A Word is Worth A Thousand Dollars: Adversarial Attack on Tweets Fools Stock Prediction (2022)

Abstract: More and more investors and machine learning models rely on social media (e.g., Twitter and Reddit) to gather information and predict movements stock prices. Although text-based models are known to be vulnerable to adversarial attacks, whether stock prediction models have similar vulnerability given necessary constraints is underexplored. In this paper, we experiment with a variety of adversarial attack configurations to fool three stock prediction victim models. We address the task of adversarial generation by solving combinatorial optimization problems with semantics and budget constraints. Our results show that the proposed attack method can achieve consistent success rates and cause significant monetary loss in trading simulation by simply concatenating a perturbed but semantically similar tweet.

## introduction the advance of deep learning based language models are playing a more and more important role in the financial context, including convolutional neutral network (cnn) @xcite , recurrent neutral network (rnn) @xcite , long short-term memory network (lstm) @xcite @xcite , graph neutral network (gnn) @xcite , transformer @xcite , autoencoder @xcite ), etc. for example, @xcite find that comments on yahoo finance can predict stock market volatility after controlling the effect of news. @xcite also show that sentiment disagreement on stocktwits is highly related to certain market activities. readers can refer to these survey papers for more details @xcite @xcite ). our code is available at https://github.com/yonxie/ advfintweet it is now known that text-based deep learning models can be vulnerable to adversarial attacks @xcite . the perturbation can be at the sentence level (e.g., @xcite @xcite , the word level (e.g., @xcite @xcite @xcite @xcite , or both @xcite . we are interested in whether such adversarial attack vulnerability also exists in stock prediction models, as these models embrace more and more human-generated media data (e.g., twitter, reddit, stocktwit, yahoo news @xcite ). the adversarial robustness is a more critical issue in the context of stock prediction as anyone can post perturbed tweets or news to influence forecasting models. for example, a fake news ("two explosions in the white house and barack obama is injured") posted by a hacker using the associated-press's twitter account on 04/23/2013 erased @xmath0bhp announces the demerger of its noncore assets -details expected to be filled in on tuesday." an adversarial sentence could be "@xmath110000 (100%), its net value at the end of test period reflects the profitability of the trading strategy and the underlying model. consequently, the change in pnls measures the monetary impact of our attack. more details on the dataset, victim models and evaluation metrics are housed in appendix b. ## conclusion this work demonstrates that our adversarial attack method consistently fools various financial forecast models even with physical constraints that the raw tweet can not be modified. adding a retweet with only one word replaced, the attack can cause 32% additional loss to our simulated investment portfolio. via studying financial model's vulnerability, our goal is to raise financial community's awareness of the ai model's risks, so that in the future we can develop more robust human-in-theloop ai architecture @xcite to cope with this and other real-world attacks, including black-box attack, unknown input domains, etc.