---
title: Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents
url: https://www.ml-quant.com/papers/arxiv/2610.26438/
site: ML-Quant (https://www.ml-quant.com)
updated: 2026-10-23
license: Summaries CC BY 4.0; links go to the original sources
index: https://www.ml-quant.com/llms.txt
identifier: arXiv:2610.26438
source_url: https://arxiv.org/abs/2610.26438
featured: 2026-10-23
citations: unknown
topic: ML & AI Methods
---


# Fake News, Real Crashes: Information Injection Attacks on LLM Financial Trading Agents

Fabricated news reaches 62% attack success against LLM trading agents, far exceeding prompt injection, with surface-form credibility cues mattering more than content accuracy.

- Source: https://arxiv.org/abs/2610.26438
- Identifier: arXiv:2610.26438
- Released: 2026-10-20
- First featured: Quant Letter No. 136 (2026-10-23): https://www.ml-quant.com/issues/2026-10-23/
- Citations (Semantic Scholar): not tracked
- Published in: not yet
- Topic: ML & AI Methods
- Authors: Mengxiao Wang, Nitesh Saxena

## Abstract (arXiv, CC0)

Large language model (LLM) agents now trade real capital using news as evidence, yet they cannot reliably tell fabricated headlines from real news. Because they read the same feeds under near-identical policies, a single fabricated post can push them into the same trade at the same moment. We present a systematic attack benchmark for information injection against LLM trading agents. Unlike prompt injection, which targets the model's instructions, information injection targets the evidence the agent trusts. The benchmark spans five injection vectors and seven event categories, evaluated over ~10,000 decisions on 15 U.S. stocks. Five findings emerge. (i) Prompt injection achieves 14% attack success rate (ASR), but fabricated news reaches 62% and two 30-word templates reach 100% on all 15 stocks, inverting the usual LLM-security intuition. (ii) For fact-poisoning templates, surface form matters more than content, since removing credibility cues such as a named source or a "BREAKING" tag drops ASR from 100% to 0% while the fake claim remains identical. (iii) Success depends on the agent's state, with a fake indicator panel scoring 91% against an agent about to hold but 12% against one about to buy. (iv) Attacks generalize across model vendors and remain effective when blended, unlabeled, into real news feeds. (v) Most attacks evade standard defenses, since model scaling stops shallow vectors but not fact poisoning, peer debate fails, and only hierarchical aggregation reduces ASR.

## Related

- [AlphaDiverse: Post-Training Local Quantitative Research Agents for Diverse Exploration in Alpha Factor Mining](https://www.ml-quant.com/papers/arxiv/2609.29014/): Proposes a multi-agent system with post-training that automates alpha factor mining locally, using diverse research paths and joint optimization to broaden exploration while maintaining prediction quality.
- [Can Generative AI agents behave like humans? Evidence from laboratory market experiments](https://www.ml-quant.com/papers/arxiv/2505.07457/): Large Language Models (LLMs) have potential in mimicking human behavior in economic markets, but need more research for improved diversity and accuracy.
- [Quant-Arena: Benchmarking LLM Agents for Quantitative Trading Research](https://www.ml-quant.com/papers/arxiv/2610.30113/): A public benchmark tests whether large language models can complete end-to-end quantitative research with real trading constraints; no frontier model beats the equal-weight market in 2024.
- [VQuant: An Agentic Large Language Model Architecture for Automated Quantitative Financial Analysis and Document Generation: Reasoning-Augmented Tool Orchestration, In-Loop Numerical Computation, and Multi-Format Reporting](https://www.ml-quant.com/papers/ssrn/7650999/): A platform couples a language model with deterministic execution to turn natural-language requests into auditable reports where every figure is from live data or reproducible code, not model hallucination.
- [AlphaPilot: Multi-Turn Tool-Using LLM Agents for Adaptive Alpha Mining with Reinforcement Learning](https://www.ml-quant.com/papers/arxiv/2610.15488/): A reinforcement-learning framework trains multi-turn tool-using LLM agents to discover factor expressions by conditioning on market descriptions and querying real-data feedback.
- [RICE-Alpha: Reliability-Informed Correction with Event Graphs for LLM-Agent Stock Forecasting](https://www.ml-quant.com/papers/arxiv/2609.34004/): RICE-Alpha uses event graphs and historical reliability to improve LLM-based stock forecasting, achieving stronger results on Nasdaq-100 and Hang Seng panels than competing LLM agents.