Research map / Adversarial robustness and security / Certified and empirical robustness

Distributional Adversarial Attacks and Training in Deep Hedging

NeurIPS 2025 · Adversarial robustness and security › Certified and empirical robustness · approach: Robust overfitting and regularization · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that classical deep hedging policies are highly sensitive to small distributional perturbations, and proposes Wasserstein-ball adversarial attacks (WPGD/WBPGD) used for adversarial training of deep hedging strategies, which improves out-of-sample, out-of-distribution, and real-market performance.

Problem

Deep hedging strategies trained on one data distribution degrade under small distributional shifts and model misspecification, and classical Wasserstein DRO tractability results do not cover non-convex deep hedging losses.

Approach

Extends pointwise FGSM/PGD attacks to the distributional setting via a first-order sensitivity expansion of Wasserstein DRO, yielding closed-form one-step perturbations of the empirical sample set, and proposes WPGD and WBPGD multi-step attacks used inside an adversarial training loss that mixes clean and adversarial losses.

Key results

• On Heston with CVaR, attacks increase hedging loss from 1.928 (delta=0) to 8.07 (delta=0.5) for S-WBPGD, showing high vulnerability.
• At N=5,000 training samples, SV-Attack adversarial training reduces mean hedging loss by 54% versus clean training (2.86 vs 6.21) and max loss from 10.62 to 3.60.
• On real market data, adversarial training on FIX improves over clean FIX for all five stocks, e.g. AAPL P&L -0.579 vs -2.261.

Measured effects reported in the paper

Surprising findings

• Adversarial perturbations with very small Frobenius covariance and ACF changes still cause large hedging loss increases, suggesting distributional shifts that are hard to detect with simple statistics.
• The optimal attack radius delta decreases as training sample size grows (0.5 at N=5,000 to 0.005 at N=100,000).

Limitations

• Performance is sensitive to the choice of Wasserstein radius delta, which differs across models.
• Theoretical reformulation is only a first-order approximation valid as delta goes to 0; the attack set is a subset of the ambiguity set.
• Real-market evaluation uses a single price trajectory per company, which the authors acknowledge as a limitation.

Experimental setup

Datasets: simulated Black-Scholes paths simulated Heston paths simulated General Affine Diffusion paths S&P 500 daily closing prices (AAPL, AMZN, MSFT, GOOGL, BRK-B), 2008-2020

Benchmarks: Heston simulated test set (1M paths) out-of-distribution parameter-perturbed GAD/Heston paths (1M) real S&P 500 test trajectories from 9 March 2020

Metrics: mean hedging loss max loss P&L on real trajectories covariance matrix Frobenius distance autocorrelation difference

Baselines: Clean deep hedging (Deep Hedging) Robust Deep Hedging S-WPGD SV-WPGD

Builds on: Deep hedging FGSM PGD Robust deep hedging

Closest papers by meaning

• Deep Portfolio Optimization via Distributional Prediction of Residual Factors (AAAI 2021 · similarity 0.86)
• Adversarial Attacks on Probabilistic Autoregressive Forecasting Models (ICML 2020 · similarity 0.85)
• Certifying Some Distributional Robustness with Principled Adversarial Training (ICLR 2018 · similarity 0.85)
• Market-GAN: Adding Control to Financial Market Data Generation with Semantic Context (AAAI 2024 · similarity 0.84)
• Learning to Price Homogeneous Data (NeurIPS 2024 · similarity 0.83)
• Revisiting Adversarial Training Under Long-Tailed Distributions (CVPR 2024 · similarity 0.82)