Adversarial Dynamical Systems and the Ceiling on AI Trading

By Thomas Adair. Marine. DJ/Producer. Systems Architect — shipping across trading systems, music production, agentic tooling, and consumer apps with AI orchestration.

Field notes on what actually works — and on the limits nobody selling you a signal wants named.

The DM

The DM shows up every few weeks — a Discord ping, a comment reply, a YouTube pre-roll with a ticker behind a guy in a headset. The shape barely changes: I trained a model on ten years of price data, it’s up 340% this year — want the indicator? Neural net, “AI,” a GPT wrapper reading chart screenshots — the wrapper changes, the claim doesn’t. The market is a pattern, and enough data and compute will find it and keep finding it.

I’ve spent the past year building a live-money trading system and the AI substrate around it. No revenue yet — still in development. But the goal was never in question: make it work, make it profitable. What I’ve started to see is that the road is narrow — to prove a system like this can earn, the substrate has to be built a specific way, and most of this year went into learning which way.

Which is a strange position to argue from, until you know how I got here. A friend got me interested in day trading in August of 2025. He pitched it the way everyone pitches it — learn this and you can replace your paycheck — the same line the course sellers run, and I clocked it at the time. I was interested anyway. At the same time, by happenstance, I was finding out that people were using AI to write real software. The two interests converged, and when I learned you could write a strategy in Pine Script, wire it through a broker bridge into a prop-firm account, and let it trade … a very large lightbulb went off.

So I am not writing this from outside the pitch. I started inside it. What changed between then and now is that I have spent enough time since reading the papers underneath my own tools to know that a Sharpe ratio on a slide — return divided by the volatility it took to earn it — is not evidence of anything until it survives the parts of the process designed to kill it.

Then a paper landed that asks the question nobody in that pitch asks, and answers it with a proof instead of an equity curve: for a given system, is there any learning algorithm that can succeed on it? Not mine, not the DM’s — any algorithm, any amount of data. That has a real answer, with a floor the DM’s claim either stands on or falls through.

The claim under the claims

The paper is Colbrook, Mezić, and Stepanenko, “Adversarial dynamical systems characterize when data-driven learning succeeds or fails,” Nature Communications, July 14, 2026 (DOI: 10.1038/s41467-026-74220-8). [1] Open access — read it yourself rather than trust my paraphrase.

They construct adversarial dynamical systems — built deliberately, respecting the real structure of the data you’d collect, and still provably beyond any learning algorithm. Not “succeeds badly.” Blocked. Success caps at 50%, whatever the data volume, the algorithm, deterministic or probabilistic. A coin flip does as well as your best model, forever.

Careful with that number — it’s the most misreadable sentence here. The 50% isn’t “your model wins half its trades.” It’s a ceiling on a specific decision task, over the classes the paper defines. Miss that and you’ll either call the result false or repeat it as something it never said.

What should stop a trader mid-scroll is where these systems live: not a pathological corner case — the paper is explicit they “are not rare edge cases.” They show up in smooth, low-dimensional, well-studied systems, doing something as ordinary as learning a compressed representation through an autoencoder — a neural net that squeezes a system’s state down to a few numbers and rebuilds it, the standard way of asking a model to find the structure under messy data. The model many describe as “an autoencoder that learns the market’s latent structure” is the exact task class the paper shows can be unlearnable — structurally, not for want of data or capacity.

Two things keep this from being doom about machine learning. First, the same paper hands you provably optimal algorithms, with certified error bounds, for the systems that aren’t adversarial — a real advance in Koopman analysis (treating nonlinear dynamics as linear spectral objects). Second, they prove it on Arctic sea ice — CPU-trained, cheaper than the deep-learning baselines, surfacing hidden decay modes with bounds attached. Teeth on both sides of the line — and most “AI trading edge” never asks which side its strategy sits on.

Does the proof reach the market?

The objection I owe you before leaning on this: the paper’s systems are constructed, built on purpose to defeat learning. Nobody built the market to defeat learning. So what lets me carry a result about hand-built pathological systems into a conversation about ES futures at 09:31?

Nothing, automatically — and I’ll say it out loud, because the sloppy version of this essay, waving “adversarial” around because markets feel adversarial, is worse thinking than the DM. The DM at least has an equity curve.

The construction is a proof device: it shows unlearnable systems exist inside ordinary, well-behaved classes — you can’t rule out the hard case by pointing at smoothness or low dimension. It doesn’t prove any real system is in that class. It kills the argument that clean data makes a system safe.

Markets reach the same neighborhood by a different road. The market is full of participants whose whole job is to find exploitable structure and trade against it until it stops paying. Findable structure gets found and arbitraged; what survives is the residue — structure that isn’t findable, or not cheaply enough to be worth the capital. That’s a selection pressure toward the hard case, running continuously, funded by everyone better resourced than I am. Not deliberate construction. Same direction.

So the honest claim is narrow: the paper removes an excuse. “There’s no proof this isn’t learnable” used to be defensible; now the burden moves — you can’t infer learnability from clean data, and your domain has a live economic engine grinding toward where learning fails. That doesn’t prove any strategy is doomed, and anyone who says it does read the abstract and stopped. The market bridge is mine, not the authors’ — check the reasoning, not the credential.

The soft case and the hard case

Now the distinction the trading-education internet blurs constantly.

The soft case is backtest overfitting. You ran a thousand parameter sets, kept the best Sharpe, reported the luckiest as the true one. This is learnable-in-principle trouble — the system may be fine; your estimate is contaminated by selection bias, or by leakage from the future into the past. The tools are mature: the Probability of Backtest Overfitting [2] numbers how likely your “best” set just got lucky; the Deflated Sharpe Ratio [3] discounts your Sharpe for how many trials it took — a headline 2.0 across ten thousand tries might deflate to 0.8; Combinatorial Purged Cross-Validation [4] blocks the leakage a plain train/test split allows when data is autocorrelated in time, which financial series always are. Run all three and “my backtest looks good” becomes “…and here’s how much to discount that.” Necessary, not sufficient.

The hard case is what this paper names. A strategy can pass every soft check — clean folds, defensible DSR, no PBO flags — and still sit on dynamics from an adversarial class, where no methodology rescues you. The problem isn’t a noisy estimate; there’s no algorithm, on any data, that pulls a better-than-coin-flip edge from that system at all. The paper even shows the two obvious levers — longer data window, richer measurement — sometimes can’t be combined freely: some problems only yield if you apply them in a specific order, not both at once and hope.

Plainly: PBO, DSR, and CPCV tell you whether you’re fooling yourself about a signal that could be found. The Colbrook–Mezić–Stepanenko result says that for some signals there’s no self to fool — the signal isn’t there, and every gate you own still waves it through. Most “AI edge” content doesn’t even clear the soft bar; the dangerous claims are the credentialed ones that clear it and still pretend the hard case doesn’t exist.

Which side is this strategy on?

The paper poses the question but hands you no Tuesday-afternoon test — you can’t certify a system out of the adversarial class from finite data. So here’s the triage I run. It proves nothing; it sorts strategies by hard-case exposure, which is the call I have to make.

Does it have to forecast a trajectory to make money? This does most of the work — earning by predicting where the state goes next is exactly the claim the result bites. Is there a mechanism, independent of the pattern, for why the money is there? A named reason someone pays — inventory risk, immediacy — not “the pattern held across folds,” which is a fact about your sample. If the pattern died tomorrow, would the mechanism tell you, or the P&L? Mechanisms degrade legibly — spreads compress, flow changes. Pure patterns degrade invisibly, and the P&L only tells you at cost. How many others can run it? A pattern any charting package and a GPU can find is already under selection pressure.

Score badly on all four and you’re not necessarily wrong — you’re carrying exposure you can’t measure, and the response has to be structural.

What this looks like in a real strategy portfolio

I run a small book on prop-firm futures — MNQ, MGC, SIL — through a system I’ve been building called Trident Forge. Two strategies sit at opposite ends of the spectrum.

The market maker. Built straight from Avellaneda and Stoikov’s 2008 paper [5]. It doesn’t predict price; it manages inventory risk — quoting a reservation price around the mid, shaded by inventory held, spread widening as volatility or time-to-flat pressure rises. It earns the spread it provides, not a call on the next candle. Why less hard-case exposure? Because the result blocks the extraction of forecastable structure, and a market maker’s revenue doesn’t come from forecasting — it comes from being paid a spread to absorb inventory someone urgently wants gone. That payment exists whether or not the price series is learnable. So its risk falls back onto the soft case: did I fit the parameters to noise in one window, or to something that holds out of sample?

And the soft case bit me here. An earlier heuristic version backtested beautifully; audited against the paper, the number was a fill-model artifact — the backtest assumed resting orders filled in a way live fills never would. I pulled it from live capital, rebuilt it to the paper’s equations, and only let it back after it ran in parallel with the retired version long enough to agree. The fix was more rigor, not less ambition.

The pattern strategy. A short-only strategy on a rare multi-candle continuation pattern, volume and momentum confirmation layered on. It sits in ghost trading — generating signals against live data, never touching an order — because it’s a directional bet dressed in pattern-recognition language, the exact shape the hard case says to distrust. It fails all four triage questions. A recurring visual pattern looks like structure; whether it’s structure the market keeps producing or a mechanical artifact that happened to correlate with profit — the kind Stefan Nagel’s 2025 critique of a “virtue of complexity” result showed can hide inside a sophisticated-looking model [6] — CPCV can’t answer. It tells you the pattern held across folds, not that it isn’t noise rhyming with structure for as long as you’ve watched.

Nobody can prove that strategy isn’t adversarial — from finite data, that proof doesn’t exist. So the response isn’t a cleverer backtest; it’s the posture it’s in. Extended live-shadow before a dollar’s at risk. A pass bar written down before the window opens — here, a detection count; two quiet weeks means it hasn’t earned live capital. And a demotion path that’s already pulled other strategies back to paper when their edge stopped confirming.

The weak link, honestly: the circuit breaker is specified — trip on consecutive rejected take-profits or orphaned exits, auto-demote on a blown account — and not built. Every demotion so far was me, reading logs. That works because I’m one person watching a handful of strategies; it doesn’t scale, and it’s not the part to copy. The gate isn’t “did it pass CPCV once.” It’s “does it keep passing, with the trapdoor always open.”

The LLM connection

The paper doesn’t stop at sea ice; one paragraph in the intro reframes every “let the LLM pick your trades” pitch.

LLMs generate text one token ahead — a process linked to the same Koopman operators. The adversarial systems the authors build tend to have a continuous spread of frequencies, the signature of chaos: short-term predictable (the next word follows from context), long-term not (tiny changes at the start compound into wild divergence). The authors say this mirrors how a small prompt change swings an LLM’s output — and may reflect a limit baked into autoregressive architectures themselves, not one better fine-tuning quietly closes.

I read that next to an essay, “The Loop and the Cut” [9], built on Howard Pattee’s “epistemic cut” [7]: interpretation isn’t a state a system holds, it’s a loop — write, read, rewrite — where a system’s own history of interpreting keeps redrawing the line between its instructions and its actions. An LLM’s rewrite is exogenous: a human sets the loss, curates the data, decides when to stop — closer to a breeder selecting cattle than a cell rewriting itself in response to what it just did. At inference the weights are frozen. When a model apologizes or claims a self, that’s pattern completion about self-reading, not a system owning its own interpretation.

Together the diagnosis sharpens. The paper gives the mechanism — the drift is architectural — so the fix has to come from outside the model, and the only rewrite loop available is outside: human-authored, on a human’s clock. The correction is never automatic and never self-originating. Nobody RLHFs their way to a model that reads its own trading output and revises what counts as a good trade, because that criterion was never the model’s — it belongs to whoever wrote the loss. (That synthesis is mine.)

So the question I now ask when someone shows me an LLM “picking trades”: who authors the rewrite criterion? “It learns as it goes” — push on it; inference weights don’t move, and what looks like learning is a longer context window doing pattern completion. “We retrain nightly” — real, but exogenous rewrite on a slow human clock, subject to every soft- and hard-case question already on the table. Neither gets you out from under the ceiling.

The reframe

None of this says “AI can’t trade” — the same paper hands you convergent algorithms for the non-adversarial classes and beats deep-learning baselines with them. The ceiling is on a specific family of tasks under adversarial dynamics; it’s a forcing function for specificity. The honest question was never “does AI have an edge in markets.” It’s: which part of your strategy is in the learnable regime, and which part is a bet that it is? A market-making model anchored to a proof makes a narrower claim than one that ingests years of bars and outputs a direction with no anchor beyond “it held in backtest.” Both build with AI; both demo well; only one can say why the thing it learned should generalize. That’s the whole difference between a practitioner and a copywriter selling an indicator — the pitch works because it never says which regime the claim lives in.

What a serious builder actually does

Concretely, here’s what changes and what doesn’t, once you take the hard case as real rather than academic.

The soft-case discipline doesn’t go anywhere — it gets more load-bearing, not less. Every new strategy still gets its DSR, its PBO score, and CPCV in place of a plain train/test split before I trust its backtest number at all. None of that changes.

What changes is the posture toward the strategies that pass all three anyway. Passing CPCV, PBO, and DSR tells you the strategy isn’t fooling you about noise it found in your particular sample. It does not tell you the strategy isn’t operating in an adversarial regime, because that’s a property of the underlying dynamics, not of your validation methodology — and this paper is explicit that no single-sequence limiting procedure, run adaptively on the data you already have, can certify you out of that uncertainty. So the response has to be structural, not statistical: hold pattern-based, theory-thin strategies to an extended live-shadow period regardless of how clean their backtest reads, and keep a real demotion path — live capital back to paper, permanently open, no ego about it — for any strategy whose live behavior starts to diverge from what validation promised. A strategy earning that trust back has to re-earn it in parallel with its own history, not on the strength of a single retrospective number.

The other piece worth adopting directly from the paper’s own method is adversarial construction as an analytical tool, not just a mathematical curiosity. The authors didn’t find these unlearnable systems by accident — they built them, deliberately, to see exactly where learning breaks. That’s the same move I try to run before I trust any validation pass on my own work: don’t just check whether the strategy survives the data I have, construct the specific scenario engineered to break the claim — the regime shift, the fill-model assumption flipped against you, the parameter perturbed exactly where the strategy is most confident — and see if it survives that. A validation pass that never had to survive an adversary constructed to kill it hasn’t told you very much.

And the multiple-limits point is worth sitting with. More historical data and richer measurement both feel like unambiguous wins, so the instinct is to grab both and pick whatever combination scores best. That last move is precisely the multiple-comparisons trap DSR exists to catch — and this paper gives a deeper, structural reason to distrust it: for some problems the order in which you apply those two limits is load-bearing, not just the count. Grab both and hope, and you can miss the representation entirely.

No amount of retraining fixes a strategy sitting inside the adversarial class. That sentence is the whole piece, compressed. The response isn’t a bigger model or a longer backtest. It’s knowing which regime you’re in, building the discipline that manages the regime you can’t fully verify, and never letting a clean validation pass talk you out of the vigilance the paper says you still need.

Closing

Two companion reads: the Colbrook–Mezić–Stepanenko paper itself [1], and Colbrook’s earlier survey, “The Multiverse of Dynamic Mode Decomposition Algorithms,” for the landscape this sits in [8].

The takeaway isn’t caution for its own sake — it’s the opposite. It’s permission to stop pretending every claim needs to sound equally confident. Some of what I’ve built has a real anchor and a narrow claim, and I trust it more for it. Some is still in the shadows, earning the right to be trusted — not because I lack conviction, but because the paper gave me a reason to hold the line.

The proof doesn’t tell me my strategies are doomed. It tells me which of my confidences were free … and which I actually paid for.

If you’re building alone with AI — trading systems or anything where a model’s confidence and its correctness are two different things you check separately — I’d like your company. Subscribe below, or find me on Threads.

References

[1] Matthew J. Colbrook, Igor Mezić, and Alexei Stepanenko, “Adversarial dynamical systems characterize when data-driven learning succeeds or fails,” Nature Communications 17, Article 5397, July 14, 2026. DOI: 10.1038/s41467-026-74220-8. https://www.nature.com/articles/s41467-026-74220-8 (open access; preprint at arXiv:2407.06312)

[2] David H. Bailey, Jonathan M. Borwein, Marcos López de Prado, and Qiji Jim Zhu, “The Probability of Backtest Overfitting,” Journal of Computational Finance 20(4):39–69, 2017 (first circulated 2013; introduces the combinatorially symmetric cross-validation estimator of PBO). https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2326253

[3] David H. Bailey and Marcos López de Prado, “The Deflated Sharpe Ratio: Correcting for Selection Bias, Backtest Overfitting and Non-Normality,” Journal of Portfolio Management 40(5):94–107, 2014. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=2460551

[4] Marcos López de Prado, Advances in Financial Machine Learning, Wiley, 2018 (ISBN 978-1-119-48208-6). Combinatorial purged cross-validation and the purging/embargo procedure are developed in Chapter 7 (“Cross-Validation in Finance”) and Chapter 12 (“Backtesting through Cross-Validation”).

[5] Marco Avellaneda and Sasha Stoikov, “High-frequency trading in a limit order book,” Quantitative Finance 8(3):217–224, 2008. DOI: 10.1080/14697680701381228.

[6] Stefan Nagel, “Seemingly Virtuous Complexity in Return Prediction,” Chicago Booth Research Paper No. 25-10 / NBER Working Paper 34104 / Becker Friedman Institute WP 2025-104, June 2025. https://papers.ssrn.com/sol3/papers.cfm?abstract_id=5335012. The paper critiqued is Bryan T. Kelly, Semyon Malamud, and Kangying Zhou, “The Virtue of Complexity in Return Prediction,” Journal of Finance 79(1):459–503, 2024. DOI: 10.1111/jofi.13298.

[7] Howard H. Pattee, “The physics of symbols: bridging the epistemic cut,” BioSystems 60(1–3):5–21, 2001. DOI: 10.1016/S0303-2647(01)00104-6.

[8] Matthew J. Colbrook, “The Multiverse of Dynamic Mode Decomposition Algorithms,” in Handbook of Numerical Analysis, Vol. 25, Elsevier, 2024, pp. 127–230. DOI: 10.1016/bs.hna.2024.05.004. Preprint: arXiv:2312.00137.

[9] Extended_Brain, “The Loop and the Cut,” Substack, July 21, 2026. https://extendedbrain.substack.com/p/the-loop-and-the-cut

— Thomas Adair. Marine. DJ/Producer. Systems Architect — shipping across trading systems, music production, agentic tooling, and consumer apps with AI orchestration.