Market data presentation alters large language model pricing behavior
Market Signal Injection: Adversarial Context Manipulation of LLM Pricing Agents
Artificial IntelligenceComputation and Language
Summary
Pricing agents powered by large language models can change their pricing decisions just by how market information is shown, not by changing the actual numbers. The authors demonstrate attacks that tweak things like competitor order or tone in text to shift prices and outcomes between simulated firms. Some models are more vulnerable, and bigger models aren’t always better at resisting these tricks. The authors also tested ways to detect and reduce these effects, showing that formatting and text framing matter for these AI pricing strategies.
What this means in practice
- •For economic modeling teams: Improve reliability of AI-based pricing simulations by accounting for data presentation effects on model outputs.
- •For ai safety engineers: Develop defensive tools to detect and mitigate adversarial manipulation of market data inputs to pricing AI systems.
Authors
Dohun Lee, Hyunwoo Park
Abstract
Large language model (LLM) pricing agents may respond to how market data is presented, even when its numerical values remain unchanged. We introduce market signal injection (MSI), an attack that manipulates numerical formatting, competitor ordering, or qualitative market commentary without issuing explicit instructions. We evaluate nine open-weight models in simulated Bertrand duopoly and triopoly markets and three proprietary models in duopoly markets. Sentiment-based attacks produce the largest behavioral shifts, which propagate to other firms and alter profits and consumer surplus. Susceptibility varies across model families, and larger models are not consistently more robust. Matched neutral-text controls and a rule-based agent support a framing-based account of these shifts under the fixed demand parameters of our simulation. Episode-held-out probes distinguish baseline from attacked activations in all eleven re-evaluated model--condition pairs: linear AUC is 1.00 and MLP AUC ranges from 0.93 to 0.99. This separability does not by itself identify harmful pricing decisions. Input canonicalization removes the tested sentiment attacks, while decision boundary anchoring, which combines prompt constraints with output projection, provides partial mitigation under the tested adaptive attacks. These results identify data presentation as an attack surface for LLM pricing agents and motivate defenses that account for interactions among agents.