Search papers, labs, and topics across Lattice.
To evaluate the limitations of isolated safety checks, the authors deployed ten role-conditioned LLM agents in a simulated financial market to execute complex trading, token launches, and liquidity operations with and without transaction-local wallet policies. While per-action safety filters evaluate individual requests in isolation, malicious market behavior is routinely distributed across multi-agent communication, evolving balance states, and extended time horizons. The experiments revealed that adversarial agents successfully executed multi-stage launch-promotion-exit schemes because gatekeepers predominantly flagged rather than blocked localized operations, allowing the broader coordinated manipulation to proceed unhindered.
Transaction-local safety filters are fundamentally blind to distributed agentic exploits, allowing autonomous LLMs to coordinate multi-step market manipulation schemes across private comms and delayed trades without tripping an execution block.
Transaction-local controls answer whether one financial request may proceed, but market behavior can be distributed across messages, agents, assets, and time. We study this interpretation gap in a virtual exchange populated by ten role-conditioned language-model agents. The agents communicate, trade reference assets and futures, launch tokens, and manage concentrated-liquidity pools under prescriptive adversarial roles. We analyze eight 72-cycle trajectories across two time-blinded hourly replay paths, with a runner-side wallet policy enabled or disabled. The retained artifacts connect generated outgoing messages, policy events, balances, positions, and cycle-end market state. A focal reconstruction shows a launch--promotion--exit scenario realized across private coordination, public claims, follower positioning, repeatedly withheld exits, and a later non-blocking request aligned with a token balance change. Across policy-enabled runs, the gate withholds direct requests selectively; most policy-categorized candidates are flagged rather than blocked, while the surrounding interaction can continue. Repeated runs also show that category-level and within-trajectory relations can recur even when normalized score-change rankings do not. These findings motivate agent-behavior evaluation that links communication, authorization, and evolving state instead of treating individual transaction verdicts as complete safety judgments.
