A working paper. Revision 2, October 2026 (first version July 2026). -Author: Zarif Latif · zarif@aetheriusresearch.tech
+A working paper. Revision 2.1, October 2026 (first version July 2026).
+Author: Zarif Latif, independent researcher · zarif@aetheriusresearch.tech
+Keywords: risk screening, event study, entity resolution, textual analysis, GDELT, SEC EDGAR, bank failures, backtesting
+JEL codes: G14, G17, G21
What changed in Revision 2. Revision 1 reported that the pipeline flagged all nine affected names "before the realized event date," with a median lead of about 2.5 days. That is true, but the realized event date was the formal resolution (receivership, insolvency filing, Chapter 11), not the market's reaction. Revision 2 adds a test of timing against the first headline reporting each stock already falling (Section 4.5). Measured that way, no first flag came before the market reaction. Revision 2 also adds confidence intervals, states the hindsight selection of events and watchlists, documents two known false-positive classes, removes commercial framing, and describes a pre-registered live forward test (Section 8). Every number in this revision is reproduced by pinned tests.
+What changed in Revision 2.1. A pre-publication check found that no control name appears in any of the three corpora, so the "0 false positives on controls" result was never actually tested. Text in Revisions 1 and 2 describing control headlines was wrong and has been removed. Section 4.6 explains what happened. Revision 2.1 also adds related work and references, and discloses that the Section 4.5 price-reaction pattern was written after the headlines had been read.
We replay a deterministic entity-mapping and severity-scoring pipeline against real news headlines from three well-studied financial crises: the March 2023 U.S. regional-bank contagion, the June 2020 Wirecard AG accounting fraud and the November 2022 FTX collapse. For each affected name we report detection timing, mapping precision and behavior on unrelated control names.
-On 161 archived observations from GDELT DOC 2.0, the pipeline flagged all 9 affected names at "elevated" or "high" severity before each name's formal resolution date, with a median lead of 2.48 days. It raised no flags on the 3 control names. With these small samples, the 95% confidence interval for recall is 66–100%, and the control false-positive rate could be anywhere from 0% to 71%.
+We replay a deterministic entity-mapping and severity-scoring pipeline against real news headlines from three well-studied financial crises: the March 2023 U.S. regional-bank contagion, the June 2020 Wirecard AG accounting fraud and the November 2022 FTX collapse. For each affected name we report detection timing and how it compares with the market's own reaction.
+On 161 archived observations from GDELT DOC 2.0, the pipeline flagged all 9 affected names at "elevated" or "high" severity before each name's formal resolution date, with a median lead of 2.48 days. With only nine names, the 95% confidence interval for recall is 66–100%. The study's three control names never appear in the corpus, so it provides no evidence about false positives.
The more important finding is about timing. In all 9 detections, the first flag arrived at the same time as, not before, the first headline reporting that the stock was already falling. In 8 of 9 it was that headline. The pipeline is therefore evidence of fast, auditable triage of a market reaction already underway. It is not evidence of anticipating the market. We describe the pipeline, the corpus and the ground truth, discuss the limitations, and describe a pre-registered live forward test started on 2026-10-16. All code and data are Apache-2.0 licensed and reproducible.
This is detection-timing evidence on frozen historical windows. It is not a return forecast, a trading signal, or a causal claim.
The question here is narrow: on the headlines that actually existed at the time, when would this pipeline have flagged the affected names, both relative to their formal resolution and relative to the market's own reaction, and would it have stayed quiet on unrelated controls?
+The question here is narrow: on the headlines that actually existed at the time, when would this pipeline have flagged the affected names, both relative to their formal resolution and relative to the market's own reaction? False-positive behavior is the subject of the live forward test (Section 8), because this corpus cannot measure it (Section 4.6).
+Media text carries information about stock returns and firm fundamentals: pessimistic language in a daily newspaper column predicts downward pressure on market prices (Tetlock, 2007), and the share of negative words in firm-specific news predicts earnings and returns (Tetlock, Saar-Tsechansky and Macskassy, 2008). Word lists matter in finance: Loughran and McDonald (2011) show that general-purpose negative-word dictionaries misclassify many common financial terms, and build finance-specific lists from 10-K filings. This paper's adverse-term list is smaller and hand-written. Replacing it with the Loughran–McDonald negative list is a natural robustness test (Section 8). Event timing here follows the event-study idea of measuring information arrival around a dated event (Fama, Fisher, Jensen and Roll, 1969), but uses headline timestamps, not returns. The news archive is the GDELT project (Leetaru and Schrodt, 2013).
The pipeline is the production Aetherius code, unchanged for this exercise. Paths are relative to the repository root.
@@ -84,7 +89,7 @@severity_label() bins risk into low, moderate, elevated or high. Every weight is a constant, and there are no learned parameters.
adverse_severity(raw_text) (same module) counts matches against a fixed list of about 40 downside terms (loss, plunge, withdrawals, deposit run, receivership, collapse, funding pressure, distress, insolven…, …) and maps the count to an event-severity score. An observation is a shippable flag only when its severity label is elevated or high and at least one adverse term is present. This gate, not the matcher, keeps the MSFT control quiet: MSFT headlines match MSFT directly but contain no adverse terms. Since Revision 2, the live API, the backtest and the forward test all import this single implementation.
adverse_severity(raw_text) (same module) counts matches against a fixed list of about 40 downside terms (loss, plunge, withdrawals, deposit run, receivership, collapse, funding pressure, distress, insolven…, …) and maps the count to an event-severity score. An observation is a shippable flag only when its severity label is elevated or high and at least one adverse term is present. Unit tests show the gate holding a benign direct mention below shippable severity (for example, "Microsoft expands Copilot across product suite"). The backtest corpora contain no such case for the controls (Section 4.6). Since Revision 2, the live API, the backtest and the forward test all import this single implementation.
simulations/backtest/run_backtest.py replays each event's observations.jsonl in chronological order against its watchlist.json and ground_truth.json, records the first shippable flag per name, and computes:
Confidence intervals are exact (Clopper–Pearson) binomial intervals. The nine names span three failure modes: bank runs (SVB, Signature, First Republic, Western Alliance, PacWest), accounting fraud (Wirecard) and crypto counterparty contagion (Silvergate, Coinbase, Signature).
+Confidence intervals are exact (Clopper–Pearson, 1934) binomial intervals. The nine names span three failure modes: bank runs (SVB, Signature, First Republic, Western Alliance, PacWest), accounting fraud (Wirecard) and crypto counterparty contagion (Silvergate, Coinbase, Signature).
Event. On 2023-03-08 SVB Financial Group (SIVB) disclosed a loss on a $21B securities sale and a planned $2.25B capital raise. Deposit outflows followed, and the FDIC took SVB into receivership on 2023-03-10. Signature Bank was closed on 2023-03-12.
Watchlist. SIVB, SBNY, FRC, WAL and PACW, with MSFT as a non-bank control. Corpus: 98 observations, 2023-03-06 to 2023-03-12.
@@ -209,7 +214,6 @@MSFT appeared in benign product coverage only, scored zero adverse severity, and never shipped.
Event. On 2020-06-18 Wirecard AG (WDI) disclosed that €1.9B of reported cash likely did not exist. It filed for insolvency on 2020-06-25.
Watchlist. WDI, with Deutsche Telekom (DTE) as a control. Payments peers were left out to avoid scoring peer_readthrough flags. Corpus: 14 observations, 2020-06-15 to 2020-06-30. The corpus is thin because European coverage falls mostly outside the whitelist, which was not widened after the fact.
Both 7.12-day leads come from a single article. Without it, both would shrink substantially.
The lead times above are measured to the formal resolution date. An investor cares about a different clock: when the price moved. The evidence titles in Sections 4.2–4.4 already hint at the answer, since almost every one reports a stock that is falling.
-simulations/backtest/market_reaction_check.py makes this precise. For each detected name, it finds the earliest observation in the corpus that maps to that name and reports a price decline already underway, using a fixed pattern that pairs a price noun ("shares", "stock") with a falling verb ("plunge", "drops", "falling", …). It then compares that headline's time with the first flag.
simulations/backtest/market_reaction_check.py makes this precise. For each detected name, it finds the earliest observation in the corpus that maps to that name and reports a price decline already underway, using a pattern that pairs a price noun ("shares", "stock") with a falling verb ("plunge", "drops", "falling", …). It then compares that headline's time with the first flag. The pattern was written after the headlines had been read, so this is not a blind test. Every classification is listed below with its headline, and each can be checked by eye.
No first flag came before the market reaction. The pipeline flagged each name at the moment the press reported its shares falling. This is expected given how it works: adverse-language scoring of headlines fires most strongly on headlines about a sell-off.
That is still useful for a small team. Out of hundreds of headlines, the names that need attention today were surfaced within the same news cycle, with an auditable reason. But it is triage, not anticipation, and Revision 1's framing of "lead time" overstated what the evidence supports.
+Each fixture includes one control name (MSFT twice, DTE once) that the pipeline should not flag. None did, but none could have: no observation in any corpus maps to a control name. The fixture builder did query GDELT for each control ("Microsoft Corporation", "Deutsche Telekom"), and GDELT returned articles. GDELT matches article bodies, but the pipeline stores and scores headlines only, and none of those headlines names the control. market_reaction_check.py prints this coverage, and a test (test_controls_never_appear_in_the_frozen_corpora) pins it so the paper must be updated if a fixture is ever rebuilt.
Revisions 1 and 2 reported "0 false positives on 3 controls" as evidence of specificity, and described control headlines that do not exist in the data. Both were errors. This study therefore says nothing about how often the screen fires on companies that turned out fine. The same fact makes the 100% mapping precision uninformative. Measuring false positives is the purpose of the forward test (Section 8).
Three events, nine affected names and three controls make a very small sample. 9/9 recall is consistent with a true recall as low as 66%, and 0/3 control false positives is consistent with a true control false-positive rate as high as 71% (exact binomial 95% intervals). One added event that failed would deserve equal reporting.
+Three events and nine affected names make a very small sample. 9/9 recall is consistent with a true recall as low as 66% (exact binomial 95% interval). There is no false-positive sample at all (Section 4.6). One added event that failed would deserve equal reporting.
The three events, the affected names, and the decision to include each name were all chosen after the outcomes were known, from among the best-known failures of recent years. The adverse-term list was also written by people who knew how these crises unfolded, and its vocabulary ("deposit run", "receivership", "unrealized loss", "capital raise") is close to bank-run reporting. A screen tested only on famous failures cannot tell us how often it fires on companies that turned out fine. The forward test in Section 8 is designed to address this.
The harness sorts observations by GDELT seendate and only counts flags strictly before the resolution date (pinned by test_time_safety_lead_time_never_negative). Regulatory anchors are inserted at a small offset from the resolution date. Removing them leaves SVB recall (5/5) and median lead (2.34 days) unchanged.
The harness sorts observations by GDELT seendate and only counts flags strictly before the resolution date (pinned by test_time_safety_lead_time_never_negative). Regulatory anchors are inserted at a small offset from the resolution date. Removing them, and keeping news headlines only, leaves recall and median lead unchanged for all three events (5/5 and 2.34 days, 1/1 and 6.60 days, 3/3 and 7.12 days).
COIN) directly. The live forward test keeps COIN and META on its watchlist to measure this.What it does show is narrower: a small, deterministic, auditable pipeline running on real headlines would have put nine affected names in front of a reviewer within the same news cycle as their market reaction, ahead of formal resolution, without firing on three unrelated controls.
+What it does show is narrower: a small, deterministic, auditable pipeline running on real headlines would have put nine affected names in front of a reviewer within the same news cycle as their market reaction, ahead of formal resolution. It does not show how often the screen raises false alarms.
simulations/forward_test/ fixes a 20-name, all-normal-priority watchlist chosen for coverage rather than expected distress, and commits its hash. A daily GitHub Action scores live GDELT news and SEC filings with the frozen backtest scorer and appends timestamped rows to the forward-test-log branch. The planned report covers alerts per name per week, human-labeled precision, and the stock's 5-session return before and after each flag.Clopper, C. J., and Pearson, E. S. (1934). The use of confidence or fiducial limits illustrated in the case of the binomial. Biometrika, 26(4), 404–413.
+Fama, E. F., Fisher, L., Jensen, M. C., and Roll, R. (1969). The adjustment of stock prices to new information. International Economic Review, 10(1), 1–21.
+Leetaru, K., and Schrodt, P. A. (2013). GDELT: Global data on events, location, and tone, 1979–2012. Paper presented at the International Studies Association Annual Convention.
+Loughran, T., and McDonald, B. (2011). When is a liability not a liability? Textual analysis, dictionaries, and 10-Ks. Journal of Finance, 66(1), 35–65.
+Tetlock, P. C. (2007). Giving content to investor sentiment: The role of media in the stock market. Journal of Finance, 62(3), 1139–1168.
+Tetlock, P. C., Saar-Tsechansky, M., and Macskassy, S. (2008). More than words: Quantifying language to measure firms' fundamentals. Journal of Finance, 63(3), 1437–1467.
+Full JSON lives at simulations/backtest/events/<event-id>/watchlist.json.
Controls are listed for completeness; none appears in its corpus (Section 4.6).
simulations/backtest/build_fixture.py.Replayed on 161 real archived headlines from three crises, the screen flagged every affected company before its formal failure date and never flagged the unrelated control companies. But it never flagged a company before the press reported its stock already falling.
+Replayed on 161 real archived headlines from three crises, the screen flagged every affected company before its formal failure date. But it never flagged a company before the press reported its stock already falling, and the backtest cannot say how often it raises false alarms.
So the system is fast, auditable triage of a market reaction already underway, not a predictor. The working paper (Section 4.5) shows the check and the tests that pin it.
| Event | Mechanism | Flagged before resolution | Median lead to resolution | Controls flagged | Before market reaction |
|---|---|---|---|---|---|
| Event | Mechanism | Flagged before resolution | Median lead to resolution | Before market reaction | |
| SVB 2023 | Regional-bank contagion | 5 / 5 | 2.34 days | 0 / 1 | 0 / 5 |
| Wirecard 2020 | Accounting fraud | 1 / 1 | 6.60 days | 0 / 1 | 0 / 1 |
| FTX 2022 | Crypto counterparty contagion | 3 / 3 | 7.12 days | 0 / 1 | 0 / 3 |
| SVB 2023 | Regional-bank contagion | 5 / 5 | 2.34 days | 0 / 5 | |
| Wirecard 2020 | Accounting fraud | 1 / 1 | 6.60 days | 0 / 1 | |
| FTX 2022 | Crypto counterparty contagion | 3 / 3 | 7.12 days | 0 / 3 |