On the Robustness of Sentiment Analysis for Stock Price Forecasting
Authors: Gabriel Deza
Colin Rowat
Nicolas Papernot
Venue:  (2021)
Keywords: adversarial machine learning
adversarial examples
stock price forecasting
finance

Abstract: Machine learning (ML) models are known to be vulnerable to attacks both at training and test time. Despite the extensive literature on adversarial ML, prior efforts focus primarily on applications of computer vision to object recognition or sentiment analysis to movie reviews. In these settings, the incentives for adversaries to manipulate the model's prediction are often unclear and attacks require extensive control of direct inputs to the model. This makes it difficult to evaluate how severe the impact of vulnerabilities exposed is on systems deploying ML with little provenance guarantees for the input data. In this paper, we study adversarial ML with stock price forecasting. Adversarial incentives are clear and may be quantified experimentally through a simulated portfolio.  We replicate an industry standard pipeline, which performs a sentiment analysis of Twitter data to forecast trends in stock prices. We show that an adversary can exploit the lack of provenance to indirectly use tweets to  manipulate the model's perceived sentiment about a target company and in turn force the model to forecast price erroneously. Our attack is mounted at test time and does not modify the training data. Given past market anomalies, we conclude with a series of recommendations for the use of machine learning as input signal to trading algorithms. 

Under review as a conference paper at ICLR 2021
ON THE ROBUSTNESS OF SENTIMENT ANALYSIS FOR STOCK PRICE FORECASTING
Anonymous authors Paper under double-blind review
ABSTRACT
Machine learning (ML) models are known to be vulnerable to attacks both at train- ing and test time. Despite the extensive literature on adversarial ML, prior efforts focus primarily on applications of computer vision to object recognition senti- ment analysis to movie reviews. In these settings, the incentives for adversaries to manipulate the model's prediction are often unclear and attacks require exten- sive control of direct inputs to the model. This makes it difficult to evaluate how severe the impact of vulnerabilities exposed is systems deploying ML with little provenance guarantees for the input data. In this paper, we study adversar- ial ML with stock price forecasting. Adversarial incentives are clear and may be quantified experimentally through a simulated portfolio. We replicate an in- dustry standard pipeline, which performs sentiment analysis of Twitter data forecast trends in stock prices. We show that an adversary can exploit the lack of provenance indirectly use tweets to manipulate the model's s perceived sentiment about a target company and in turn force the model to forecast price erroneously. Our attack is mounted at test time and does not modify the training data. Given past market anomalies, we conclude with series of recommendations for the use machine learning as input signal to trading algorithms.
INTRODUCTION
Research on the vulnerability of machine learning (ML) adversarial examples (Biggio al. [013] Szegedy et al. 2013) focused, with few exceptions (Kurakin et al.) 2016 Brown et al. 2017). on adversaries with immediate control over the inputs to an MI. model. Yet, ML. systems are often applied on large corpora of data collected from sources only partially under the control of adver- saries. Recent advances in language modelling (Devlin et al. 2019 [rown et al., 2020) illustrate this well: they rely training large architectures on unstructured corpora of text crawled from the Internet. This raises a natural question: when the provenance of train or test imputs to ML systems is ill defined, does this advantage model developers adversaries? Here, by provenance we refer to a detailed history of the flow of information into a computer system (Muniswamy-Reddy et al.).
We study the example of such ML system for stock price forecasting. In this application, MI. predictions can both serve as inputs to algorithmic trading or to assist human traders. We choose the example of stock price forecasting because involves several structured applications of ML, including sentiment analysis over a spectrum of public information sources (c.g., news, Twitter, etc.) with little provenance guarantees. There is also long history of leveraging knowledge inaccessible to all market participants to gain an edge in predicting the prices of securities. Thales used his knowledge of astronomy to corner the market in olive-oil presses and generate a profit.
We first reproduce an ML pipeline for stock price prediction. inspired by practices common in the industry. We note that choosing the right time scale is of paramount importance. MI is better suited for low frequency intra-day and weekly trading than high-frequency trading, because the latter requires decision speeds much faster than achievable by ML hardware accelerators, Although there has been prior work attacking ML for experimental setting is 7 orders of magnitude slower than NASDAQ timestamps (NASDAQ) 2020), which high-frequency trading finms use. In contrast, ML in low- frefereuency trading has attracted greater practical interest of the industry, with two major finance data vendors vastly expanding their sentiment data API offerings in the past decade (Bloomberg) 2017 Reuters 2014). This is serve
trading (Goldblum et al. 22200) their

---

Under review as a conference paper at ICLR 2021
the growing demand from institutional and advanced retail market players use ML models for sentiment analysis at lower frequencies.
We adopt this low frequency setting, and collect our data from Twitter and Yahoo finance, which provides 1-minute frequency stock price data. Using these services, we collected tweets related
to Tesla and Tesla's stock prices over 3.5 years. We then used FinBERT (Araci 2019), financial sentiment classifier to extract sentiment- based features from every tweet. We describe these methods in more depth in Section 3.1 they are general and applicable any company of interest.
We use sentiment features as our input and the change in price as our target to train multiple prob- abilistic forecasting models. We show that including sentiment features extracted from Twitter can reduce the mean absolute eπror of a model that only learns from historical stock prices by half. Sec- tion 3.2 introduces the probabilisticc models used in our work. Predicting stock prices is a known hard task. Even a limited, per trade edge can lead to large gain when scaled by the number of trades preformed (Laughlin) 2014). Moreover, typically sentiment analysis is only one of many indicators used in trade decision. Hence our model only needs to provide a slight non-trivial advantage over random baselines to be effective in practice. We used our forecasts to implement portfolio strategies with positive returns, and measure its performance across other metrics to showcase its advantage.
Equipped with this realistic MI. pipeline for stock price forecasting, which takes input data from a source with little provenance guarantees (i.e., Twitter), we set out to study its robustness. Unlike pre- vious settings of adversarial examples like vision, where the realistic incentives for an adversary to change the classification is often unclear (Gilmer et al. 2018), in our setting there clear financial interests at stake. Furthermore, Twitter is already subject to vast disinformation campaigns (Zannet- tou al. 2019). These make even more complicated to assess the provenance of data analyzed by ML plppppppieeeee ines. To investigate the robustness of our stock price prediction pipeline, we use adversarial examples show that our financial sentiment analysis model is brittle in this setting.
While attacks against NLP models are not new in research settings, our work demonstrates the prac- tical impacts that attacks on an NLP component (i.c., sentiment analysis) of system can have on downstream tasks like stock price prediction. We show that an adversary can significantly manipu- late the forecasted distribution's parameters in targeted direction, while perturbing the sentiment features minimally at test time only. An adversary would determine parameter and direction, such as increasing variance forecasted stock prices, and compute a corresponding perturbation. given control over training data, the adversary's s capabilities would only further increase.
The contributions of this paper are the following:
We propose a realistic setting for adversarial examples through the task of sentiment anal- ysis for stock price forecasting. We develop a dataset collection pipeline using ticker data and Twitter discussion, for any ticker (i.e., company). This includes querying Twitter, pro- cessing data into a format fit for training, and a suitable sentiment analysis model.
We implement different sentiment-band based probabilistic forecasting models that are able to perform better then naive approach in forecasting stock price changes given Twitter dis- cussion surrounding the company. DeepAR-G, a Gaussian probabilistic forecasting model, outperformed all other models in our experiments.
We subject our pipeline to adversarial manipulation, leveraging information from our model to minimally modify its inputs into adversarial examples, while achieving important changes in our model's 's output such as shifting distribution parameters of our probability distribution in any direction we wish.
We intend release our code and data should the manuscript be accepted. Beyond the implications of our findings in settings where an adversary is present, we stress that capturing model performance in the worst case setting important for the domain of finance. These threats are very real: past mar- ket anomalies led to the collapse of the Knight Capital Group, and there were legal matters following the suspected manipulation of Tesla stock via Twitter. Therefore, it is important for financial institu- tions to understand how their ML systems could behave in worst-case settings, lest market anomalies impact these systems in unprecedented ways. Furthermore, unforeseen catastrophic events (e.g., a natural disaster or pandemic) are often hard to model via standard testing procedures be it order gen- eration simulators or backtesting, i.e. simulating trading on replayed past data. Our methodology based on adversarial examples enables institutional traders assess maximum loss risk effectively.
2

---

Under review as a conference paper at ICLR 2021
2 BACKGROUND
Stock Price Forecasting and Market Anomalies. Market agents have long attempted to forecast stock prices. Nonetheless, predicting market behaviour notoriously difficult for several reasons. If predictive factors become known, they alter the market's behaviour as agents attempt to exploit then. The limit of this behaviour is the efficient market hypothesis (French 1970), which states that any information is immediately incorporated in prices. leaving a white noise process. The efficient market hypotheis has generated debate about whether it possible to systematically outperform the market. See Cornell (2020) for recent analysis suggesting that outperformance is possible, and may be linked to outsiders not understanding how such performance is attained. Lastly, markets follow the Red queen effect (Van Valen 1973): parties adapt their prediction capabilities, markets also evolve by becoming more challenging to forecast.
The deviations from the efficient market hypothesis are known as market anomalies. They occasion- ally allow individuals to capitalize off of such discrepancies. See Bass (199)) for a readable account of successful application of chaos theory market prediction. Beyond traditional techniques like arbitrage and standard data analysis, hopes for discovering factors that have not yet been traded away presently centred on MI. techniques, primarily, as the medium by which advances in computing power will drop the costs of research, including, for non-linear predictive factors. Thus, ML is a good fit to tackle the problem stated in the introduction. Indeed, ML models for tasks involving sequential data are now able to learn complex non-linear relationships. Initial work applied these advances to financial time series tasks (Fischer & Krauss 2018).
Sentiment Analysis in Finance. Sentiment analysis serves an input signal to trading decisions because it allows one to rapidly digest new information relevant to the market. This requires pro- cessing large quantities of text: e.g., news, financial statements, etc. Previous methods of extracting sentiment and moods were through curated lexicons where every word has a score associated with each sentiment (Bollen et al. 2011). Yet, word counting methods poorly reflect semantics since they are unable to factor in features like word order. [ollen et al.] (201T) also received criticism for selecting small and well specified testing set achieve good results. On the other hand, training more complex models such as neural networks requires larger datasets. We follow the approach of Araci (2019) and turn to language models such as BERT (Devlin et al. | 22019) or GTP-2 (Radford) et al. 2019) finetuned on financial sentiment analysis datasets. Such models are able to factor in features that lexicon-basee based methods could not, achieving a deeper understanding of the text.
Time Series Forecasting. The general question of how predict potential future trajectories from a series of observations is studied in the field of time series forecasting. While traditional modelling approaches like ARIMA (Box& & Jenkins 1968) and exponential smoothing (Hyndman et al.) 2008 have focused on generating forecasts for individual time series, which are typically called local models, more recent techniques based on deep learning enable us extract patterns from multiple (potentially related) time series jointly and capture these patterns in a global model. Popular archi- tectures for time series forecasting include recurrent neural networks (RNNs) (Salinas et al., 2020]] Smyl 2020), convolutional neural networks (CNNs) (Oord et al., 2016 Borovykh et al. 2017 77; Bai 2018 with 1-dimensional convolutions over time, as well as transformers (Vaswani et al. mechanisms, More details about the exact forecasting framework used in this work are established in Section 3.2
et al.
2017
Lim et al.) 2019 Li et al. 2019) using
Adversarial Examples. Extensive prior work in adversarial examples is in the vision do- main (Szegedy et al. 2013 Su et al. 2019). Despite the fundamental advances in our understanding of the robustness of ML these works enabled, the practicality of such work is limited, and the in-
centives of the adversary to achieve such forms of misclassification is unclear (Gilmer et al. 2018)). Recent work has focused on more practical domains, such as malware analysis (Kolosnjaji et al,, 2018) or sentiment analysis of movie reviews (Samanta & Mehtal 2017). Studying the implications of adversarial examples in financial applications is clear: the financial gain will motivate mali- cious individuals to attack ML models deployed by financial institutions. This begs the question of whether these applications of machine learning to finance will exhibit the same lack of robustness than their counterparts did in the vision domain. In our work, we adapt the common strategy of determining the model's 's sensitivity to perturbations in the input through an analysis of the model's gradients. In particular, we leverage previous work on RNNs (Papernot et al., 2016).
3

---

Under review as a conference paper at ICLR 2021
3 METHODS
To achieve our goals of studying adversarial ML on a pipeline with little provenance guarantces, we perform the following. First, collect dataset comprised of series of tweets about particular organization and the associated stock prices. Next, we preprocess this data to obtain relevant features as needed by our predictive models (Section[3.1) For the models themselves, we utilize probabílistic forecasting approaches (Section 3.2). Finally, we show how these forecasting models can be attacked (Section 3.3
A detailed overview of the aforementioned approach Figure I
Forecasting Model
Stock Forecasts
Daneset
Query
[text metatiata
Gradien:
Yelluu Finance
Query
Daily Ticker (Close Open)
Allack
Perturbed
Penurbed
Forecasts
collected from Twitter (1) and passed through FinBERT, financial sentiment classifier, produce 10 sentiment based features (2). Price data from Yahoo finance then collected to use as largets (3). We use the price data sentiment features to create dataset (4). then train probabilistic forecasting models (S) on the collected dataset. Lastly, we adversarially manipulate Twitter based features in our testing set to obtain an adverserial testing set (6) using gradient attack method (7). We then test the original and adversarial stock forecasts (8) using several metries that simulate portfolio's performance to determine the robustness our model and data.
Figure I: Tweets pertaining to company
3.1 DATA COLLECTION
We now explain steps taken create our dataset. Though we focus on one organization, our method- ology is applicable to any organization of interest.
chose to collect data about Tesla since it generates large vol- ume of discussion Twitter. Furthermore, when collecting data for other companies, our querying method ran into 2 problems: 1. homonyms: it was hard to distinguish between Amazon the com- pany and the Amazon rain-forest, and 2. unintended discussion: the majority of tweets pertaining to Microsoft were about Bill Gates heing discussed along with other billionaires. Homonyms are particularly interesting as studies have shown that 12% 25% of company pairs with similar names experience correlated price movements (Balashov & Nikiforov 2019).
Step 1. Collecting Tweets.
Tweets were collected by scraping Twitter posts that contain relevant words. This included: Tesla, $TSLA, Elon Musk, Model and more. Note that $TSLA is a special financial token called the company's 's ticker" For every tweet, we collected (a) the timestamp, (b) the text associated with the tweet, and (c) the number of likes and retweets. In total. we collected 120.292 tweets spanning 3.5 year period from 2017-01-02 to 2020-06-08. We limited ourselves to 896 days as the language used on Twitter frequently changes over time, introducing temporal concept drift.
Step Collecting Stock Prices. Ticker prices were collected via Yahoo Finance. Data for Tes was collected for the same period as the tweets at daily frequency, consisting of: (a) the opening price, and (b) the closing price. Opening price refers to the price when the market opens at 9:30 EST and closing price refers to the price when the market closes 16:00 EST. Observe that tweets continuous over time, while stock prices are not. Thus, we framed our time series data as follows: given tweets between 16:00 EST day t t-1 1 and 09:30 EST on day between the opening price on day and closing price on day t 1. Lastly, it is common practice to predict the log of the ratio of open price to closing price, known as the log return.
predict the difference
It is the symbolic used designate the stock the exchange and look up price change information.
4

---

Under review as a conference paper at ICLR 2021
Step 3. Performing Sentiment Analysis. Whilst performing sentiment analysis we found that is important to use pretrained language model that was previously finetuned on financial data. We compared two datasets and approaches for finetuning BERT. The first approach involves finetuning a dense layer of BERT on the Sentiment 10 dataset (Go et al., 2009). which contains 1.6M tweets labelled either positive or negative. The second approach involves using finetuned BERT model on corpus of financial sentiment data, called FinBERT (Araci 2019) FinBERT classifies text into 3 categories: positive, negative, and neutral.
dataset,
The first approach performed poorly in our tests. Although the second approach involves training on financial news and statements which contain a different distribution of vocabulary than those of tweets, we found that it performed significantly better on the data used to test the first approach. We thus used FinBERT as our sentiment classifier for the rest of our work. FinBERT outputs 3 log- its: O-, 0+, 0= representing the confidence of negative, positive and neutral classes. The predicted sentiment class is the one with the highest logit, and Sentiment score is defined as 04 o_.
Step 4. Extracting Features. Our dataset groups tweets into periods to match our daily ticker data. We explain the features we extract using information collected on September 17th 2019:
1. Time Related: (i) The date i.c., Tuesday, September 17 2019.
2. Stock Related: (ii) The opening price on Tuesday, September 17th 2019, and (iii) the
closing price on Monday, September 16th 2019.
3. Tweet Related: (iv) Number of tweets, (v) average likes, and (vi) average retweets.
4. Sentiment Based: vii,,x) The percentage of tweets belonging to each sentiment class,
(x) average sentiment score, and (xi,xii,xiii) average of each class's logit.
This results in 7 data points derived from sentiment and 3 from tweet metadata, resulting in 10 features. Additionally, we also utilize the date index, and the two stock related data points to cal- culate the log return of the target stock. Although the markets are closed over the weekend, events pertaining to or influencing the stock (e.g., an earthquake close to one of the company's 's factories) can occur over this period and be discussed on Twitter. Thus, Monday morning data points contain Twitter discussion from Friday after 16:00, the entire weekend, and up to 9:30 on Monday.
3.2 PROBABILISTIC FORECASTING
Using the dataset collected, we can lear a global model over the complete panel of time series to predict the stock's log return. Rather than outputting a foint-forecast for these values, we use a probabilistic forecasting strategy which allows us to account for the inherent uncertainties in the prediction. As part of our setup, investigate both the usage of a univariate time series model, which forecasts each time series independently of the other time series, and the multivariate setting in which we produce forecasts over multiple time series jointly.
The univariate probabilistic forecasting setting can be summarized as follows. Given a set Z (zi 1.T, 1 of univariate time series, with each element 24,:T, (2,,1, 2.,, 2i,r;) and a set of associated covariate vectors X = {a:; +: I we intend to model the probability distribution over future (unobserved) values 2, +:7, of length conditioned on past time series values 21,17T, and covariates 01,1:T,+7 using a neural network M parameterized by 4:
p P(2 24,1:T2 T1ITT)++) -M MM 21,1).+7))
Note that covariates assumed to be known for the full prediction length т. This setup can be generalized to multivariate forecasting over D-many time series by replacing predictions for a single time series ži,t with predictions over vector of time series 2,
IR
As part of this work we use the DeepAR (Salinas et al. 2020) (see Figure g for an overview) and VAR (Salinas et al., 2019)) architectures, which are autoregressive RNNs specifically designed for time series forecasting in the univariate and multivariate setting respectively. Specifically, we use their Python implementations in GluonTS" G (Alexandrov et al. 2019) for our experiments. Both models allow for flexible parametric and non parammeettii output distributions by using projection
https:: whtp:::///tttt.tccc/tcce abbp:///wwllassl//////// ts
5

---

Under review as a conference paper at ICLR 2021
layer to map the RNN output to parameters defining the chosen distribution function. For example, the chosen distribution is Gaussian, DeepAR parameterizes the mean and standard deviation at each time step I.... Ii + т. Finally, we also consider the GPVAR model (Salinas et al. 2019) which parameterizes the output as a low-rank Gaussian Copula process.
When working with DeepAR, consider stock log returns as single time series and the Twitter features as covariates. Recall that covariates are assumed to be known over the entire time period under consideration, including the prediction horizon of length т. This is the case with Twitter data as we do not know future tweets. To alleviate this issue, we consider forecasting 1 day in the future or the previous day's 's market closure, and predict the new day's opening price. When working with DeepAR's multivariate version DeepVAR and GPVAR, we consider the stock log returns and our sentiment features as time series we wish to predict. In this setting, we have no restriction on т, however the model is learning distributions for other series as well. When training, we cannot translate a decreasing loss to improvements towards a specific time series.
This is analogous to where a trader would collect all tweets posted after
3.3 GRADIENT ATTACK
The crafting method of our adversarial sequences similar to Papernot et al. (2016). In their imple- mentation, to perturb output j. they alter input if output is highly sensitive to input i, and other outputs k # are not sensitive to input i.
We implemented gradient attack for DeepAR alone, but the idea stays the same for multivariate settings. The inputs of our model are our covariates features I::4:T:77, while our outputs are the set of parameters defining our probability distribution, θ = {0),... (0',...., 0K) }. For each time step, we calculate the gradient of our distribution parameters with respect each covariate, resulting in a dimensional tensor of shape (r, N, K) for our Jacobian. The value [t, a, k) represents how sensitive parameter distribution 0 is at time step T; t, denoted f with respect covariate Ta,
Algorithm 1 Adversarial sequence crafting: Given I distribution parameter 8* of the distribution that is defined by the set of distribution parameters @ that we wish to push in the direction d, we iteratively perturb covariate Fa Ta + + by a fixed 5 if 0/,.+- is highly sensitive to that point and other distribution parameters are not.
Require: θ 0,, X,,,,,,,,,, 1: x f- x
2: for 0, 0,1..... do
3: a',t" argmax Jtt a, x|| x Enseoro- att,a,k)
4:
To Te- + + 6 (d
TT
5: end for
return... x²
The input to our crafting algorithm is distribution parameter we wish to perturb, 0*, a direction d which is the direction which we wish to perturb the input to. is -1 if we wish to decrease 0", or +1 if we wish to increase 0*, We determine the covariate a" and time t" which would perturb 0; + significantly, while perturbing other distribution parameters minimally. We do so by computing the
ratio of [][t, a, #]| to EptErre [[t, a, k] for each time step and covariate a, and we pick the and a that maximize this ratio. We then perturb XT + by a fixed value å in the direction d. For example, if our algorithm picks the positive sentiment score time and increases by 5, the adversary may: (1) post few tweets with strong positive sentiment or (2) post many tweets that are slightly positive. The algorithm devised in Papernot et al. (2016) for misclassifying movie reviews can be used for this task by targeting FinBERT instead. The adversary could start with random tweets or tweets posted in the past and perturb them until they reach the require positive score.
Lastly, the setting in Papernot et al. (2016) is classification of sentences, and the input is perturbed until the sentence is misclassified. As our task is not classification we do not have such a condition. Instead, perturb the input for fixed number of steps R.

---

Under review as a conference paper at ICLR 2021
4 EVALUATION
4.1 TO WHAT EXTENT CAN WE FORECAST STOCK PRICES WITH THE DESCRIBED PIPELINE?
Here study whether our stock forecasting models are capable of producing meaningful forecasts before we attempt to attack them, and if so, quantify their usefulness.
We run our models under different parameters and compare their results across 11 metrics shown in Table In particular, we evaluate the potential financial gains that a trader can expect through the Sharpe ratio and two active strategies: Greedy and Threshold. An explanation of these metrics is found in Appendix [.I as well as the hyper-pus parameters used (refer Appendix B.2.1 We used a 90-10 training testing split, resulting into testing set of 89 days shown Figure 7
As we are
interested in predictions lengths т (1,3), we implement a rolling window over our testing set. Instead of plotting probabilistic forecasts that are seperated due to our rolling testing set such as
Figure 3
we plot the mean of 100 samples paths taken from our distribution in Figure 2
Model
MAE (x10-2)
MАРE
MASE
RMSD (x10-7)
CRPS
Accuracy
Sharpe Ratio
Greedy
Threshuld
DeepAR-S-37
6.45
0.0155
1.449
2.127
1.265
49.45%
-31.9%
$ 4068
$ 77605
DeepAR-8-0
5.00
0,0199
1.110
0.670
1.381
50.55%
-26.1%
$ 4553
S 73351
D88pAR-87
5.93
0.0139
1.548
2.639
1.230
57.14%
-2.23%
SS -4000.
$6152
DeepAR-G
3.20
0.0109
0.99
0.524
1.199
57.14%
3.31%
$5002.1
$6103
DeapVAR
5.37
0.0170
1.592
4.666
51.65%
0.25%
-S 1227
5
DeepVAR-3
5.61
0.0145
1.356
1.698
N/A
54.95%
0.20%
-S 107.8
S 5440
GPVAR GPVAR 3
5.59
0.0135
1.262
1.263
52.75%
40.17%
$334422
4.61
0.0126
1.198
0.771
N/A
47.31%
-0.05%
-S 216.5
S 6422
Table I: Different forecasting models on a 90 day rolling window testing set. The target has a binary distri- bution of 54.95%. Sharpe ratio of 9.04% and passive gain of $ 245.3. DeepAR-G is the best performing model across every metric except our portfolio methods. CRPS values are not available for multivariate models as they were aggregated for all time series.
Our first experiment to determine the usefulness of Twitter covariates in univariate setting. We trained DeepAR without Twitter covariates on Gaussian and Student-t distributions, and then include Twitter covariates on the same 2 distributions. For our purposes, the important difference between the two distributions is that Student-t has heavier tails than the Gaussian distribution, resulting in a higher likelihood of extreme behaviour. These 4 scenarios are the first rows shown in Table T where- S indicates removing covariates, no S indicates the use of covariates and lastly S7 and G indicate Student-t and Gaussian distributions, respectively.
Including Twitter features as covariates improved performance across all metrics for Gaussian dis- tributions except the two portfolio metrics. Furthermore, the portfolios gains are only slightly worse and still positive return. Student-t performs worst across all implementations with the Twitter co- variates. Figure 2 shows the forecasts of DeepAR-STL and despite its performance, the shape of the forecasted log return is consistent with the real change in stock, but shifted horizontally or verti- cally by couple days or percentage log returns. These shifts make the overall performance of this method very poor, although the model has been able to learn something about the true forecasts.
Our second experiment tests our multivariate models such as DeeRVAR and GPVAR. We ran scenarios for each, one with prediction length of and another with prediction length of 3. We found that all 4 implementations did not perform as well as the univariate models. We show the distribution output of GPVAR-3 in Figure In this setting, the model is trained to learn a joint distribution over all 11 time series. We hypothesize that when the loss is being optimized, the Twitter-based based time series are significantly easier to learn compared to the log return of Tesla stock. Hence although our model's loss converges, very little improvement has been done in forecasting the log return of Tesla stock compared to the Twitter-based features.
Hence in Table D the best implementation was a Gaussian distribution using Twitter covariates- DeepAR-G. We visualize the resulting forecast in Figure We now determine the performance of our model not relative to each other, but in an absolute sense. Although the financial metrics show success with positive returns, this is likely due to the overall upward trend Tesla had during our testing set. The metric that is best suited for this task is MASE, which takes the ratio of the error of our forecast, to the error associated with predicting the previous days forecast. In every case except DeepAR-G, this value is above 1, indicating that predicting the previous day is better. In DeepAR-
7

---

Under review as a conference paper at ICLR 2021
G, the MASE is 0.996, indicating that the forecasted method is just slightly better then predicting the previous day's 's change. Accompanied by the discussion regarding DeepAR -ST, we believe that were able to implement pipeline that has limited but non-trivial forecasting ability.
4.2 To WHAT EXTENT IS OUR MODEL AND DATA VULNERABLE TO MANIPULATION?
We implement the attack formulated in Section 3.3 to both of our best performing models, DeepAR- G and DeepAR- ST, for different distribution parameters and directions. We characterize how much perturbation in our features is required to change our models' forecasts. We summarize our results where we show that an adversary is able to manipulate a distribution parameter in a direction of their choosing to reduce the performance of forecasted predictions.
Table Figures
Distribution Param
Dir
MAE (x10"")
MAPE
MASE
RMSD (x10"))
CRPS
Accuracy
Sharpe
Greedy
Threshold
SLudeaL -L
5.93
1.39%
1,548
2.639
1,230
57.14%
-2.23%
-400
6152
SLudent-1
P
11.53
2.48%
2.323
11,863
1,545
54.95%
-31.76%
5911
7658
Student-t
10.72
1.99%
1.861
4,805
1.7131
56.04%
-0.27%
3067
6053
Student-t
6.01
L87%
1.753
1.8071
58.24%
40.56%
7625
Student-t
7.68
1.76%
1.648
2.967
1,3951
58.245
14.7%
1803
8602
Student-t
7.67
1.76%
1,647
2,963
1.8109
57.14%
14.8%
1732
7005
Student-t
8.31
1800%
1,688
3.93
2,4318
54,95%
4.89%
1803
6802
Gausslan
3,20
1.0%%
0.996
0.524
1.199
57.14%
3.31%
502
6103
Gausslan
10,76
2.59%
2,425
14.97
1,8874
58.24%
55,59%
402
5964
Gaussian
P
10.31
L94%
1,815
4,961
2.3299
54.95%)
54.12%
10220
9818
Goussion
10.32
1.94%
1,815
4,963
2.3303
59.34%
57.07%
332
5964
Gauas1 an
8.131
1.55%
1.449
1.704
1.996
52.75%
17.11%
224
6647
Table 2: Performance crafting algorithm on different distributions and directions Every type of perturba- tion resulted into larger error over all error metrics. Note that some experiments resulted in similar performance such as J. and Student-t 1, likely due to the same perturbations.
Recall that the inputs to attack are (a) the distribution parameter 0", and (b) a direction d along which 6* should be perturbed. In Table we manipulate every distribution parameter of a Gaussian and Student-t distribution in both directions. We also report the unperturbed performance for com- parison. The performance of adversarially manipulated forecasts across every experiment in Table worse then the original forecasts. Other metrics such as binary accuracy, Sharpe ratio, and our portfolio metrics (see Appendix B.1) show mixed results. The reason is in our probabilistic setting perturbing a distribution parameter does not always decrease the strength of forecasts. For exam- ple, Figure 6 shows the result of decreasing the mean. Although we achieved the intended change in mean by going from 2.109 x 10 to 9.57 x 10-3, at day 05-01 in Figure 6 our adversarial forecast is better than original forecast. The original forecast was above the target, and thus decreasing the mean actually improved our forecasts. Hence, in the application of Algorithm [] an adversarial trader would need to knowledge about the victim model's forecast determine the distribution parameters, direction, and number of iterations to achieve their goal.
Figure 5 shows the perturbed features from trying to decrease the mean of DeepAR-G, while Fig- ure 6 plots the true, forecasted and adversarially forecasted log return of Tesla stock. We perturbed our Twitter covariates using algorithm for R 30 iterations resulting into the original and per- turbed fcatures in Figure 5 we can see small perturbations in our covariates represented by dashed lines. For example, covariate from the bottom is perturbed around day 13 and 32, while the 7th and 8th covariates from the bottom are perturbed significantly at day 82 of our dataset. In this sce- nario, we picked value of 8 that is 1% of the range of the covariate across the whole dataset. The adversarially forecasted log returns are on average smaller as described in the previous paragraph, which is consistent with the intended attack goal of decreasing the mean of our forecast.
Conclusions. We demonstrated how the realistic stock price forecasts of our pipeline, initially able to turn a profit through active trading, are subject to worst-case drops in predictive performance, e.g., when an adversary manipulates inputs from low provenance data pipelines. Our methodology helps appreciate maximum loss risk faced when incorporating ML in trading. Future work will need to integrate outlier detection for sentiment analysis inputs, and integrate these detection results with probabilistic forecasting to increase robustness of the end-to-end pipeline to worst-case inputs.
8

---

Under review as a conference paper at ICLR 2021
REFERENCES
Alexander Alexandrov, Konstantinos Benidis, Michael Bohlke-Schhniderr Valentin Flunkert, Jan Gasthaus, Tim Januschowski, Danielle C Maddix, Syama Rangapuram, David Salinas, Jasper Schulz, et al. Gluonts: Probabilistic time series models in python. arXiv preprint arXiv: 05264, 2019.
Dogu Araci. Finbert: Financial sentiment analysis with pre-trained language models. arXiv preprini arXiv: 2019.
Shaojie Bai, J Zico Kolter, and Vladlen Koltun. An empirical evaluation of generic convolutional and recurrent networks for sequence modeling. arXiv preprini arXiv: 1803.0117, 2018
Vadim S. Balashov and Andrei Nikiforov. How much do investors trade because of name/ticker confusion? Journal of Financial Markets, 46, 2019.
Thomas A Bass. The predictors: How a band of maverick physicists used chaos theory to trade their way to a fortune on Wall Street. Henry Holt & Company, 1999.
Battista Biggio, Igino Corona, Davide Maiorca, Blaine Nelson, Nedim Smdić, Pavel Laskov, Gior- gio Giacinto, and Fabio Roli. Evasion attacks against machine learning test time. In Joint European conference on machine learning and knowledge discovery in databases, p 387-402. Springer, 2013.
Bloomberg. Finding novel ways to trade sentiment data. professi ona /bllg//l/////// holbbl/g//nniiii///////ion -tg///fiinnnnn-ooooon novel seays-trades sent immntt -aattddata// 2017.
Johan Bollen, Huina Mao, and Xiaojun Zeng. Twitter mood predicts the stock market. Journal of computational science, 2(1):1-8. 2011.
Anastasia Borovykh, Sander Bohte, and Cornelis W Oosterlee. Conditional time series forecasting with convolutional neural networks. arXiv preprint 1oXivv/703.0400 2017.
George EP Box and Gwilym M Jenkins. Some recent advances in forecasting and control. Journal of the Royal Statistical Society. Series C (Applied Statistics), 17(2):91-009 1968.
Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. arXiv preprint arXiv: 1712.0666, 2017.
Tom B. Brown, Benjamin Mann, Nick Ryder. Melanie Subbiah, Jared Kaplan, Prafulla Dhari- wal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- Voss, Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, Ilya Sutskever, and Dario Amodei. Language models are few-shot learners, 2020.
Bradford Cornell. Medallion fund: The ultimate counterexample? The Journal of Portfolio Man- agement, 46(4):156-159, 2020.
Jacob Devlin, Ming- Wei Chang. Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding, 2019.
Thomas Fischer and Christopher Krauss. Deep learning with long short-term memory networks for financial market predictions. European Journal of Operational Research, 270(2):654 669, 2018. ISSN 0377-2217. // www.sciencedi http://ttt.eeeceeeeee/aaaaaaaa/a
doi:
2017.11 1.054. URL http:
Eugene French. Efficient capital markets: A review of theory and empirical work. The Journal of Finance: 25(2)383-417, 1970. doi: 10.2307/2325486.
Justin Gilmer, Ryan P Adams, Ian Goodfellow, David Andersen, and George E Dahl. Motivating the rules of the game for adversarial example research. arXiv preprint arXiv: / 0877006732 2018.
Alec Go, Richa Bhayani, and Lei Huang. Twitter sentiment classification using distant supervision. Processing, 150, 01 2009.

---

Under review as a conference paper at ICLR 2021
Micah Goldblum, Avi Schwarzschild, Ankit B. Patel, and Tom Goldstein. Adversarial attacks machine learning systems for high-frequency trading. arXiv:2002.09565, 2020.
Olivier Guéant, Charles- Albert Lehalle, and Joaquin Fernandez Tapia. Dealing with the inventory risk. solution to the market making problem. arXiv:1105.3115 2012.
Rob Hyndman, Anne B Koehler, J Keith Ord, and Ralph D Snyder. Forecasting with exponential smoothing: the state space approach. Springer Science & Business Media, 2008
Bojan Kolosnjaji, Ambra Demontis, Battista Biggio, Davide Maiorca, Giorgio Giacinto, Claudia Eckert, and Fabio Roli. Adversarial malware binaries: Evading deep learning for malware de- tection in executables. In 2018 26th European Signal Processing Conference (EUSIPCO), pp- 533-537. IEBE, 2018.
Alexey Kurakin, Ian Goodfellow, and Samy Bengio. Adversarial examples in the physical world. arXiv preprint arXiv:1607.02530 2016.
Greg Laughlin. Insights into High Frequency Trading from the Virtu Initial Public Offering. 2014.
Shiyang Li, Xiaoyong Jin, Yao Xuan, Xiyou Zhou, Wenhu Chen, Yu-Xiang Wang, and Xifeng Yan. Enhancing the locality and breaking the memory bottleneck of transformer time series forecasting. In Advances in Neural Information Processing Systems, pp. 5243-5253, 2019.
Bryan Lim, Sercan O Arik, Nicolas Loeff, and Tomas Pfister. Temporal fusion transformers for interpretable
time series forecasting. arXiv preprint 1912::111,.09363, 2019.
Kiran-Kumar Muniswamy-Reddy David A Holland, Uri Braun, and Margo I Scltzer. Provenance- aware storage systems.
NASDAQ. NASDAQ ITCH 5.0 protocol specifications.
URL http://
NASDAQ.
NASDAQ OUCH 4.2 protocol specifications, 2020.
URL http:
Tr "aadingProouutts/UUUHH....
Aaron van den Oord, Sander Dieleman, Heiga Zen, Karen Simonyan, Oriol Vinyals, Alex Graves, Nal Kalchbrenner, Andrew Senior, and Koray Kavukcuoglu. Wavenet: A generative model for raw audio. arXiv preprint 1609v:16090034999 2016.
Nicolas Papernot, Patrick McDanicl, Ananthram Swami, and Richard Harang. Crafting adversarial input sequences for recurrent neural networks, 2016.
A. Radford, Jeffrey Wu, R. Child, David Luan, Dario Amodei, and Ilya Sutskever. Language models are unsupervised multitask learners. 2019.
Thomson Reuters. Thomson reuters adds unique Twitter and news sentiment analysis to Thom- http://e//////eeeeee http:///wwwwwtooooonneeess.coooo -mallysi-tto-hhmmo--- hww.:hommooorrrttteeeeeeeeeeeeee
Reuters Eikon.
2014.
David Salinas, Michael SchneieS, Laurent Callot, Roberto Medico, and Jan Gasthaus. High-dimensional multivariate forecasting with low-rank gaussian copula processes. In Advances in Neural Information Processing Systemx, pp. 6827-6837, 2019.
David Salinas, Valentin Flunkert, Jan Gasthaus, and Tim Januschowski. Deepar: Probabilistic fore- casting with autoregressive recurrent networks. International Journal of Forecasting, 36(3):1181-- 1191, 2020.
Suranjana Samanta and Sameep Mehta. Towards crafting text adversarial samples. arXiv preprint 177.0: 2017.
Slawek Smyl. A hybrid method of exponential smoothing and recurrent neural networks for time series forecasting. International Journal of Forecasting, (6(1):75-85, 2020.
10

---

Under review as a conference paper at ICLR 2021
Jiawei Su, Danilo Vasconcellos Vargas, and Kouichi Sakurai. One pixel attack for fooling deep neural networks. IEEE Transactions on Evolutionary Computation, 23(5):828 841, 2019.
Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks, arXiv preprint arXtv:1312.6199 2013.
Van Valen. new evolutionary law. fvo/utionflry, 1973.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. In Advances in neural information processing systems, pp. 5998-6008, 2017.
Savvas Zannettou, Tristan Caulfield, Emiliano De Cristofaro, Michael Sirivianos, Gianluca Stringh- ini, and Jeremy Blackburn. Disinformation warfare: Understanding state-sponsored trolls twitter and their influence on the web. In Companion proceedings of the 2019 world wide web conference, pp. 218-226, 2019.

---

Under review as a conference paper at ICLR 2021
APPENDIX
A
PLOTS
Figure 3 and shows the resulting forecast of SST GPVAR-3 and DeepAR-G, respec-
tively over our testing set of 89 days. Their performance is shown in Table T and discussed in Section Figure 5 plots the original and perturbed testing sets resulting into the original and adversaria forecast in Figure [6] respectively. The perturbation was for decreasing the mean of
DeepAR-G. Lastly, Figure shows Tesla's log return over the training and testing set, which we
discuss in Appendix B.4
0.1
Tesla Log Returns
0.0
Truth
0.1
Prediction
02-01
02-15
03-01
03-15
04-01
04-15
05-01
05-15
06-01
2020
Time (days)
Figure 2: Log return of Tesla stock over our testing set for DeepAR-ST -S. Note the similar but shifted shape of prediction and the target.
Tesla Log Returns
0.50
0.25
0.00
-0.25
observations
prediction
-0.50
median prodiction
50.0% prediction interval
Feb 2020
Mar
Apr
May
Jun
Time (days)
Figure 3: Probability distribution of log return Tesla stock over our testing set for GPVAR-3. The faint green line within the probability distribution represents the mean prediction of 100 samples of our distribution.
B METRICS
B. PERFORMANCE METRICS
We include information regarding the performance metrics used throughout Section 4 metrics into error and financial metrics shown below. In all settings, consider the true log return of Tesla stocks at time i as Yr and the predicted as ÿe over testing set of I' days.
We divide
B. ERROR METRICS
The error metrics all use the difference between our predictions and the truth in different representa- tions. MAE describes the mean absolute eтror while MAPE describes the average percentage error, shown in [quations[]&P] respectively. Both metries capture how close our forecasts are on average, however this fails account for direction. We prefer to have predictions and targets of the same
12

---

Under review as a conference paper at ICLR 2021
0.1
Tesla Log Returns
Truth
-0.1
Prediction
02-01
02-15
03-01
03-15
04-01
04-15
05-01
05-15
06-01
2020
Time (days)
Figure 4: Log return of Tesla stock testing for DeepAR-G. Compared DeepAR-ST, the predic- tions have lower variance due to Gaussian distribution having smaller tails then Student-t distribution.
Normalized Feature
Original Manipulated
W
ww
ww
20
40
60
80
Time (days)
Figure 5: Plotting normal adversarial versions covariates used in the testing set. top to bottom, the plots represent the following covariates: general sentiment score, volume of tweets, average likes, average retweets. positive sentiment score, negative sentiment score, neutral sentiment score, percentage of positive tweets, percentage of negative tweets and percentage of neutral tweets. The goal of the perturbation here was decrease the mean DeepAR-G. G. Note the perturbations neutral score during between day 10 35, or average retweets at around day 65 or 82.
sign and differ in magnitude greatly, rather then small difference in magnitude with differing signs. To circumvent this problem, we report the binary accuracy of our model shown in equation 5 This measures the percentage of forecasts that matched the targets direction, regardless of magnitude. In our testing set, we had an underlying distribution of 54.95% positive true log returns.
Mean absolute scaled error, MASE, is a ratio of MAE to the MAE of using yesterday's true log return today's 's forecast. This metric is interesting as value below shows that our model out- performs the idea that the market is a random process and the best forecast for the future is the present, also known as Martingale. Root mean squared deviation uses takes the square root of the average squared error. This metric useful for outliers: a single forecast that very far off the true target increases the RMSD significantly more then many forecasts that slightly off. Lastly, the cumulative ranked probability score, CRPS, is a generalized MAE for probabilistic forecasting, and one of the most widely used accuracy metrics for probabilistic forecasting.
13

---

Under review as a conference paper at ICLR 2021
Tesla Log Returns
0.1
0.0
Truth Prediction
-0.1
Adv Prediction
02-01
02-15
03-01 03-15
04-01 04-15
05-01 05-15
06-01
2020
Time (days)
Figure 6: Change in predictions after adversarially decreasing the mean DeepAR-G.
Tesla Log Returns
0.1
0.0-
-
True log return
2017-01
2017-07
2018-01
2018-07 Time (days)
2019-01
2019-07
2020-01
2020-07
Figure 7: Log return of Tesla stock across whole dataset. A red vertical line separates the training and testing sets. Note the difference in average magnitude of log returns in the training set compared the testing set.
T MAE
114
Vt
(1)
T
[=1
1
1/
MAPE
T
y/+
1=1
MAE
MASE
(3)
liVe Wt-1
T-I 1
RMSD T (yt v1.)2)
Σ
(4)
1
Binary Accuracy
[[sgn(0r) sgn(y))
(5)
B.1.2 FINANCIAL METRICS
While machine learning metrics are important to evaluate model, the best evaluation that can propose for stock price prediction algorithm is always the potential financial gains that a trader can expect.
14

---

Under review as a conference paper at ICLR 2021
Sharpe ratio Since trading is inherently risky, we will need to evaluate the return of strat- egy adjusted for the extra risk that we are taking by running this strategy over not doing any- thing. The Sharpe ratio is a standard financial metric designed specifically for this purpose. Sharpe = (Tarategy Trisk free)) \/a with a the standard deviation deviation of the returns Fstrategy For simplicity, assume that by doing nothing we gain nothing, L.e. Trisk free O.
Trading strategies We introduce a baseline strategy and 2 simple active trading strategies that act as toy example of how a real market participant would use the edge gained by our price prediction model. To be consistent with our low frequency setting, we allow at most one trade each day.
For these strategies, the low frequency day by day trading approach enables to make few first order simplifying averaging assumptions that would not be true in the HFT setting. We assume that orders are executed immediately at the price for that day. Moreover, in this setting we do not have to assume crossing the spread on each trade, a major hurdle of active strategies that may eat in the profit reported by backtesting. Trading fees paid to the exchange are assumed to be zero.
Our baseline, which we call Passive Gain, is to buy one share first day of the period and sells it on the last day. This simple strategy is an adequate baseline as it represents inventory risk, that is the change in portfolio value not related to active trading, faced by specific participants such as institutional market makers (Guéant et al. 2012).
Our first active strategy, called Greedy Gain, blindly follows the stock price prediction. If the model predicts a price increase the trader, human or algorithm, buys a share. If the model predicts a drop, the trader sells share if he holds at least one. This forgetful strategy exposes the trader to the maximum amount of risk from active trading.
Our last strategy, called Threshold Gain, keeps history of past & Opening prices. In this stateful strategy, the trader still only uses the stock price directional prediction. However, they only buy or sell if the prediction is more than one standard deviation away from the mean price over the history. If the prediction is closer than one standard deviation from the mean, they do nothing. While this strategy involves smaller risk exposure than the Greedy Gain one, the trader may at times withhold from trades which would have been profitable.
B.2 TRAINING AND ADVERSARIAL CRAFTING WITH DEEPAR
B.2.1 TRAINING
Except prediction length and number of epochs, the hyper-parameters of DeepAR, DeeR GP- VAR and the mxnet trainer were the default hyperparameters, described in their documentation We used 25 epochs for DeepAR, 40 epochs for DeR, and 50 epochs for GPVAR respectively. For all 3 models, Twitter based features were standardized to μ = and σ² 1. Figure 8 shows the DeepAR architecture from the original work in depth.
B.3 ADVERSARIAL CRAFTING
In our adversarial crafting method, we did not wish to manipulate a certain feature to become the new maximum minimum across the whole dataset. If our perturbation pushes our feature to become the new maximum or minimum, we pick the covariate and time step that satisfies our argmax that is not the previous candidate covariate and time step, and perturb it instead. For the perturbation amount ó, we tried a fixed size perturbation, a scaling factor and a variable sized for each covariate. All 3 methods were able achieve the intended results of our attack, but the extent and shape of the perturbed features in Figure 5 varied across the 3 methods.
B.4 TRAINING AND TEST DISTRIBUTION
In Figure 7 the training set has occasional large log returns, but these are infrequent and spaced apart. The testing set however has large price changes, and occur after the other. This period lines up with the beginning of COVID-19, where many companies including Tesla experienced large volatility. We found Tesla tweets collected during periods of great volatility contained more tweets
https: http:::/ggttubb.ccmm/// www..ttt..bccccc.e http://ccc////ww//////////////// won ts
15

---

Under review as a conference paper at ICLR 2021
output
2,,
2i
Zi,e
Ei,41
likelihood
(2 (
1 (
(2 (
[(z,001 (o1+1))
network
h
h4,1+1
h
hiet
hi,e+1
inputs
2, 1i
25,t-1: Bitt
25,t; 0i,e+1
1 2, 1i,t-1
1 1, Di,t
25, 21,
Figure 8: Overview of the DeepAR model (figure taken from Salinas al. (2020)). Inputs 2 and æi, as well as the previous RNN hidden state h,,c- are fed to the RNN's current state to compute h for each time step t. The RNN's output is then mapped to the parameters di,, governing the likelihood function 1(2;,s (i.e) associated with a specific distributional assumption over 2i,-- Training is depicted on the left for which require 24, to be known; autoregressive prediction is shown on the right where a sample žt, ~ ((-1or,)) is drawn from the predictive distribution at and fed back into the prediction for L +
discussing financial events related to Tesla, such as plans for opening factories or new products, rather then opinions surrounding Elon Musk Tesla. We believe that stronger financial distri- bution of tweets made the sentiment derived from FinBERT a strong signal compared to periods in the training set. We experimented with reducing the training split smoothen out the different distributions across sets, however the model performance suffered. We believe that this is could be because deep neural networks such as DeepAR requires enough data points learn a meaningful relationship especially a complicated one such as the log returns of a stock. Another reason would be that we did catch financial signal from Twitter during periods with less variance and hence data source and collection issue.
16


Reviews:
[{"review_id": "dKj-JBD3QXa", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors studied the problem of adversarial ML in stock price forecasting. They first replicated an industry standard pipeline, which performs a sentiment analysis of Twitter data to forecast trends in stock prices. Then, they show that an adversary can exploit the lack of provenance to indirectly use tweets to manipulate the model’s perceived sentiment about a target company and in turn force the model to forecast price erroneously.\n\nStrength:\n\n1. The topic is interesting. Adversarial ML attracts a lot of attention recently, and applying them to stock price forecasting has clear incentive.\n2. The authors plan to release the code and data when this is accepted, which is good for other researchers to reproduce this work.\n\nWeakness:\n\n1. The novelty of the methodology seems limited. Both the stock price forecasting model (FinBERT and DeepAR-G) and the gradient attack method (Papernot et al. 2016) are not proposed by the authors. \n2. The writing can be improved. For example, in the experiment section, the authors used a lot of evaluation metrics such as sharpe ratio, greedy, threshold. Though they might be familiar to the audience in finance industry, they are not very clear to me at first. I'd suggest to give a definition and explanation of those metrics in this section.\n\nOverall comments:\n\nI think the research topic of this paper is interesting, but the methodology seems lack of novelty. In addition, the writing can be further improved. ", "extra_scores": {}, "extra_text": {}}, {"review_id": "R7dGc2Rm0jc", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The paper studies the impact of adversarial attacks on a ML based system for forecasting stock prices. The authors leverage Twitter data in order to enhance stock price prediction. Then, by determining the sensitivity of the model when perturbing the inputs. Then, small changes are applied to the inputs and output is observed. The authors experimented with the Tesla stock price.\n\nThis is interesting work and the authors do good work at explaining the different parts. Generally it flows well.\n\nA first comment I have is about the focus of the paper as it studies both feasibility of forecasting as well as adversarial attacks. But, it does not go in depth in neither of these topics. For example, the first part for me is very interesting and having more forecasting approaches as well as adding more features with the additions of time-series would be very valuable.\n\nAnother comment I have is that there is a naive assumption. The fact that before sentiment classification we do not do any filtering. This does not make sense for an industrial system. Having a filtering step would greatly benefit the pipeline. The authors could have invested some space on such an approach.\n\nAs you conclude that an adversarial trader would need to know the details for the forecasting model in order to attack would you be able to suggest an approach that would not require this knowledge?\n\nA major issue of the paper is that the authors just do predictions in a single stock price. I am not sure how much we can trust the conclusions based on just a single stock. The authors need to add more datasets. It is not enough.\n\nWhat about having other type of textual features apart from the sentiment? Do you think there is more space to explore here?", "extra_scores": {}, "extra_text": {}}, {"review_id": "NFfoYVJFxjn", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 7, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Pros: \nThe paper is clear with a significant contribution. It performed a sentiment analysis task that can predict trends in the stock market and also showed how an adversary may attack the model using tweets thereby leading to false price prediction. The methodology and the probabilistic forecasting used are excellent in my opinion. \n\nCons: \n1. The title of the paper does not describe the actual work done. I suggest that the authors may consider giving a new title to reflect the method they applied. \n2. It is unclear why the attack was done on the test stage but was not shown at implementation. That is, how would this work be reproduced or be beneficial to the community? \n\nThe following can be corrected: \n1. The claim on Page 1, Para 2 of the Introduction needs a citation (Thales used his...) \n2. On page 5, para 1, please briefly describe BERT \n", "extra_scores": {}, "extra_text": {}}, {"review_id": "JlDtGQkgOV2", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors in this paper propose to use the adversarial ML in the stock price forecasting scenario and demonstrate that an adversary can exploit the lack of provenance to indirectly use tweets to manipulate the prediction model’s perceived sentiment about a target company and in turn force the model to forecast price erroneously. However, I have the following comments on the paper: \n\n- Dataset collection is not convinced. Authors collect only one company (i.e.,  Tesla) data from Twitter and Yahoo. Experiments in the entire paper are only based on the dataset containing just one company. The authors provide two reasons for not considering other companies (such as Microsoft or Amazon as discussed examples in the paper): \"homonyms\" and \"unintended discussion\". However, Tesla also has the similar issue. For example, when Elon Must was discussed on Twitter, it may be about Elon Musk’s other companies (SpaceX) or his arguments that are not related to Tesla (similar to the Bill Gates case in the paper). When people talk about Tesla, they may talk about Nikola Tesla. When people discuss Model 3, they may only express their experience of driving Model 3. The dataset with only one company contains bias to the model that may not be generalized to other cases.\n\n- Lack of novelty. All the technical components in this paper are not new. FinBERT, DeepAR, and Gradient Attack are all from existing works. ", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: One reviewer is positive, but that review is not of high quality. The other reviewers agree that this paper is interesting, but has too many limitations to be accepted by a highly competitive venue such as ICLR.
Decision: Reject