[Paper Review] Adversarial Attacks on Machine Learning Systems for High-Frequency Trading

Micah Goldblum, Avi Schwarzschild+2 more|RePEc: Research Papers in Economics|Feb 21, 2020

Market Dynamics and Volatility9 citations

TL;DR

This paper introduces targeted, cost-constrained adversarial attacks on machine learning models used in high-frequency trading (HFT), leveraging differentiable trading simulations to generate realistic perturbations to order book data. It demonstrates that even small, sparse adversarial orders—mimicking spoofing—can significantly degrade model performance across diverse architectures, revealing critical robustness vulnerabilities in financial AI systems.

ABSTRACT

Algorithmic trading systems are often completely automated, and deep learning is increasingly receiving attention in this domain. Nonetheless, little is known about the robustness properties of these models. We study valuation models for algorithmic trading from the perspective of adversarial machine learning. We introduce new attacks specific to this domain with size constraints that minimize attack costs. We further discuss how these attacks can be used as an analysis tool to study and evaluate the robustness properties of financial models. Finally, we investigate the feasibility of realistic adversarial attacks in which an adversarial trader fools automated trading systems into making inaccurate predictions.

Motivation & Objective

• To analyze the robustness of machine learning models used in high-frequency trading (HFT) through adversarial attacks.
• To develop a differentiable trading simulation that enables adversaries to anticipate how their own orders affect victim models.
• To evaluate the feasibility of low-cost, detectable adversarial attacks on HFT systems using realistic order book perturbations.
• To investigate transferability of adversarial attacks across different model architectures (linear, MLP, LSTM) in financial prediction tasks.
• To demonstrate that interpretable adversarial patterns—such as creating artificial order book imbalances—can fool models with minimal financial cost.

Proposed method

• The authors use a differentiable trading simulation to model how adversarial orders propagate through the order book and affect model inputs in a differentiable manner.
• They generate adversarial perturbations on order book data using projected gradient descent (PGD) with a step size α drawn from a uniform distribution U(0, 40).
• For universal attacks, they initialize a perturbation vector to zero and iteratively update it using gradients from mini-batches of training samples, applying a learning rate α ∼ U(0, 10).
• A sparsity penalty is introduced as 5× the relative size of the perturbation to encourage low-cost, sparse attacks.
• The method stores order book data in two formats: raw snapshots and grouped-by-price entries to enable efficient, parallel backpropagation with O(n) complexity.
• The attack process is applied to models trained on real stock order book data (e.g., Ford), and results are evaluated on test data and transferred to unseen models.

Experimental results

Research questions

• RQ1 Can adversarial attacks be constructed on HFT models using only manipulations of the order book that are financially and operationally realistic?
• RQ2 To what extent do adversarial perturbations remain effective across different model architectures (linear, MLP, LSTM) in financial prediction tasks?
• RQ3 How small can an adversarial attack be in terms of order book size while still causing significant model misclassification?
• RQ4 Can adversarial patterns be interpreted as known market manipulation strategies, such as spoofing?
• RQ5 How does the inclusion of a sparsity penalty affect the cost and effectiveness of adversarial attacks on HFT models?

Key findings

• A universal adversarial attack with a relative order book size of 0.9% caused misclassification on 123 out of 341 test inputs, demonstrating high effectiveness with minimal cost.
• The same attack achieved 157 misclassifications with a 3.8% relative size, showing that sparsity constraints reduce cost without drastically reducing impact.
• Adversarial patterns were interpretable: attackers created artificial local minima in the size-weighted average price, mimicking spoofing behavior.
• Transferability of adversarial attacks was high—attacks effective on one model (e.g., MLP) also fooled other models (e.g., LSTM), even when trained on different data.
• Neural network models (MLP, LSTM) outperformed linear models in accuracy but were significantly less robust to adversarial perturbations.
• The differentiable simulation enabled precise gradient-based attack generation, which commercial backtesting tools cannot support due to lack of automatic differentiation.