AQuA: Recursively Self-Improving Quantitative Trading Research Agents
Jiacheng Guo, Suozhi Huang, Yunlong Gao, Zihao Li, Jian Ge, Xu Kuang, Mengdi Wang
cs.CL, cs.AI
2026-08-13
AQuA seals the data path and evaluator so two independent LLM research agents can self-improve without data leakage; per-stock IC 0.0843 on US equities and a strategy positive every year from 2021 to 2025.
LLM agents can already propose hypotheses, run experiments and revise their search from feedback. In quantitative research the structural risk is that an unconstrained agent corrupts the very evidence its later iterations depend on: a feature that reads future data, or a selection made on the test set, produces a convincing but non-reproducible backtest that gets stored as a success and propagates. Prompt-level instructions and model-based review do not form a reliable integrity boundary. AQuA, from Princeton, Ant Group and Stanford, makes leakage-inducing actions structurally unavailable.
Two fully separate systems share no agents, memories or candidate spaces. Part I (factor discovery) runs a manager-mediated pipeline of six specialist agents (Data Steward, Visual Analyst, Idea Miner, Factor Evaluator, Backtest Engineer, Research Librarian); every factor starts as a falsifiable economic hypothesis with mechanism, predicted direction and refutation conditions, then gets assembled from a formulaic-alpha operator registry. Structured records and beliefs persist across runs and steer the next search. Part II (model development) restricts the agent to a single config diff over a frozen sandbox: data splits, features, labels and evaluator are sealed and human-authored, and the harness compiles and scores every diff.
The core design is asymmetric freedom: the agent explores freely inside a DSL while the evaluator sits outside the adaptive surface. Leakage is split into two channels, each closed separately. Generation leakage is closed by construction: time-series operators read only trailing windows and cross-sectional operators only the current timestamp, so causality is closed under composition and no admissible expression can read the future. Selection leakage is closed by separating metrics: during search the agent sees only scores on a validation slice fixed in advance; the 2021-2025 test window is scored once, after the configuration is frozen, and never used for ranking.
Part I, on a crypto universe at five-minute frequency, lifts a combined signal IC to roughly 0.190 across iterations; individual factors sit at 0.026-0.037, with strength coming from combination. Part II predicts 30-minute US equity returns, training on 2010-2019 with 2020 as an embargo gap and 2021-2025 untouched:
| Model | per-stock IC |
| Ridge | +0.0251 |
| LGB | +0.0397 |
| LSTM | +0.0535 |
| GRU | +0.0613 |
| Hybrid (agent-iterated) | +0.0843 |
That is +0.023 absolute and 37.5% relative over the strongest baseline. Sector-neutralizing the score lifts held-out Sharpe to 2.15 at a two-leg cost of 2bps; a causal volatility-targeting overlay takes it to 2.50; a fully causal walk-forward retains about 2.0. The strategy is positive every year from 2021 to 2025 (1.7/3.5/1.9/1.8/2.7), with 2022, the index drawdown year, its best.
For teams building autonomous research agents, the transferable part is the two-channel decomposition of leakage: generation-side leakage closed structurally by a restricted DSL, selection-side leakage closed by separating the metric the loop optimizes from the one it reports. The construction applies to any agent scored by an evaluator, well beyond finance. Appendix B honestly documents a leak that survived agent review, which is the paper's own argument for sealing over auditing.
Each system is demonstrated on a single market and horizon (crypto at five minutes, US equities at thirty minutes), and the authors do not claim transfer without re-tuning. A human operator sets goals, owns the sandbox and supervises promotion, so this is autonomy within bounds, not unattended research. All results are simulations under a turnover-cost model, with no live trading. Test-window isolation is a governance property, not a cryptographic guarantee; an operator with access to the store could in principle consult it. Deployed factor expressions and parts of the configuration are withheld, hurting reproducibility, and the two IC conventions differ, so 0.190 and 0.0843 are not comparable.