
The paper quantifies the profit loss of an LLM trading system from a single-day headline manipulation over a 14-month backtest, and compares robustness differences across 10 models.