Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents
cs.AI · cs.CL
Quick verdict
Simulation study: presentation-only edits of rival inputs steer LLM pricing agents and markets; credible, but n=5 seeds and fixed demand limit scope.
Summary
The paper introduces market signal injection (MSI): an adversary alters how market data is presented to a rival's LLM pricing agent—numerical formatting, competitor ordering, or a qualitative sentiment sentence—without any explicit instruction. Using a logit-demand Bertrand duopoly/triopoly (Calvano-style, 300 rounds, five seeds), the authors evaluate nine open-weight models plus GPT-4o, GPT-4o-mini, and Claude Haiku 4.5, measuring shifts in the collusiveness index. Sentiment commentary ('stagnating') causes the largest shifts (e.g., Gemma-9B from −0.151 to −3.838; impacts ≈2.5 for GPT-4o/GPT-4o-mini), propagating to non-target firms (83–99% response ratios). Matched neutral-text controls and a rule-based agent support a framing-based account under fixed demand. Episode-held-out linear probes separate baseline from attacked activations with AUC 1.00 in all eleven re-evaluated pairs (MLP 0.93–0.99). Input canonicalization removes the tested sentiment attacks; decision boundary anchoring (prompt constraints plus output projection) partially mitigates but leaves residual distortion under three adaptive anchor-aware attacks. Main limitations: n=5 seeds with unadjusted Welch tests, an ad hoc impact threshold (I>0.5), a stylized symmetric market, and reliance on the artificial assumption that fully supplied demand parameters make the commentary uninformative.
Review complete
Assessment at a glance
5
risk flags identified
● high 0
● medium 3
● low 2
5 strengths · 5 weaknesses · 5 author questions
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Presentation-only manipulation of a rival's market inputs—numerical format, entry ordering, or sentiment commentary, with no explicit instructions—can change LLM pricing decisions and propagate through competitors' responses to alter profits and consumer surplus.
- Sentiment commentary produces the largest behavioral shifts; susceptibility varies by model family and larger scale does not consistently confer robustness (Qwen impact 0.72→1.39→0.45→0.35 across 7B–72B; Llama-70B remains at 1.88).
- Matched neutral-text controls and a rule-based agent support a framing-based account of the shifts within the fixed-demand simulation.
- Episode-held-out linear probes distinguish baseline from attacked activations with AUC 1.00 across eleven model–condition pairs, establishing detectability but not identification of harmful pricing decisions.
- Input canonicalization removes the tested sentiment attacks entirely, while decision boundary anchoring provides only partial mitigation with residual distortion under the tested adaptive attacks.
Strengths
Carefully scoped threat model distinct from prompt injection
Definitions 1–2 (Sec. 3.1) restrict the adversary to presentation edits of the target's market-information block with no instructions, and Appendix E explicitly flags which NFA variants (round_1dp, four_dp) are not information-preserving—uncommon candor about the attack's own taxonomy.
Matched controls make the framing account more credible
Sec. 5.4 inserts three neutral sentences at the identical 'Market signal:' position (none reaches p<0.05 individually) versus stagnating (p<0.001 in Llama-8B and Gemma-9B), and adds a rule-based best-response agent plus Gaussian price noise (|Δ|≤0.04) as invariance references.
Unusually transparent statistical reporting
Honest scoping of the interpretability result
Theory ties the propagation effect to economics
Weaknesses
Small n with many unadjusted tests
Impact metric conflates direction of harm
Baseline instability across campaigns
External validity hinges on an artificial assumption
Defense evaluation has acknowledged gaps
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is market signal injection (MSI)?
MSI is an attack introduced in this paper in which an adversary changes only how market data is presented to an LLM pricing agent—for example rewriting prices in a different number format, reordering competitor entries, or inserting a qualitative sentence like 'market conditions are stagnating'—without issuing any instruction, and thereby shifts the agent's pricing decisions in simulated markets.
Which LLM pricing agents were most vulnerable in the study?
Sentiment commentary ('market stagnating') caused the largest shifts: Gemma-2 9B, Llama-3.1 8B, and Mistral-7B showed index impacts of roughly 2.7–3.7, GPT-4o and GPT-4o-mini about 2.5, and Claude Haiku 4.5 about 1.1. Larger models were also affected (Llama-70B impact 1.88), so model scale did not reliably confer robustness.
Can these presentation-based attacks be detected or defended against?
Partially. Linear probes on the model's internal activations separated attacked from baseline states perfectly (AUC 1.00) in the tested conditions, though this only shows the states differ, not which decisions are harmful. Input canonicalization—stripping commentary lines and normalizing number formats—removed the tested sentiment attacks, while a prompt-plus-projection defense (decision boundary anchoring) only partially mitigated effects and adaptive attacks left residual distortion.
Is market signal injection the same as indirect prompt injection?
No. Indirect prompt injection smuggles instructions into external content; MSI's manipulated content contains no instructions at all. It only changes the presentation of data (formatting, ordering, added commentary), which is why defenses that separate instructions from data do not directly address it.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures (trajectory plots, scaling curves) are only available via captions in the extracted text; their visual content could not be verified.
- The extraction contains some OCR-mangled formulae and table fragments; numeric values cited here were cross-checked against the running text where possible.
- Code and data are promised ('We plan to release') but not yet available, so implementation-level claims (e.g., IC's cleaning rules) could not be inspected.
- This is an arXiv v1 preprint (2609.18357) and has not undergone peer review.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.