智能体
arxiv.org ·
市场信号注入：对 LLM 定价智能体的对抗性上下文操纵
论文提出 market signal injection（MSI）攻击，在不改变数值的情况下通过数字格式、竞争对手排序或定性市场评论操纵 LLM 定价智能体。作者在模拟 Bertrand 双寡头与三寡头市场中评估 9 个开源权重模型和 3 个专有模型，发现基于情感的注入造成最大行为偏移，并传导至其他企业、改变利润与消费者剩余；模型家族间易感性不同，更大模型未必更稳健。匹配的中性文本对照与规则智能体支持框架效应解释；留出回合探针在全部 11 个模型-条件对中区分基线与受攻击激活（线性 AUC 1.00，MLP AUC 0.93–0.99），但该可分性本身不能识别有害定价决策。输入规范化可消除所测试的情感攻击，决策边界锚定（提示约束+输出投影）在测试的自适应攻击下提供部分缓解。结论基于固定需求参数的模拟市场，缓解措施仅针对所测试攻击。
AI推荐理由 arXiv 新论文，提出 market signal injection（MSI）攻击：在不改变数值的前提下，通过数字格式、竞争对手排序或定性市场评论操纵 LLM 定价智能体。在模拟 Bertrand 双寡头/三寡头市场中评估 9 个开源权重模型和 3 个专有模型，发现基于情感的注入引发最大行为偏移，并传导至其他企业、改变利润与消费者剩余；模型家族间易感性不同，更大模型未必更稳健。匹配的中性文本对照与规则智能体支持“框架效应”解释；留出回合探针在全部 11 个模型-条件对中区分基线与受攻击激活（线性 AUC 1.00，MLP AUC 0.93–0.99），但该可分性本身不能识别有害定价决策。输入规范化可消除所测试的情感攻击，决策边界锚定（提示约束+输出投影）在测试的自适应攻击下提供部分缓解。局限：结论基于固定需求参数的模拟市场，缓解措施仅针对所测试攻击，未验证真实部署效果。
78
正文
Computer Science > Artificial Intelligence
arXiv:2609.18357 (cs)
[Submitted on 16 Sep 2026]
Title:Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents
Authors:Dohun Lee, Hyunwoo Park
View a PDF of the paper titled Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents, by Dohun Lee and Hyunwoo Park
View PDF
HTML (experimental)
Abstract:Large language model (LLM) pricing agents may respond to how market data is presented, even when its numerical values remain unchanged. We introduce market signal injection (MSI), an attack that manipulates numerical formatting, competitor ordering, or qualitative market commentary without issuing explicit instructions. We evaluate nine open-weight models in simulated Bertrand duopoly and triopoly markets and three proprietary models in duopoly markets. Sentiment-based attacks produce the largest behavioral shifts, which propagate to other firms and alter profits and consumer surplus. Susceptibility varies across model families, and larger models are not consistently more robust. Matched neutral-text controls and a rule-based agent support a framing-based account of these shifts under the fixed demand parameters of our simulation. Episode-held-out probes distinguish baseline from attacked activations in all eleven re-evaluated model--condition pairs: linear AUC is 1.00 and MLP AUC ranges from 0.93 to 0.99. This separability does not by itself identify harmful pricing decisions. Input canonicalization removes the tested sentiment attacks, while decision boundary anchoring, which combines prompt constraints with output projection, provides partial mitigation under the tested adaptive attacks. These results identify data presentation as an attack surface for LLM pricing agents and motivate defenses that account for interactions among agents.
Comments:
Subjects:
Artificial Intelligence (cs.AI); Computation and Language (cs.CL)
Cite as:
arXiv:2609.18357 [cs.AI]
(or
arXiv:2609.18357v1 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2609.18357
Focus to learn more
arXiv-issued DOI via DataCite (pending registration)
Submission history
From: Dohun Lee [view email]
[v1]
Wed, 16 Sep 2026 09:16:08 UTC (106 KB)
Full-text links:
Access Paper:
View a PDF of the paper titled Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents, by Dohun Lee and Hyunwoo Park
View PDF
HTML (experimental)
TeX Source
view license
Current browse context:
cs.AI
new
|
recent
| 2026-09
Change to browse by:
cs
cs.CL
References & Citations
NASA ADS
Google Scholar
Semantic Scholar
export BibTeX citation
Loading...
BibTeX formatted citation
×
loading...
Data provided by:
Bookmark
Bibliographic Tools
Bibliographic and Citation Tools
Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
Connected Papers Toggle
Connected Papers (What is Connected Papers?)
Litmaps Toggle
Litmaps (What is Litmaps?)
scite.ai Toggle
scite Smart Citations (What are Smart Citations?)
Code, Data, Media
Code, Data and Media Associated with this Article
alphaXiv Toggle
alphaXiv (What is alphaXiv?)
Links to Code Toggle
CatalyzeX Code Finder for Papers (What is CatalyzeX?)
DagsHub Toggle
DagsHub (What is DagsHub?)
GotitPub Toggle
Gotit.pub (What is GotitPub?)
Huggingface Toggle
Hugging Face (What is Huggingface?)
ScienceCast Toggle
ScienceCast (What is ScienceCast?)
Demos
Demos
Replicate Toggle
Replicate (What is Replicate?)
Spaces Toggle
Hugging Face Spaces (What is Spaces?)
Spaces Toggle
TXYZ.AI (What is TXYZ.AI?)
Related Papers
Recommenders and Search Tools
Link to Influence Flower
Influence Flower (What are Influence Flowers?)
Core recommender toggle
CORE Recommender (What is CORE?)
Author
Venue
Institution
Topic
About arXivLabs
arXivLabs: experimental projects with community collaborators
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Which authors of this paper are endorsers? |
Disable MathJax (What is MathJax?)