Audits › Controls › Model poisoning
AI and learning · control 20 of 21
Model poisoning: does your trading bot have it?
If it feeds news, tweets or third-party messages into the model, are they treated as data (isolated, limited, with no power to order), or can an external text dictate a trade?
Why it matters
A fake headline or a crafted message makes the model buy what someone else wants to sell.
How to check it in the code
- Find which external text reaches the prompt: news APIs, social feeds, chat messages.
- Check that text is delimited and the model is told it is data, and that its output still passes validation and risk checks.
- Check whether a single source can trigger a trade on its own.
This is what the audit does for every bot in the list, on public code, without installing or running anything. Verdict values: present, partial, absent, not applicable, not verified. See the method.
Results across audited bots
Across 10 audited bots: 0 present, 2 partial, 1 absent, 4 not applicable, 3 not verified.
| Bot | Verdict | Evidence | Note |
|---|---|---|---|
| HKUDS/Vibe-Trading | Not verified | agent/src/scheduled_research/ and agent/src/agent/grounding/ directories exist | Not reviewed within budget. |
| hummingbot/hummingbot | Not applicable | Same search as above, total_count 0 | No third-party text is fed into a model within this repo. |
| Drakkar-Software/OctoBot | Not verified | The reviewed code (ai_index_trading.py._build_agent_state) only feeds internal structured data (portfolio holdings, open orders, evaluator strategy scores) into the LLM prompt; SIGNAL_AGENT_INSTRUCTIONS in deep_agent_team.py asks the model to consider 'Recent news and events impact' but no code ingesting raw third-party text (tweets, news feeds) was found in the files reviewed. | LangChain Deep Agents may have additional tool access (e.g. web search) not covered by the files read; could not confirm or rule out within the time budget. |
| freqtrade/freqtrade | Not verified | ||
| jesse-ai/jesse | Not applicable | README.md ML example only feeds numeric technical-indicator values (ta.rsi, ta.adx) computed from candle data into record_features/ml_predict; no code path was found that feeds news, tweets or other third-party free text into any model used for trading decisions | No_aplica because the only documented trading-relevant model (the scikit-learn pipeline) consumes numeric OHLCV-derived features, not external text. |
| chrisleekr/binance-trading-bot | Not applicable | apps/web/src/features/backtest/components/backtest-llm-advisor.tsx | The only LLM integration found this session consumes the operator's own backtest run data and config (first-party), not third-party text. No news/tweet/sentiment ingestion into any model was found in the docs or code read this session, though the full ~900-file tree was not exhaustively searched within budget. |
| alsk1992/CloddsBot | Partial | src/security/index.ts detectInjection() scans inbound text for SQL-injection, shell-command-injection, XSS and path-traversal patterns and is imported in src/agents/index.ts (`import { ..., detectInjection } from '../security/index'`). docs/SECURITY_AUDIT.md section 4 lists this as part of a 'Security Shield' with explicit 'prompt injection detection'. | Classic injection payloads in chat input are screened, but no separate mechanism was found that isolates ingested third-party content (news feeds, tweets) as inert data before it reaches the LLM's decision context, so a natural-language instruction embedded in a news item is not clearly covered. |
| Lumiwealth/lumibot | Absent | lumibot/example_strategies/agent_news_sentiment.py: the canonical `search_news` @agent_tool returns raw third-party headline/summary text directly as the tool result with no sanitization, delimiting, or 'treat as data not instruction' wrapper. GET /search/code?q=sanitize+OR+untrusted+OR+injection+repo:Lumiwealth/lumibot -> 1 hit, in CHANGELOG.md, unrelated to a defense mechanism. | |
| YizhiSong/FriesTrader | Partial | README 'How it works' step 3: Phase A runs 'a news search' per candidate and feeds the results directly into the model's direction/conviction rating written to pending_proposals.jsonl. No isolation, sandboxing, or instruction-stripping of that third-party text is described anywhere read. | Blast radius is bounded: conviction only selects a fixed conviction-tier percentage of the account (per risk_rules.json position_sizing, not an amount the model can freely choose), and Phase A itself is barred from placing orders (see decision_ia_filtrada) -- so a poisoned article could at most bias which stock gets bought and at which fixed tier size, not an immediate live order or an arbitrary size. |
| c9s/bbgo | Not applicable | same search as decision_ia_filtrada | Not applicable: no third-party text (news/tweets) is fed into a model. |
If your bot does not have it
The watchdog enforces daily loss, drawdown, position size and heartbeat limits from outside the bot, with a read-only key, whatever the bot's own code does.