Distributional Adversarial Attacks and Training in Deep Hedging
Authors: Guangyi He
Tobias Sutter
Lukas Gonon
Venue: NeurIPS 2025 poster ()
Keywords: deep hedging
distributionally robust optimization
adversarial attack
stochastic control
quantitative risk management
quantitative finance
Primary area: machine_learning_for_sciences
TL;DR: This paper introduces an adversarial training framework that enhances the robustness of deep hedging strategies against distributional shifts, demonstrating superior out-of-sample performance and resilience compared to classical models.

Abstract: In this paper, we study the robustness of classical deep hedging strategies under distributional shifts by leveraging the concept of adversarial attacks. We first demonstrate that standard deep hedging models are highly vulnerable to small perturbations in the input distribution, resulting in significant performance degradation. Motivated by this, we propose an adversarial training framework tailored to increase the robustness of deep hedging strategies. Our approach extends pointwise adversarial attacks to the distributional setting and introduces a computationally tractable reformulation of the adversarial optimization problem over a Wasserstein ball. This enables the efficient training of hedging strategies that are resilient to distributional perturbations. Through extensive numerical experiments, we show that adversarially trained deep hedging strategies consistently outperform their classical counterparts in terms of out-of-sample performance and resilience to model misspecification. Additional results indicate that the robust strategies maintain reliable performance on real market data and remain effective during periods of market change. Our findings establish a practical and effective framework for robust deep hedging under realistic market uncertainties.

Distributional Adversarial Attacks and Training in Deep Hedging
Guangyi He Department of Mathematics Imperial College London g h.e2@@imeerial. ac uk
Tobias Sutter Department of Economics University of St. Gallen tobias. sut.eruuistrr..........u ch
Lukas Gonon
School of Computer Science
University of St. Gallen
lukas gonondunisg ch Department of Mathematics Imperial College London
1. gonooniimmeeiie iwe.eeimpeiaaa... ac. uk
Abstract
In this paper, we study the robustness of classical deep hedging strategies under distributional shifts by leveraging the concept of adversarial attacks. We first demonstrate that standard deep hedging models are highly vulnerable to small perturbations the input distribution, resulting significant performance degrada- tion. Motivated by this, we propose adversarial training framework tailored to increase the robustness of deep hedging strategies. Our approach extends pointwise adversarial attacks to the distributional setting and introduces a computationally tractable reformulation the adversarial optimization problem over a Wasserstein ball. This enables the efficient training of hedging strategies that are resilient distributional perturbations. Through extensive numerical experiments, we show that adversarially trained deep hedging strategies consistently outperform their clas- sical counterparts in terms of out-of-sample performance and resilience to model misspecification. Additional results indicate that the robust strategies maintain reliable performance on real market data and remain effective during periods market change. Our findings establish practical and effective framework for robust deep hedging under realistic market uncertainties
Introduction
In the past decades, options and derivatives trading has seen enormous growth, with billions of contracts traded every year (I]. Hedging of financial derivatives refers taking financial positions
in other linked assets to mitigate the risk associated with the derivative. Thereby, hedging is a fundamentally important task in the financial services industry. Deep Hedging (2) introduces
model-free, data-driven framework that employs deep learning to optimize hedging strategies directly from simulated market scenarios. The core idea is to parameterize hedging decisions via neural networks. Optimal hedging is achieved by training the neural networks to minimize risk measure of the hedged portfolio's profit and loss (P&I.). While this approach has been widely adopted in industry, the performance of learned hedging strategies critically depends on the quality of the training data. For instance, the Rata-generating distribution during training might differ slightly from the test distribution under which the deep hedging strategy is ultimately deployed and evaluated. This mismatch, known as model misspecification, can result in suboptimal or even misleading decisions, phenomenon that is well documented in various classes of data-driven ceecisionnmakinn problems B 4 This
'The code available http:////ggggtttoooooaaaaaa/aaaa
Attacks- and- in-
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

highlights the fundamental challenge of modeling uncertainty in finance and the importance of designing strategies that remain robust to small changes in the underlying distribution.
To mitigate model uncertainty in decision-makinn problems, a large variety of different approaches exist. Parametric methods quantify uncertainty on model parameters, allowing strategies to account for potential estimation errors, like in [S] 6). Moreover, advances in machine learning enable the use of generative models with high-dimensional parameter spaces to simulate complex dynamics 7 [ In the field of deep hedging, recent works consider robustness by perturbing the terminal distribution randomized model parameters or penalizing deviations from a reference distribution [2]
10.
On the other hand, model uncertainty can be addressed within the framework of distributionally robust optimization (DRO) [3]. DRO seeks to make optimal decisions under the worst-case scenario over a specified set of probability distributions, known as the ambiguity set. This problem can be formulated two-player game
mingge max Bs(n) Be [1(O:=)]]
(1.1)
where 0 denotes the decision variable optimized over the parameter space θ representing the first player. The adversarial player selects distribution 7 from an ambiguity set (₁( of plausible distributions centered around a nominal distribution μ.. The objective is described by the loss function I(0; 2²), parameterized by 0 and evaluated at an input Rd, which is modeled The parameter 5 >> 0 controls the size of the ambiguity set, with Bo(u) = {u). Thus, when ō = 0, the DRO problem [.1 reduces to the nominal stochastic optimization problem
random variable.
m Eaz [1(0;))) x))]
(1.2)
Various functions to encode the difference between probability distributions in (s( are popular, such as the d-divergence [14), matching moments [15), and the total variation distance [16). Among these, the Wasserstein distance is particularly popular and powerful, see the appendix for the detailed definition and see [7 18 [3] for detailed treatments of Wasserstein-
DRO problems. These existing computational tractability results in Wasserstein DRO rely on structural assumptions about the underlying loss function, such as convexity, which do not hold in the deep hedging setting considered in this work.
The concept of robustness important across machine learning applications. In image classification tasks, [19] first highlighted that neural networks are vuinerable to adversarial attacks-sman imper- ceptible changes to input images that cause miselassification. This discovery led to a growing body of research on adversarial attacks and training techniques to improve network robustness against them (120) 21 22 ). However, most studies have focused on pointwise adversarial perturbations, where attacks modify individual data points. A broader perspective considers distributional attacks, where an adversary perturbs the entire data-generating distribution rather than specific samples 13 26 (7.). Specifically, the distributional version of adversarial attacks can be applicd to search for the worst-case scenario in the DRO problem.
(23] 24 25 18
In this paper, we study the robustness properties of classical deep hedging strategies under distribution shifts by utilizing the concept of adversarial attacks. The main contributions of this paper can be summarized as follows:
We propose the first framework that unifies distributional adversarial training with deep hedging. Building on tractable reformulations from Wasserstein DRO (26] and sensitivity analysis results (23,, our approach derives computationally efficient adversarial attacks within a Wasserstein ball and integrates them into an adversarial training procedure. This framework reveals the vulnerability of classical deep hedging to even small distributional shifts and provides a tractable method to enhance robustness.
Prior work [3] 17 [8] establishes that data-driven Wasserstein DRO solutions guarantee out-of-sample performance under certain theoretical assumptions. However, in complex dynamic settings such as deep hedging, these assumptions do not generally hold. Through adversarial training with limited data 55,000-100,00 samples), we empirically demonstrate that adversarially trained strategies outperform classical deep hedging methods in terms of out-of-sample and distri--ittiiitoonn performance.
We validate our framework on real market data, demonstrating that adversarially trained strategies remain effective and robust during periods of market stress and distributional shifts, and compare our results against the robust deep hedging approach of (T].

---

Related work. Deep hedging was introduced in 28] Since its introduction, numerous works have studied deep hedging and related machine learning-base based hedging methods from different perspectives.
Robustness of deep hedging methods has been studied in [0 11 12 Further directions include
tackling complex pricing problems [29, 30 BI,, targeting improved efficiency
32
or general
initial portfolios [34], alternative reinforcement learning frameworks [35
36
37
38)
empirical
approaches [39 40), or implementations on quantum hardware [4]]. We refer to the surveys [42 43
for comprehensive overview.
Parallel to this, distributionally robust optimization (DRO) has emerged as framework for decision- making under model uncertainty. with Wasserstein- methods offering both theoretical guarantees and computational tractability [13] [8]. In machine learning, adversarial training provides another
robustness perspective. where worst-case perturbations improve generalization [19] 20
21
22
Recent works extend pointwise adversarial attacks to the distributional setting [23 24
thereby connecting adversarial training methods with DRO formulations.
Deep Hedging Framework
Basic setup. In Deep Hedging 2 we consider a discrete-time market with trading dates (0. .......,77) 7 and of tradable assets. Let S (Si,... ST+1) (T+x(++1) denote the mid-price trajectories of the assets. The price process is adapted to a filtration (Fi) generated by an information process I == (J..... Iy+1), where each I E Rd captures market-relevant features at time such asset prices, volatility, risk limits, trading signals. We denote the price trajectories S(D) as a function of I. The trajectory I is sampled from a known distribution f4, which may corre- spond to stochastic model a uniform distribution over simulated or historical scenarios. A trading strategy ê = (ō1,...,ōT_i) E Rrxx represents the portfolio holdings in the r assets. Each position 5, is determined by a neural network that parameterized by 0 (01; 0r) and takes the history of available information up to time / as input,
ÔT-1)
6, So, ,I....,, It).
(2.1)
where fo is function parameterized by network weights 0; E R". Therefore, the whole trading strategy 8 depends on the the network parameter E O and information process I, denoted 5(0,1).
We consider hedging a contingent claim with payoff P(ST) at maturity, where P R" - IR is given payoff function. The profit and loss (PnL) of the hedging position is defined as
T PnI = Po + Σ 8. (0, (() - ((S
(2.2)
for a given price po 2 0. The objective is to optimize the hedging outcome PnI(0. I) under a convex risk measure p. such as the entropic risk measure or Conditional Value at Risk (CVaR) 44 i.e., solve
mingge e (0 I)]
(2.3)
Optimized Certainty Equivalents. We focus on convex risk measures that admit an optimized certainty equivalent (OCE) form. Specifically, consider convex risk measures that can be expressed as
p(Z) inf (w E [e(-Z 7 ---w) w]]}
(2.4)
WER
for random variables 7 and fixed loss function 1: R - R. OCE risk measures form an important class of convex risk measures [45). naturally suited for deep hedging (2]. During training, we implement an OCE risk measure by treating w trainable parameter. That is, we consider an augmented parameter 0 == (0,w) and define the deep hedging loss
lu I) = + + ((-PLL - w).
(2.5)
We can equivalently express the deep hedging problem 2..3 standard expected loss minimization
ming Er DH (0 .)].
(2.6)
During the evaluation, the optimal w can be obtained by directly solving 2.4
3

---

DRO Formulation of Deep Hedging. The reformulated deep hedging problem (2.6) now has the common structure of (I.).. which induces a corresponding DRO formulation
ming BaX EI (0, l)]-
(2.7)
The OCE framework naturally encompasses common convex risk measures such entropic risk and Conditional Value-at-Rin (CVaR), whose specific implementations will be demonstrated in subsequent examples. Crucially, the OCE reformulation aligns with standard DRO formulations, enabling direct utilization of established convergence guarantees and computational methods.
Examples. We consider a Black-Scholes model and General Affine Diffusion model with entropic risk and Heston model with CVaR. Detailed formulations of these models and the associated loss functions are provided in the appendix.
3 Adversarial Attacks
Pointwise adversarial attacks. Pointwise adversarial attacks aim to perturb the imput within 5-ball centered at the input to maximize the corresponding loss, that is,
maX ((0;2) subject to d(t,z) S.
(3.1)
Two cornerstone algorithms in this domain are the Fast Gradient Sign Method (FGSM) [20] and Projected Gradient Descent (PGD) (1I] For input x and L x distance d(.,)). the FGSM perturbation computed as
i = x + 6 sign( v.((0=)))
(3.2)
where 8 is the perturbation magnitude, Val(0; x)) is the gradient of the loss function with respect to the input 2, and sign(-) denotes the element -wie sign function. FGSM directly perturbs the input data the direction of the gradient to the boundary of the 8-ball around the original input æ, which is computationally efficient. For deeper exploration of the worst-case perturbation, PGD is an iterative extension of FGSM that applies multiple small perturbations the input. At each iteration, the input is updated as
(k+1) Pro (x 3 sign(V ,0;(0; (+)),,
(3.3)
where 3 is the step size, and (ro projects the perturbed input back into the 8-ball around to ensure the perturbation remains bounded.
Distributional ad versarial attacks. Distributional adversarial attacks aim to find the worst-case data distribution perturbation within an ambiguity set (B( that maximizes the expected loss of the model. This is formalized as
(0) ma Ez-n, [))
(3.4)
requires to optimize where an optimal perturbed distribution 17" achieves this maximum. Solving 3.4
Wasserstein ball, making direct approaches intractable. Therefore, provide reformulation that approximates (3.4) based on the sensitivity results on DRO in Wasserstein balls that are inspired by (46). The proposed reformulation relies on the following two assumptions.
Assumption 3.1. The distance d on Rd is induced by norm defined as
with corresponding dual norm
||v|l- = sup (1, |
(3.5)
Furthermore, there exists function h RRd + Rdd such that
|0||_ (h(x), for all E Rd.
(3.6)
Assumption 3.2. For each 6, the map x -> 1(0; x) Lipsehitz continuous.
Assumption 3.1 is satisfied, e.g., for d chosen as the distance induced by the 11 norm. In this case, the dual norm is given by || ll.. where g the Hölder conjugate satisfying 1/p + 1/q = 1. The corresponding function I + Rd explicitly given (with operations applied component-wise) as
h(x)) sign(z) |
(3.7)

---

Additionally, we focus on the data-driven framework, where the input distribution js is the empirical 인े4
distribution constructed from the training set , ....
i...
- Óx,.
Analogously to (3 Theorem 4.1] the setting classification problem, we use 446 Theorem 2.1] and its proof to establish the following theorem. The details are provided in the appendix.
Theorem 3.3. Under Assumption 3.7 and Assumption 3.2 (ō can be approximated by
(6) Eng [[0, o()) as 5 O.
(3.8)
where 1is = >n 6x, For n ,,...,N, each Xn is the perturbation of the original sample
X, = X, + - ((: X., V.: r =
(3.9)
V (0; (,))
(3.10)
provides an approximate worst-case perturbation by leveraging the sensitivity expan- sion of the Wasserstein DRO problem, which directly yields a computationally tractable solution that approximates (3.4). However, this approach may not fully explore the adversarial landscape. Therefore, we instead constrain optimization to a subset of the ambiguity set which contains y)s and has a simpler structure. The set B3 (bx) is defined as
Equation 3.9
Bo(uN) = JAN -
1 - N
E 6x, X, Rd, 1 E d(X,, (1) soj.
(3.11)
Lemma 3.4. Consider the empirical optimization problem
(6) = max nE Earoy [(0
(3.12)
obtained by replacing the ambiguity set (b( in 3.4 by BB(u) as defined 3.11. Under
Assumptions 3.7 3.2
have
(o = (8) + o()) as 840.
(3.13)
The set Bs( has been previously studied in the literature 126 27 with focus on the setting
where N grows. Our paper provides sensitivity analysis L 0. Finally, we write (3.12) into constrained problem perturbing the dataset directly
1 Σー d(X, 8.)))// $6. (3.14)
V (6) = max X N ==1 X(,; subject to
is worth noticing that, as p - co, the constraint in (3.14) becomes an - i.e., max, (d( (X,,, X,)) & 6, which coincides with the pointwise adversarial attack setting.
Algorithms for Distributional Adversarial Attacks in Deep Hedging
In this section, develop numerical algorithm to solve the distributional adversarial attack problem (3.4 via its tractable approximation (3.14) in the deep hedging framework. Drawing inspiration from adversarial training methods in machine learning, we adapt the Fast Gradient Sign Method (FGSM) [20] and Projected Gradient Descent (PGD) (21) to the distributional setting. For each algorithm, we first propose one-step FGSM-like perturbation generate adversarial distributions efficiently. We then extend this to multi-step PGD-like algorithm, which iteratively refines the perturbation with smaller steps while constraining the perturbation through projection step.
We first focus on the Black-Scholes model, where the input information is exactly the single price trajectory as detailed in the appendix. We will then explain how to extend the algorithm models with more than one trajectory, including the Heston model, where the input is a pair of price and variance trajectories and v. For the readers' convenience, focus these two cases here and present algorithms for general setting in the supplementary material.
In deep hedging, with the loss function DH (0; S) defined in 2.5) problem 3.14 becomes
max SN N -= (B: subject to
Σn'''
.N
Σ ==1
d(s /) s 5.
(4.1)
5

---

We define the distance in the input space I T+1 as the - distance, i.c.,
d(S.. S..) = |S,, - Salle = max Sn,t - Sn,l.
(4.2)
The infinity norm has the -nom as its dual norm, i.e., ||9|l. applied component-wise, satisfies (h(x), = ||=]] which implies Assumption 3.1
Et= Igt and h(x) sign(z).
Wasserstein Projection Gradient Decent (WPGD). Following the above setup, equation (3.9)
provides an asymptotic approximation of the worst-case distributional shift, leading to one-step perturbation of each path like FGSM
S - Sn + 8- 1e.
(4.3)
where oi is the gradient of pH (0:S,) with respect to S, and Y is defined as ( Σn 19 1/9) To propose an analogous PGD-like algorithm, we iteratively apply (4.3) with adjusted step-size B and project the perturbed path back ball defined by the constraint (4.1). During the projection, each sample S,, updated
N
S Sn
S,):
(4.4)
where dist N DE Gradient Descent (WPGD), is summarized Algorithm
1 d(S: P. The overall procedure, called the Wasserstein Projection
Algorithm Wasserstein Projection Gradient Descent (WPGD)
1: for 1 to nuum_oof _oun_oo_ileralio do
2: Compute Y == ( Σm
3: for
N do
4: S, + S. + B- sign(V (e
5: end for
6:
S,,..., Sn. + Proi ( (SI,...,..) Sw))
7: end for
Wasserstein Budget Projection Gradient Descent (WBPGD). We can interpret d(S,,, S,,) in (4.1) as budget allocated to path S,, during the attack. This intuition motivates a reparameterization of the perturbed sample as
S, = S, + budget,, x direction,;
(4.5)
where for each sample S,, the variable budget,, Rzo represents the magnitude of the perturba- tion, and direction,, with the same dimension as S,,, denotes its direction bounded within [-1, 1]. Then, the optimization problem (4.1) can be considered as allocating budget,, with the restriction
( D budget"))
and optimizing the perturbation direction for each sample. We have the following one-step updates budget,, and direction, based (4.3).
Lemma 4.1. For the perturbation S. satisfying 4.3)
have the equivalent representation
=, + budget, x direction,..
(4.6)
Let 9i and sf be the gradient of LDH (0; b d) with respect to b and d when = and = (0;S then
budget, = 8- (- direction, sign(g())
(4.7)
Furthermore, T in 4.3 satisfies T ( EN 19999
By applying the above updates iteratively with step size and projection, we propose new PGD- like algorithm that optimizes the budget allocation and perturbation direction for each sample independently. The full procedure is summarized in Algorithm

---

Algorithm 2 Wasserstein Budget Projection Gradient Descent (WBPGD)
1: for i= I to numm_oof -ir_ooollleraoonnn do
2: Compute 9h and In through pack-propagation for 1, I,...,N
3: Compute T := ( Σ (
4: for n to N do
5:
budget, f budget, + 3. 1-
6:
direction, + direction, + 3/6 sign(
7:
Clamp direction, to [-1,1]
8: S, S, + budget, x direction..
9: end for
S S. + Proj (S
end for
Extension to Heston model. We now consider how to extend the above algorithms models with several series of data as input, such as the Heston model. In this case, the network strategy uses two input series: the price process S and the variance process v. During the attack phase, we perturb either the price process S alone (referred to as S-Attack) or both the price and variance processes simultaneously (referred as SV-Attack) For S-Attack, we can directly apply the above algorithms. For SV-attack, we first need to define, for weight À >> O, the distance on (S,V) as
d((S, V), (S, v) (Smax,|S, ) + (A max./ d//).
(4.8)
The price and variance are weighted differently as they are on different scales. Under this distance, we have d((S, v). (S, 8) d(s Sy + >Pd(y, V)P and the following result by direct calculation.
Corollary 4.2. Under Assumption 3.7 and Assumption 3.2 for impul (S, v) with distance defined
as (4.8) T becomes
r
vn Sm.
II1/A T,,
(4.9)
and the perturbation
3.9 can be written
S S S (.
(4.10)
サ 1/> sign
V.((0:S,r)]l!"
(4.11)
This corollary reveals that applying an adversarial perturbation jointly the price and variance processes (S, v) under the defined metric (4.8) is equivalent to independently perturbing the price series S and the scaled variance series λv separately using the Lx2 -distance. Consequently, practical implementation, we can conveniently treat S and λv as separate input sequences, by transforming the original sample set {S....., ,,,) into (S), AV1, Sn, }v
Experimental Results
5.1 Attacks on classical deep hedging strategies
We start with applying distributional adversarial attacks to neural network strategies trained in the classical deep hedging 2 setting, i.e., on the Heston model with CVaR loss function. As detailed in Section 4 both S-attack and SV-attack are implemented using the WPGD and WBPGD algorithms introduced in Algorithms/ I and 2 The resulting hedging loss across varying perturbation magnitudes is summarized in Table The base case (ō 0) corresponds to the unperturbed hedging loss. Table shows that the adversarial loss significantly increases as the attack magnitude (d) increases. Additionally, the WBPGD method consistently outperforms the WPGD method, especially at larger perturbation magnitudes. Therefore, WBPGD will be used as the main attack method in subsequent experiments.
To understand practical implications and quantify the extent of distortion in the path space due to the attack, we assessed perturbation impacts through covariance matrix comparisons, as shown in Table 2
The Frobenius distance between the covariance matrices of perturbed and original paths,
7

---

given the original covariance matrix norm (< 386), indicates minor covariance distortions, especially for small perturbations (6 < 0.1). Specifically, simultaneous perturbations on both price and variance processes (SV-Attack) result in less pronounced covariance changes compared to perturbations only on the price process (S-Attack). In the appendix we also report autocorrelation function comparisons.
Overall, together with with Table D these analyses show that adversarial attacks may significantly deteriorate the hedging strategy's 's performance, even under seemingly modest perturbations, thereby underscoring the necessity for robust neural network models in financial applications.
Table 1: Robustness of classical deep hedging strategy under different attack methods and magnitudes
0
0.01
0.03
0.05
0.1
0.3
0.5
S-WBPGD
1.9280
1.9642
2.0432
2.1356
2.4466
4.5771
8.0745
SV-WBPGID
1.9280
1.9659
2.0485
2.1451
2,4660
4.5898
7.7391
S-WPGD
1.9280
1.9642
2.0431
2.1343
2,4369
4.5148
7.5411
SV-WPGD
1.9280
1.9652
2.0457
2.1378
2.4393
4.4802
7.4678
Table 2: Distance berween covariance matrices of perturbed and original paths
8
0.01
0.03
0.05
0.1
0.3
0.5
S-Attack
0.1421
0.4038
0.6295
1.0248
2.3864
4.5057
SV-Attack 0.1355
0.3836
0.5929
0.9548
2.1787
3.8617
5.2 Adversarial training
We introduce adversarial training, which aims enhance the robustness of strategies against distribu- tional adversarial attacks and hence solve the DRO problem. We adopt the standard deep hedging methodology [2] as baseline and expand it incorporate adversarial examples during training. Experimental details (e.g., network architecture, hyperparameters) are provided in the appendix.
Loss functions. In standard deep hedging, the network parameters O are optimized using the loss function defined by Lelean (0) E IDH (8; X,)). In adversarial training, we separate the optimization problem into two parts: the inner maximization problem and the outer minimization problem. During the inner maximization part, the network parameters are fixed and we apply a distributionally adversarial attack to find the worst-case perturbation. With the adversarial perturbation Xn obtained from the distributional adversarial attack, we can then minimize the expected loss function with respect to the network parameters the outer minimization part. Following 20 22]. our training uses an enhanced loss function
Ladv (0) a Σ
n=1 Em= In (1; > n=1 Inn (0; Xn),
(5.1)
where (XI,... 8n) are adversarially perturbed versions of the original samples and a balances the importance of clean versus adversarial samples. This leads to an iterative process of adversarial training, alternating between generating adversarial samples and optimizing the network parameters.
Dataset. We conduct our experiments using three well-established financial models: SccklSSc Heston, and the General Affine Diffusion (GAD) model. Here we present results for the Heston model in Section 5.3. while model details and results for the other models are provided in the appendix. Results for real market data are reported in Section 5.4 below. For each model, we generate extensive training datasets of 100,000 sample paths. To examine robustness across varying dataset sizes, we partition each dataset into smaller subsets with sizes N ranging from 5,000 to 100,000 samples. Neural networks are independently trained on these subsets, and the average performance is assessed and reported on a fixed test set, which contains I million paths, generated from the same distribution. In addition, we generate a validation set of 100,000 paths, but only N paths will be used for validation, so that the training is exposed to only a limited number of data depending N.
Robustness of adversarial training. Strategies trained with our adversarial procedure achieve lower losses under distributional perturbations than classical deep hedging strategies, indicating that
8

---

the method effectively approximates the desired distributionally robust solution. Detailed experiments and results are provided in the appendix.
5.3 Adversarial training improves out-of-sample and out-of-distribution performance
Out-of-sample performance. Given robust strategies alongside the corresponding clean strategies, Figure Ta evaluates hedging performance on a test set of 1 million simulated paths approximating the true generraing distribution. The midline presents the average performance of strategies trained on partitioned datasets of size N. while the shaded area shows the performance range. From the plot, adversarial training significantly outperforms conventional methods, especially when data is scarce: at N 5,000, SV-Attack achieves 54% lower mean hedging loss than clean training (2.86 vs 6.21) while reducing worst-case outcomes by 66% (max loss 3.60 vs 10.62). When the data size becomes larger, the empirical distribution becomes closer to the true underlying distribution, and all strategies approach near-identical performance (~ 1.95). However, the robust strategy still outperforms the clean one even at relatively smaller scales. In addition, though S-Attack and SV- Attack show comparable average performance, SV-Attack exhibits tighter variance across all N, indicating the advantage of allowing perturbation in the variance process.
Out-of-distriuttinn performance. In prior experiments, test data were drawn from the same distribution as the training data. To further assess generalizability, we now evaluate the strategy on out-of-distribun
(OOD) samples generated under perturbed parameter regimes. Specifically, we generate 100 new parameter configurations by scaling the original values by factors uniformly sampled from (0.9, 1. introducing bounded deviations of +0%% For each perturbed configuration, 10,000 sample paths are simulated, resulting comprehensive OOD dataset of 1 million paths. Figure Tb illustrates the strategy's s performance on this OOD dataset. Despite the models never encountering these perturbed parameter regimes during training, the observed performance trends align closely with the out-of-sample results in Figure Ia underscoring the robustness of the approach under parameter distribution shifts.
8 attack
attack
attack
Hedggnng Lose
Hedging
Training Samplex (N)
Training Samples (N)
Out-of-sample performance
(b)
Out-of-distribution performance
Figure I: Comparative hedging performance under Heston models. Shaded regions indicate min-max ranges across training partitions.
5.4 Experiments on Market Data
In this section, we evaluate the performance of adversarial training on real market data. Specifically, we train hedging strategies using historical daily closing prices from leading companies in the S&P 500 index from [47), covering the period from 26 September 2008 8 March 2020. The time period is chosen in line with the benchmark method [T with which we compare our method.
For this evaluation, we constructed two synthetic datasets based on an additional model introduced in the appendix. The FIX dataset is simulated using the General Affine Diffusion (GAD) model with fixed parameters estimated from 250-day period prior to 8 March 2020. The ROBUST dataset, following [1I. is also based on the GAD model but incorporates parameter robustness by sampling parameters uniformly from intervals determined by the extreme values across 26 rolling estimates. These estimates are obtained from 250-day windows updated every 100 days between September 2008 and March 2020. For each dataset (FIX and ROBUST), generate 100,000 paths for training,

---

validation, and testing. The starting price is set as the closing price of the respective company on 8 March 2020, and each trajectory is scaled to begin from 10.
Directly training on the FIX and ROBUST datasets corresponds to the methods proposed in Deep Hedging 2 and Robust Deep Hedging [1] respectively. Building this foundation, implement the adversarial framework described in Section [5.2] resulting in two adversarial variants of the strategies. Similar to [II], we evaluate out-of-sample performance real data by computing profit and loss (PnL) for hedging strategies on the tested price trajectories starting form 9 March 2020, Table 3 summarizes results for five companies B where bold entries indicate uop-peformming results company. To address the limitations of using a single price trajectory, we refer the reader to the Appendix for details of the evaluation protocol and an additional evaluation result.
Several notable patterns emerge from this analysis. The clean strategy trained on the ROBUST dataset generally outperforms the clean strategy trained the FIX dataset. This aligns with the conclusion of [T]. which highlights the benefit of incorporating parameter uncertainty into the training data. However, our proposed adversarial training framework consistently achieves better performance overall. When trained on the FIX dataset, adversarial training yields notable improvements over clean training across all companies. In cases where clean training on the ROBUST dataset performs better than adversarie training on the FIX dataset, applying adversarial training to the ROBUST dataset further enhances performance. These findings underscore the effectiveness of the adversarial training framework we propose in addressing model misspecification and enhancing strategy robustness.
Table 3: Testing performance (P&L) on tested price trajectory
Method
AAPL
BRK-B AMZN
GOOGL
MSFT
Clean training on FIX
-2.261
-0.981
-2.086
-1.275
-4.341
Clean training on ROBUST
-0.830
-0.849
-0.281
0.026
-0.223
Adversarial training FIX
-0.579
-0.291
-0.127
-0.459
-0.564
Adversarial training on ROBUST
-0.739
-0.860
-0.294
0.199
-0.144
6 Conclusion
We presented a robust deep hedging framework that leverages adversarial training under Wasserstein ambiguity to address the challenges of model misspecification and distributional shifts. By formu- lating the distributionally robust optimization problem as a minimax objective and approximating it through tractable reformulation, adversarially. Empirical results across a variety of widely used synthetic models and data regimes show that adversarially trained strategies achieve improved out-of-sample and diitii-iist performance, especially under structural changes or limited data availability. Further experiments on real market data suggest that these strategies also generalize well beyond simulated settings, maintaining robustness in periods of market stress. These findings underscore the practical value of robust training methods in financial environments characterized by uncertainty and instability.
demonstrated how deep hedging strategies can be trained
Limitations and future work. Our adversarially trained deep hedging framework enhances ro- bustness, but its performance remains sensitive the choice of the Wasserstein radius. which may differ across models. Future work could explore potentially stronger distributional adversarial attack methods and explore extensions alternative ambiguity set geometries beyond Wasserstein balls.
Acknowledgment GH's research is supported by the Department of Mathematics at Imperial College London through the Roth Scholarship. We also thank G-Research for the travel support to attend NeurIPS.
'Including Apple (AAPL), Amazon (AMZN), Microsoft (MSFT). Google (GOOGL), and Berkshire Hath- away (BRK-B)
10

---

References
[1] Choe Global Markets, Inc. Choe Global Markets Reports Trading Volume for December and Full Year 2023. Technical report, Choe Global Markets, Inc., 2024.
[2] Hans Buehler, Lukas Gonon, Josef Teichmann, and Ben Wood. Deep hedging. Quantitative Finance, 197))11771 2019.
[3] Tobias Sutter, Andreas Krause, and Daniel Kuhn. Robust generalization despite distribution shift via minimum discriminating information. In Advances in Neural Information Processing Systems, 2021.
[4] Zijian Liu, Qinxun Bai, Jose Blanchet, Perry Dong, Wei Xu, Zhengqing Zhou, and Zhengyuan Zhou. Distributionally robust q-learning. In Proceedings of the 39th International Conference on Machine Learning, volume 162 of Proceedings of Machine Learning Research, pages 13623-13643. PMLR. July 2022. ICML 2022, 17-23 July.
[5] Qi Feng and J. George Shanthikumar. The framework of parametric and nonparametric opera- tional data analytics. Production and Operations Management, 32(9):2685-211) -2006 2023.
[6] Liwan H. Liyanage and G.George Shanthikumar. A practical inventory control policy using operational statistics. Operations Research Letters, 33(4):341-34) 2005.
[7] Hao Ni, Lukasz Szpruch, Mare Vidalle, Baoren Xiao, Magnus Wiese, and Shujian Liao. Sig-wassersteii gans for time series generation. Proceedings of the Second ACM International Conference on Al in Finance, pages 1-8, 11 2021.
[8] Tianlin Xu, Li Wenliang, Michael Munn, and Beatrice Acciaio. Cot-gan: Generating sequential data via causal optimal transport. Proceedings of the 34th International Conference on Neural Information Processing Systems, 2020.
[9] Jinsung Yoon, Daniel Jarrett, and Mihaela van der Schaar. Time-series generative adversarial networks. Advances Neural Information Processing Systems, 32, 2019.
[10] David Wu and Sebastian Jaimungal. Robust risk-aware option hedging. Applied Mathematical Finance, 15371153-114 2023.
[11] Eva Litkebohmerr, Thorsten Schmidt, and Julian Sester. Robust deep hedging. Quantitative Finance, 165-:1886 2022.
[12] Yannick Limmer and Blanka Horvath. Robust hedging gans: Towards automated robustification
of hedging strategies. Applied Mathematical Finance, pages 1-38, 2024.
[13] Daniel Kuhn, Soroosh Shafiee, and Wolfram Wiesemann. Distributionally Robust Optimization. arXiv preprint, arXiv:2411.02549 2024.
[14] Aharon Ben-Tal, Dick den Hertog, Anja De Waegenaere, Bertrand Melenberg, and Gijs Rennen. Robust solutions of optimization problems affected by uncertain probabilities. Management Science, 59(2):341-357, 2013.
[15] Eric Delage and Yinyu Ye. Distributionally robust optimization under moment uncertainty with application to data-driven problems. Operations Research, 58(3):595-612, 2010.
[16] Hamed Rahimian, Güzin Bayraksan, and Tito Homem-De-Mello, Identifying effective scenarios in distributionally robust stochastic programs with total variation distance. Mathematical Programming, 173(1-2):393-40) 2019.
[17] Peyman Mohajerin Esfahani and Daniel Kuhn. Data-driven distributionally robust optimization using the Wasserstein metric: Performance guarantees and tractable reformulations, Mathemati- cal Programming. (71(1-2):115-116 2018.
[18] Daniel Kuhn, Peyman Mohajerin Esfahani, Viet Anh Nguyen, and Soroosh Shafieezadeh- Abadeh. Wasserstein Distributionally Robust Optimization: Theory and Applications Machine Learning, chapter 6, pages 130-166. 2019.

---

[19] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In International Conference Learning Representations, 2014.
[20] lan J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. arXiv preprint,
2014.
[21] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
[22] Hongyang Zhang. Yaodong Yu, Jiantao Jiao, Eric P. Xing. Laurent Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy. In Proceedings of the 36th International Conference on Machine Learning, pages 7472-7482. PMLR, May 2019.
[23] Xingjian Bai, Guangyi He, Yifan Jiang, and Jan Obloj. Wasserstein distributional robustness of neural networks. Advances in Neural Information Processing Systems, 36:26322-2666 2023.
[24] Xingjian Bai, Guangyi He, Yifan Jiang, and Jan Obloj. Wasserstein distributional adversarial training for deep neural networks. arXiv preprint arXiv:2502.0933 0935022 2025.
[25] Junhao Dong, Xinghua Qu, Z. Jane Wang, and Yew-Soon Ong. Enhaneing adversarial robustness via uncertainty-aware distributional adversarial training. arXiv preprint arXiv:24/ 2tt:::2//1.02220 1.02871, 2024.
[26] Matthew Staib and Stefanie Jegelka. Distributionally robust deep learning as generalization of adversarial training. In NIPS workshop on Machine Learning and Computer Security, volume page 4, 2017.
[27] Rui Gao and Anton Kleywegt. Distributionally robust stochastic optimization with wasserstein distance. Mathematics of Operations Research, 48(2):603-655, 2023.
[28] Hans Buehler, Lukas Gonon, Josef Teichmann, Ben Wood, Baranidharan Mohan, and Jonathan Kochems. Deep hedging: hedging derivatives under generic market frictions using reinforcement learning. Swiss Finance Institute Research Paper, (19-80), 2019.
[29] Alexandre Carbonneau and Frédéric Godin. Equal risk pricing of derivatives with deep hedging.
Quantitative Finance, 21 21(4):593 -08, 2021.
[30] Alexandre Carbonneau. Deep hedging of long-term financial derivatives. Insurance: Mathemat- ics and Economics, 99:327-340, 2021.
[31] Francesca Biagini, Lukas Gonon, and Thomas Reitsam. Neural network approximation for superhedging prices. Mathematical Finance, 33(1):146-1844 2023.
[32] Shota Imaki, Kentaro Imajo, Katsuya Ito, Kentaro Minami, and Kei Nakagawa. No-transaction band network: A neural network architecture for efficient deep hedging. arXiv preprint arXiv:2103.01775, 2021.
[33] Konrad Mueller, Amira Akkari, Lukas Gonon, and Ben Wood. Fast deep hedging with second- order optimization. Proceedings of the 5th ACM International Conference on Al in Finance, ICAIF 24, page 319-327, New York, NY, USA, 2024. Association for Computing Machinery.
[34] Phillip Murray, Ben Wood, Hans Buehler, Magnus Wiese, and Mikko S. Pakkanen. Deep Hedg- ing: Continuous Reinforcement Learning for Hedging of General Portfolios across Multiple Risk Aversions, July 2022. arXiv:2207.077 .07467.
[35] Petter N Kolm and Gordon Ritter. Dynamic replication and hedging: A reinforcement learning approach. The Journal of Financial Data Science, 1(1):159-171 2019.
[36] Jiayi Du, Muyang Jin, Petter N Kolm, Gordon Ritter, Yixuan Wang, and Bofei Zhang. Deep reinforcement learning for option replication and hedging. The Journal of Financial Data Science, 2(4):44-57, 2020.
[37] Jay Cao, Jacky Chen, John Hull, and Zissis Poulos. Deep hedging of derivatives using reinforce- ment learning, arXiv preprint 2103 2021.
12

---

[38] Edoardo Vittori, Michele Trapletti, and Marcello Restelli. Option hedging with risk averse reinforcement learning. In Proceedings of the first ACM international conference on Al in finance, pages 1-8, 2020.
[39] Johannes Ruf and Weiguan Wang. Hedging with linear regressions and neural networks. Journal of Business & Economic Statistics, 40(4):1442-144 2022.
[40] Oskari Mikkilä and Juho Kanniainen. Empirical deep hedging. Quantitative Finance, 23(1):111- 122, 2023.
[41] Snehal Raj, Iordanis Kerenidis, Abhishek Shekhar, Ben Wood, Jon Dee, Shouvanik Chakrabarti, Richard Chen, Dylan Herman, Shaohan Hu, Pierre Minssen, et al. Quantum deep hedging. Quantum, 7:1191, 2023.
[42] Ben Hambly, Renyuan Xu, and Huining Yang. Recent advances in reinforcement learning in finance. Mathematical Finance, 33(3):437-503, 2023.
[43] Johannes Ruf and Weiguan Wang. Neural networks for option pricing and hedging: literature review. J. Comput. Finance, 24(1): 24(1):1-46, 2020.
[44] Hans Föllmer and Alexander Schied. Stochastic i an introduction de Gruyter, 4th rev. ed. edition, 2016.
discrete time. Walter
[45] Aharon Ben-Tal and Mare Teboulle. An old-new concept of convex risk measures: The optimized certainty equivalent. Mathematical Finance, 17(3):449-476, 2007.
[46] Daniel Bartl, Samuel Drapeau, Jan Obiój, and Johannes Wiesel. Sensitivity analysis of wasserstein distributionally robust optimization problems. Proceedings of the Royal Soci- ety A, 4777622256) 2021.
[47] Ran Aroussi. yfinance: Yahoo! finance market data downloader. https://githun com/
ranaroussi/yfinance 2019.
[48] Alexander J McNeil, Rüdiger Frey and Paul Embrechts. Quantitative risk management: concepts, techniques and tools-revised edition. Princeton university press, 2015.
13

---

NeurIPS Paper Checklist
Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification:
The abstract and Section accurately reflect our paper's contributions and scope on adversarial attack and training in deep hedging framework.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation long is clear that these goals are not attained by the paper.
Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of the work and future expectations at the end of the paper.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-specfiiaatinn asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
(iii) Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
14

---

Answer: [Yes]
Justification: Complete proofs of all theoretical results are provided in the Appendix C with assumptions clearly stated.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
(iv) Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: We disclose all the information needed to reproduce all the results of the paper in Section 5.2 and Appendix D The codes to reproduce the results are provided in
supplemental material.
Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data provided or not.
the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the of large language model), releasing of a model checkpoint, or other means that are appropriate the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
15

---

reproducible, they (v) Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions faithfully reproduce the main experimental results, described in supplemental material?
Question:
Answer: [Yes]
Justification: We provide codes in the supplemental material with clear instructions to reproduce all experimental results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co
for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (c.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https
/nips. wttpcc/ccccccccccccccooooo httpa///gu.deee//eeuubbbbiiiii seriissssoooooiii
for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing as much information as possible supplemental material (appended to the paper) recommended, but including URLs to data and code is permitted.
(vi)
Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: We describe the experimental setup in detail in Section 5.2 and Appendix D with all necessary information provided.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core of the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
(vii) Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: We report the out-of-sand sample and containing min-max ranges across training partitions.
performance in Fig
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results are accompanied by emoo bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
16

---

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
(viii)
Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: We provide the details of computer resources we use to train the neural network in Appendix
D
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g.. preliminary or failed experiments that didn't make into the paper).
(ix)
Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics http:///ww..aaappppppppppt/aaaaa
Answer: [Yes]
Justification:
Our work does not violate NeurlPS Code of Ethics.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws regulations in their jurisdiction).
(x) Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
we emphasize that potential issues model misspecification, which may result in suboptimal or even misleading decisions. This highlights the practical importance of designing strategies that remain robust to small changes in the underlying distribution.
Justification: In Section 1
17

---

Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out, For example, it is legitimate to point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI...
(xi) Safeguards
Question: Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Answer: [NA]
Justification: Our paper does not pose risk of potential misuse.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
(xii) Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [NA]
Justification: Our paper does not use any existing assets.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
18

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the datasets.paperssiii paperswi thcode. www.coo//aaaaa datasets package should be provided. For popular datasets,
has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
(xili) New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: Our paper does not release any new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmodl as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
(xiv)
Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: Our paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
(xv) Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
Our paper does not involve crowdsoureing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
19

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
(xvi)
Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: Our paper does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, non-standard components.
Please refer to our LLM policy (https://neurd) hbtre://eeerrpppccco/oofereeee// /c/////oeeeeeeeee/222////.. for what should or should not be described.
20

---

Appendix
A Wasserstein Distance
For a Wasserstein distributionally robust optimization problem 1.1.. the ambiguity set Bs(μ) is defined as a Wasserstein ball centered at μr E P(R i.
Bo(p) {n E P(RR): (, S 6].
(A.1)
For any p E (1, o0), the Wasserstein distance w (H, 1) between two distributions 1a and rj is defined as
Wp(,, m) =
inf -ell(an)) J xR
d(x, dy,,x,
(A.2)
where [1, 77) denotes the set of all joint distributions on Rd x Rd with marginals μ and ry and denotes metric on Rdd
For = co, the Wasserstein distance becomes the minimal maximal displacement between two distributions
W (u, inf (7-ess sup d(x, >EtT()-))
(A.3)
Here, y-ess sup denotes the essential supremum with respect to the measure y over Rd x Rd.
B Deep Hedging Examples
Black-Scholes Model with Entropic Risk Measure. this scenario, we assume that the asset price follows the classical Black-Scholes model
Case 1:
dS, = mS, dt + +5, dW,
(B.1)
where m is the drift, a is the volatility, and We is a standard Brownian motion. The process is discretized in time for training the neural network.
Here, as the process is Markovian, we define the information process directly as the price process S.+ which provides all the necessary information make decisions time t. The network strategy in 2.I is simplified to
8, fe. (S²).
(B.2)
We consider hedging a European call option with terminal payoff
P(St) max(S7 K,0),
(B.3)
where K is the strike price. To account for risk aversion in the objective function, we adopt the entropic risk measure
1
p log E
(B.4)
where A 0 the risk aversion parameter. This risk measure is commonly used in finance model the risk preferences of investors [4].
By [2] Example 3.8), the the entropic risk measure admits the OCE form
p(Z) inf + E expppxXX ((( w)) + log
(B.5)
Moreover, the corresponding optimal w in (B. is given by log ED exp(-
(B.6)
The corresponding deep hedging loss is then defined as
1 log À
In w.
+ Exp(-N(PnL(e.S) +w).
(B.7)
21

---

Case 2: Heston Model with Conditional Value-at-Risk (CVaR). In this scenario, we assume that the asset price follows the Heston stochastic volatility model:
ds; = m.² dt + Vu, dW,, du; = a(b v.) dt + a /
(B.8)
where Up is the stochastic variance process, and the Brownian motions W7 and W? satisfy
EldW; dw?) = dt.
(B.9)
The parameters b, and a control the mean reversion speed, long-run variance level, and volatility of volatility, respectively.
As U, itself is not directly tradable, to hedge the volatility risk, we introduce a second price process representing a variance swap corresponding to the tradable asset.
The variance swap at time is given by
ot
Us ds + U2 - (1---10000))) + ((T - 1),
(B.10)
a
where the integral is approximated by the trapezium rule in practice.
We then hedge through trading both the underlying asset and the variance swap, i.c., we define the combined price process as S; = S?). Moreover, since the network needs both the price of the underlying and variance to make decisions, the information process is defined as I, (S) v4)- The Heston model is Markovian with respect to this information process, so the network strategy becomes:
6, So, (S)+ v2)-
(B.11)
We again consider hedging a European call option with the same terminal payoff in B.3
To evaluate hedging performance under downside risk, we adopt the Conditional Value-at-Riss (CVaR) risk measure confidence level a E {0,1)
1 1
CVaR.
VaR, (Z)dy
(B.
VaR, inf {= E P(Z < -2 < <
(B.13)
This risk measure captures the expected loss in the worst 1 fraction of outcomes and is widely used in risk management [48] The CVaR can be written in OCE form
I E[max(- w. w.01
CVaR, inf WER
(B.14)
where the optimal is attained at the a-quantile of 7. We then define the corresponding deep hedging loss
(D, w. S + 1 &
max max(-PnL(,,S', v) - w. w).).
(B.15)
Case 3: General Affine Diffusion (GAD) Model with Entropic Risk Measure. In this scenario, we assume the asset price follows a General Affine Diffusion (GAD) process:
dS, (bo + b, S,) dt + (as + a1S))" dW..
(B.16)
where W, is a standard Brownian motion and the parameters bp. by ag d1 and y control the drift and diffusion characteristics.
To discretize the process for numerical implementation, we apply the Maler-Maruyama scheme. Following the robust approach of [Л we introduce parameter uncertainty through intervals, where each path and each time step. parameters are drawn uniformly from their respective intervals:
for = 1,...,T: AW, NO0 At),
dg ~ U U[g ao), ai ~ Uia ail bo ~ ULo, bol, b, ~ UL4
S. = S. + (bp + b + (ao + a A
(B.17)
22

---

By taking intervals as point value, the above process approximates the classical GAD process. As in the Black-Scholes model, the network strategy is defined using only the current price:
à, fo. (St).
(B.18)
Following the same setup as we consider hedging an Asian at-the-money put option with the terminal payoff
P(S) max
So
Σ
St,
(B.19)
We the same entropic risk measure in the Black-Scholes model (see Case above).
C Proofs
Proof of Theorem 3.3 Our proof follows the approach of [23 Theorem 4.1], adapted to the classifi-
cation setting. Specifically, we build on [46. Theorem 2.1] and its proof, which we restate below as theorem.
Theorem C.1 (Adapted from 46 statements hold.
23
Under Assumption 3. and Assumption 3.2
the following
ii The first- sensitivity expansion as 5 & ensures
V(6) = V(0) + oY + o0), where := Bzna (0V=(()))))))
(C.I)
and is the conjugate exponent of p. satisfying 1/9+ + 1/p=1. = iii) Furthermore, V()) can be approximated by
V(6) Em [(00 x)] o() as 8 4
(C.2)
where the perturbed distribution n7 explicitly given by
778 + + [(=
p.
(C.3)
In the data-driven framework we choose μ =
1 N E 8x.- Then Y C.1 becomes the average
V (0; 1/
(C.4)
and the perturbation 178 in C.33 becomes uniform distribution on the perturbed dataset NN), where each X, satisfies
X Xn + 5
(C.5)
Proof of Lemma
3.4 By Theorem 3.3
Ts is of the form //4 E 8x. and satisfy
1
Σ
d(X,, 8.)
N Σ ||
N
N i=1
8P
Σx IMV.111...) [x,,((00 x,))
(9- 1)p
8P
|| X,,Il Σx 1=
N
N
(C.6)
where we use ||{())] sup (f(x), (u sup || 1, (q- 1)p (1 1/q)pq =
for exponent conjugate and CC4). Therefore, we have 75 Bs(u).
23

---

1 Moreover, for μ 2/ En= 6x, and p N En= Ex,' we have
Eu=nd (x,, E II(H,
(C.7)
Therefore, by the definition of the Wasserstein distance,
Wp(,, (1) S / d(z,w) u)) dr(a, u)) IN EM N d(X;, (;)
(C.8)
If ( EN d(x, //D < 6, so Wl,,, P), hence Ba(w) C Bs(u).
Overall, we proved that 778 BB(μ)) c Bs(p). Therefore, Ens [(0;; x:] I (6) S Vo(o) and
0 0 5 (Vo()) - (5) - (Vo(o) E [10 .]])-
(C.9)
By Theorem 3.3 RHS + 6 0, so (Vo(()) (6)) also converges In other words, Vo( (6) o()) 5
(C.
Proof of Lemmaa 4.1 For Ih Vs((0; the updates 4.3 can be separated into updates on budget,, and direction,
T r ΣxE
N
11. budget,, 119 1 direction, sign(g.)).
(C.11)
By the chain rule, we have 3h = wh direction,.) = |1 and S = g /bddgeett The update above becomes
r Σ En=( budget,, (0h)0-11p) 1p1 direction, = sign(g
(C.12)
which proves the lemma.
Corollary 4.2 a special case of the following more general result, which we will prove next.
Corollary C.2. Consider the setting of Theorem 3.3 with inputs of the form x [xxx(++1) representing d-dimensional sequences of length T 1. Set the norm
(a ...,,"") 2d))
d
|||||
Σ (A, 112711000)
(C.13)
where ||. lloe is the infinity norm defined in the space of the trajectories RT++ Over the input
samples (X1,... ) where each sample contains trajectories X,, = (X) no.... Xd), we define In = (gh....,
vl00; (X] g. xx....,dd) Xd))
to be the gradient with respect to the input.
In this setting, the perturbation can be written as
X A; sign(g 2 1 -
(C.14)
for 1,...,d and n I,..., N. Moreover, T becomes
(C.15)
where || lla is the norm defined on T++
Proof. We first show that the norm in C.133 has dual norm defined
||
//.
(C.16)
i=1

---

With the standard pairing (a, v) = Σ, (a", v²), we estimate
(a,w)) S
| L - (Ae (x)
1l (1))))
||>|||| Iyll, (C.17)
where the inequalities hold by Hölder's incquality.
By setting >x||æ* lloe x x; Ily'll and x' = || siggn))( for each i, for any y there exists such that ||=||| 1 and (ax, y/ corresponding function hyy such that (h(v), y is defined
||=||| llyll. Hence (C.16) indeed defines the dual norm by definition. The
h(v) 1
x sign(y
1l v
X
(C.18)
|
Recall that the perturbation in (3.9
Xn = Xn + +
(C.19)
By CC.88. h(ga) becomes,
h(g.) = l1gn ! X sign (ggng 1
Xa de
sign(g
-
(C.20)
Therefore, bringing (C.20) into (C.19). each trajectory in each sample X,, is perturbed
8 X
- A: sign(
I19m l
19
X X sign( 9hh gilll -
(C.21)
for i = 1,..., d and n 1,.... N. Finally,
r = n=1
| 19) ////// ( n=1 i=1
E
T. In 4/9
(C.22)
D Experimental Details
Here we provide additional experimental details regarding the adversarial training introduced in Section 5.2 Readers can refer to the code for a comprehensive implementation.
Network Architecture. The neural network architecture remains consistent with the standard deep hedging framework (2) characterized by decision-making at each time step & ttroough:
8, 5 (Tt).
(D.1)
where I, encapsulates all relevant information available step l. In line with (2) each S comprises two hidden layers, each with 20 neurons, batch normalization, and ReLU activation.
Training Procedure. Our training procedure begins with preliminary phase of clean training to establish stable initial parameters. Specifically, this phase lasts 100 epochs for the BS model and 300 epochs for the more complex Heston model. Subsequently, the network undergoes adversarial training for an additional 200 epochs (BS) or 400 epochs (Heston), alternating adversarial example generation and optimization of Eq. (5.1). For comparison, train baseline networks (clean strategies) exclusively with clean training for an equivalent total duration (300 epochs for BS, 700 epochs for Heston).
Optimizer and Learning rate. Optimization utilizes the Adam optimizer, with decaying learning rate-initially set to 0.005 for BS and 0.05 for Heston. The batch size set to 10,000 unless the dataset size N is smaller, in which case the entire dataset is utilized per batch.
25

---

Hyperparameters. Critical adversarial training hyperparameters include tested at 0, 1, 10 to gauge the relative influence of clean versus adversarial loss, and perturbation magnitude 6, explored across (0.001, 0.003, 0.000,0003,,,, 0.005, 0.01, 0.03, 0.05, 0.1, 0.3, 0.5). Hyperparameter selection is performed by evaluating performance on validation set of size N and selecting the hyperparameters yielding the best validation results.
Adversarial attack. During the experiment, we employ the WBPGD algorithm detailed in Algo- rithm 2 for adversarial attacks. We execute this algorithm for 20 iterations, setting the step-size as 20 6, which is dependent on the perturbation magnitude Additionally, for the two models considered, input trajectories have identical initial values across all samples. Consequently, avoid perturbing the initial values by explicitly setting both the perturbation and corresponding gradient components to zero.
Computation time. All computational runs are conducted without GPU on AMD EPYC 7742 Intel Icelake Xeon Platinum 8358 processors equipped with less than 64GB of memory. For standard adversarial training involving 100,000 sample paths, the computation time is approximately 3 hours for the Black-Scholes model and around 10 hours for the Heston model. In contrast, classical deep hedging without adversarial training requires roughly one-tenth of this computational effort. The increased computational demand for adversarial training is reasonable, each network update includes an additional 20 iterations of adversarial perturbations, enhancing the network's robustness.
Cash-invariant property of convex risk measure. By the cash-invariance property 44 of the convex risk measure we have p(Z + c) = p( for any random variable Z and constant (representing cash injection). Therefore, in practice, we directly set Po in (2.2) to as does not affect the optimization problem. Note that are only interested in hedging here; for pricing the an appropriate choice po could be determined as described [2].
E
Additional Experimental Results
In this section, we provide supplementary experimental results further validate and contextualize the analyses presented in Section 3
E.1
Autocorrelation function comparison
Building upon the analysis presented in Section 5.1 we further examine the impact of adversarial perturbations by comparing the autocorrelation functions (ACFs) of the adversarially perturbed trajectories against those of the original trajectories. For a path } }. the ACF defined as:
lng
1
ACF(z x lag)
(x: (214. =)),
(E.1)
i-0
where 7 is the empirical mean of the path æ, and o² is its empirical variance.
detaoo
addumm 21
-000
Idiamm 2d
ddlaww.25 5.5
400-
defaad
de tump
5
dahl-gg
detaud
de t-
06 0)
dets...
-054
de t1-1
deht-0 05
dehtu00 02
daht-001
1aw0.5
dafi1=0.3
400
Low0.5
0002
(a) in S-Attack
(b) in SV-Attack
(c) in SV-Attack
Figure 2: Difference in Autocorrelation function (ACF) of perturbed paths for different 5 values and original paths.
Fig. illustrates the difference ACF of perturbed paths and original paths. reveals minimal deviations (<c 0.005) in autocorrelation for perturbations with magnitude 8 < 0.1. Despite these
26

---

modest ACF differences, the corresponding hedging errors are notably large (see Table thereby undermining further that an adversarially perturbed sample path distribution may lead to significant hedging losses, even though comparisons of ACF and covariance matrices suggest that the perturbed distribution is close the original distribution.
E.2 Robustness of adversarial training
we examine the adver- sarial loss to confirm training effectiveness. We evaluate robust strategies trained under distributional adversarial attacks with perturbation magnitudes á = 0.01 and 0.1, comparing their performance against clean strategy trained on an identical dataset of 100,000 samples. Table 4 adversarial loss for each strategy under varying perturbation levels. The robust strategies consistently yield significantly lower adversarial losses compared the clean strategy, clearly demonstrating that our robust training framework successfully provides computationally tractable approximation of the theoretically optimal distributionally robust optimization (DRO) solution, enhancing model resilience against adversarial perturbations. Additionally, there is an expected trade-off observed in the loss: for the robust strategy trained with 8 = 0.1, the loss at no or small perturbation levels is higher, but the adversarial loss at larger perturbation magnitudes is substantially reduced, aligning with the designed training objective.
For the robust strategy trained using adversarial training detailed in Section 5.2
iillustates the
Table 4: Comparison of robust and clean strategies under different perturbation magnitudes
0.01
0.03
0.05
0.1
0.3
0.5
clean
1.9162
1.9598
2.0530
2.1560
2.4659
4.6069
8.0379
robust (6 0.01)
1.9186
1.9541
2.0298
2.1130
2.3675
4.1626
7.1445
robust (6 0.1)
1.9796
2.0035
2.0534
2.1064
2.2549
3.1161
4.3156
E.3 Results on adversarial training
Optimal hyperparameter choice. As detailed in Section 3 and Appendix D our robust training framework introduces two critical hyperparameters: the attack radius 5 controlling perturbation magnitude, and the balance weight a modulating between nominal and adversarial losses. Through grid search across (Ó, ai) E [0.001, 0.5] x {0, 1, 10). we identify optimal configurations that maximize validation performance for each training set size N. The optimal hyperparameters for the Heston observe that the optimal å decreases from 0.5 at = 5, 000 to 0.005 at N 100, 000. This phenomenon arises because smaller training sizes induce greater divergence between the empirical distribution μNN and the true data- data-gennrating distribution μl, thus larger adversarial perturbations (f) are required to bridge this distributional gap. The optimal parameters for the Black-Scholes model show similar pattern, see Table 5b
model are presented in Table 5a where
Detailed Heston results. Table 6 provides detailed oft-of-sample performance results, supplement- ing the information shown in Figure la Specifically, the table performance as the sample size becomes large and demonstrates that the SV-Attack strategy exhibits lower variance compared to the S-Attack strategy.
shows improvements in robust strategy
Black-Scholes results. Figure 3 and Table Table show comprehensive results for the Black-Scholes model, revealing patterns analogous the Heston model. However, the gap between robust and clean strategies is relatively smaller than in Heston. This aligns with expectations the simpler Black-Scholes model offers fewer exploitable gaps for adversarial training mitigate, particularly in volatility dynamics.
27

---

Table 5: Hyperparameter Choices for Heston and Black-Scholes Models
(a) Heston Model Hyperparameters
(b) Black-Schole Model Hyperparameters
Training
S-Attack
SV-Attack
Training Samples (N)
Samples (N)
5
8
5,000
0.01
10
5,000
0.3
0.5
10,000
0,005
10
10,000
0.1
10
1.0
10
20,000
0.003
10
20,000
0.05
0.1
50,000
0,001
1
50,000
0.03
0.03
0
100,000
0.001
0
100,000
0.01
0.005
Table Detailed out-of-sample performance across sample sizes (N) for SV-Attack, S-Attack, and
Clean strategies Heston model
Strategy
N
Avg Loss
Min Loss
Max Loss
Variance
SV-Attack 5,000
2.8644
2.7386
3.5975
0.0346
SV-Attack
10,000
2.5460
2.5173
2.6087
0.0008
SV-Attack
20,000
2.1063
2.0928
2.1282
0.0002
SV-Attack
50,000
1.9706
1.9669
1.9742
2.6e-5
SV-Attack
100,000
1.9469
1.9469
1.9469
S-Attack
5,000
2.9646
2.7605
4.5912
0.1574
S-Attack
10,000
2.5287
2,4694
2.6629
0.0028
S S-Attack
20,000
2.1259
2.1027
2.1489
0.0004
S-Attack
50,000
1.9705
1.9665
1.9745
3.2c-5
S-Attack
100,000
1.9422
1,9472
1.9472
Clean
5,000
6,2095
4.7379
10.6187
2.0887
Clean
10,000
3.0000
2.8068
3.1755
0.0129
Clean
20,000
2.1955
2.1329
2.2266
0.0014
Clean
50,000
1.9773
1,9705
1.9841
9.2e-5
Clean
100,000
1.9503
1.9503
1.9503
Table 7: Detailed BS model performance metrics across sample sizes (N) for robust and Clean
strategies
Strategy
Avg Loss
Min Loss
Max Loss
Robust
5,000
2,4109
2,4040
2.4195
Robust
10,000
2.3947
2.3920
2.3976
Robust
20,000
2.3855
2.3852
2.3861
Robust
50,000
2.3798
2.3794
2.3802
Robust
100,000
2.3769
2.3769
2.3769
Clean
5,000
2.4136
2.4055
2,4208
Clean
10,000
2.3976
2.3947
2.3993
Clean
20,000
2.3860
2.3854
2.3866
Clean
50,000
2.3798
2.3794
2.3801
Clean
100,000
2.3772
2.3772
2.3772
28

---

B8 Model: Out-of-Sample Performance Comperison
Clean Robust
2415
2430
Hedging
2.385
2375
Training Samples (N)
Figure 3: Out-of-sample hedging performance comparison under plack-Scholes dynamies, comparing robust training with clean strategies. Shaded regions indicate min-max ranges across training partitions.
E.4 Results Heston models with transaction costs
In this section, we provide an additional example demonstrating the effectiveness of adversarial training by considering the Heston model with transaction costs. Following Equation (2.2). modify the profit and loss (P&L) by incorporating a transaction cost term, which is proportional to the value of the assets traded:
T Pn Po E (=1
5,- 5.- (I)
where e denotes the transaction cost rate, which we set to 0.005 in this experiment.
Apart from adding an additional transaction cost term to the loss function, the experimental setup follows the same procedure described in Sections 5.2 and Appendix [ To account for transaction
costs, we also consider a recurrent neural network architecture, in which the portfolio holding at each time step is passed input the next. In this setting, the update rule in (B.II) becomes
8, fa, (S) Ve, 6c-1).
(E.2)
We refer to the original feedforward network as NetSim. and the recurrent version as NetRec.
As in Figure I we report the out-of-sample performance of both adversarial and clean training in Figure I and Figure on NetSim and NetRec, respectively. The results show that the adversarially trained strategy consistently outperforms the clean strategy. However, this behavior differs from the case without transaction costs: instead of plateauing as the sample size increases, the hedging loss decreases more rapidly. We also observe that although NetRec is more complex, its performance does not outperform NetSim. Both findings may indicate that even with 100,000 samples, the data does not fully capture the underlying distribution in the more complex setting. Under such conditions, adversarial training demonstrates clear advantages over clean training. These findings further highlight the potential of adversarial methods to enhance robustness in lima-limited or distributionally uncertain environments.
E.5 Results on real market data
In Section 5.4 we evaluated performance on single real price trajectory, following the approach of [1]. However, relying single path leads to the absence of validation data and exposure to training randomness. Hence, we adopt the following evaluation protocol. For adversarial training, use N 100,000 training samples and report the average out-of-sample performance across six
29

---

Out-of-Sample Performance Heaton Model Transaction Cost
Clean
27
Hedging
5000
0.0000
20.000
100,000
Training
Figure 4: Out-of-sample hedging performance comparison under Heston model with transaction cost on NetSim, comparing among clean strategies and robust strategies under S-attack and SV-attack.
Out-of-Sample Performance On Hoston Modal with Transaction Cost
Claon Trining
Attokk
3.00
Hedging
2.60
250
5,000
10.000
20.000 Training Samples (N)
20.00 $0.000
100.00 C00
Figure 5: Out-of-sample hedging performance comparison under Heston model with transaction cost on NetRec, comparing among clean strategies and robust strategies under S-attack and SV-attack.
30

---

strategies corresponding to (a, 6) E {0, x {0.03, 0.05, 0.1). For clean training, we average the results over three independent runs with identical settings.
For a more thorough assessment of the model performance, we construct a more comprehensive REAL dataset by applying rolling window of length 30 over the period from 7 March 2020 to 30 September 2021. Each path is normalized to start at a price of 10, yielding a total of 300 sample trajectories. We adopt the entropic risk measure evaluate strategy performance, thereby avoiding the need to compute option prices-one of the key motivations for using this loss function. Performance results are summarized in Table where lower values indicate better outcomes, and bold entries highlight the best performance in each column. We observe that the adversarial strategy trained on the FIX dataset consistently outperforms all others across all stocks, In contrast, clean training on the ROBUST dataset does not offer notable improvements over FIX dataset, and applying adversarial training to the ROBUST dataset further degrades performance. These findings suggest that explicitly incorporating robust parameter intervals into the data generation process may be unnecessary- or even counterproductivv. Since adversarial training already mitigates the impact of model misspecification, the use of parameter intervals estimated from historical data that may no longer reflect current market conditions can introduce outdated constraints, ultimately diminishing the relevance and effectiveness of the strategy.
Table 8: Testing performance (entropic loss on REAL dataset)
Method
AAPL
AMZN
BRK-B
GOOGL
MSFT
Clean training on FIX
0.2920
0.2971
0.1993
0.2608
0.3269
Clean training on ROBUST
0.3053
0.3005
0.2410
0.3797
0.2692
Adversarial training on FIX
0.2517
0.2408
0.1692
0.2401
0.1891
Adversarial training on ROBUST
0.3077
0.3148
0.2437
0.3965
0.2776
Finally, we complement that analysis by reporting the performance on the FIX and ROBUST datasets in Tables and [0] respectively. Similar to Black-Scholes and Heston model, neural networks are independently trained on subsets of size N, and we compute the average performance on the test set. For each adversarial training result, the hyperparameters, including the attack radius å and the balance weight a, are selected using a validation set of size N.
When models are trained and evaluated on the FIX dataset, we observe trends consistent with those seen the Black-Scholes and Heston experiments: adversarial training consistently outperforms clean training, with the advantage especially pronounced when the sample size is small, suggesting particular effectiveness in data-scarce regimes. The ROBUST dataset, which generalizes the FIX dataset by incorporating model misspecification, further highlights the benefits of adversarial train- str-ttrategies trained adversarially on FIX significantly outperform their clean-traie taanttrained counterparts, demonstrating enhanced robustness to distributional shifts. When models are trained directly on the ROBUST dataset, the pattern becomes more nuanced: performance does not always improve with larger sample sizes, yet adversarial training still generally provides performance edge. Together, these results underscore the practical value of adversarial training in improving generalization under complex and uncertain market conditions.
F Extension to other models
we introduced distributional adversarial attack algorithms specifically for the Black- Scholes model, with input S, and the Heston model, with input I (S), v). In this section, we generalize these approaches an arbitrary model characterized by input trajectories I (I'...., Id).
In Section 3
We begin by defining distance measure on the general input space
i
(A: max 11 -;:)"' E(,
(F.I)
analogous to the distance measure introduced for the Heston model in (4.8). This definition allows distinct perturbation scales for each trajectory, consistent with the Heston model framework.
31

---

Table 9: Performance comparison on FIX dataset
Company
Method
N=5000
10000
20000
50000
100000
Trained on FIX dataset
Adversarial
0.1737
0.1752
0.1706
0. 1667
0.1643
AAPL
Clean
0.1960
0.1943
0.1782
0.1734
0.1745
Improvement
0.0223
0.0191
0.0076
0.0067
0.0101
Adversarial
0.1927
0.1785
0,1763
0.1753
0.1737
AMZN
Clean
0.2401
0.1970
0.1867
0.1782
0.1770
Improvement
0.0474
0.0185
0.0104
0.0029
0.0033
Adversarial
0.1412
0.1368
0.1353
0.1353
0.1352
BRK-B
Clean
0.1867
0.1649
0.1523
0. 14048
0.1363
Improvement
0.0455
0.0281
0.0169
0.0055
0.0011
Adversarial
0.2258
0.2025
0.1985
0.1981
0.1976
GOOGL
Clean
0.2955
0.2224
0.2065
0.2005
0.1984
Improvement
0.0696
0.0199
0.0080
0.0023
0.0008
Adversarial
0,1549
0.1491
0.1431
0.1436
0.1418
MSFT
Clean
0.1878
0.1789
0.1551
0.1479
0.1473
Improvement
0.0329
0.0298
0.0120
0.0043
0.0055
Utilizing Corollary
2.22
direct generalization of Corollary 4.2
the update rule for each scaled
trajectory given by:
X = 8- sign(
ghll
9n
(F.2)
A
which closely parallels the update step for the complete sample set
i, In + 5 (1(g))))lggg)))
(F.3
Furthermore, the total distance Σ d(I, i and the term TP used during the iterative update process can naturally be decomposed into sums across both trajectory dimensions (i = 1,..., d) and individual samples (n I.)...N..
Consequently, similar to the approach the Heston model, each trajectory will be independently perturbed according to -orm metric, effectively transforming the original set of samples into structured set of scaled trajectories (AT mJ
I...dd
32

---

Table 10: Performance comparison on ROBUST dataset
Company
Method
N=5000
10000
20000
50000
100000
Trained on FIX dataser
Adversarial
0.4346
0.5023
0,4748
0.4404
0,4490
AAPL
Clean
0.4387
0.5354
0,5679
0.5328
0.4831
Improvement
0.0041
0.0331
0.0931
0.0924
0.0341
Adversarial
0.4983
0.5342
0.5875
0.5958
0,5994
AMZN
Clean
0.5859
0.6509
0.6677
0.6743
0.6737
Improvement
0.0876
0.1167
0.0802
0.0785
0.0743
Adversarial
0.5548
0.5330
0.5416
0.4872
0,5029
BRK-B
Clean
0.6408
0.6733
0.6876
0.6441
0,6351
Improvement
0.0860
0.1403
0.1459
0.1569
0.1322
Adversarial
0.5276
0.6236
0.6563
0.6054
0,6055
GOOGL
Clean
0.5378
0.6707
0.6814
0.6775
0.6844
Improvement
0.0102
0.0471
0.0252
0.0721
0.0788
Adversarial
0.5859
0.6357
0.5716
0.5505
0.5678
MSFT
Clean
0.6358
0.6870
0.6993
0.6847
0.7124
Improvement
0.0499
0.0513
0.1276
0.1342
0.1446
Trained on ROBUST dataset
Adversarial
0.3936
0.3607
0.3463
0.3703
0.4325
AAPL
Clean
0.4229
0.3705
0.3699
0.3875
0,4510
Improvement
0.0293
0.0098
0.0237
0.0172
0.0185
Adversarial
0,4276
0.3525
0.2701
0.2401
0.2470
AMZN
Clean
0.4505
0.3627
0.2633
0.2647
0.3065
Improvement
0.0229
0.0102
-0.0068
0.0246
0.0595
Adversarial
0.3702
0.2849
0.1912
0.2123
0.2467
BRK-B
Clean
0.4117
0.3618
0.2265
0.1800
0.3076
Improvement
0.0415
0.0769
0.0354
-0.0323
0.0609
Adversarial
0.3748
0.2584
0.1434
0.0985
0.1427
GOOGL
Clean
0,4222
0.3351
0.2100
0.7276
0.2207
Improvement
0.0474
0.0766
0.0667
0.0291
0.0780
Adversarial
0.3885
0,2800
0.1945
0.2170
0.2399
MSFT
Clean
0.4115
0.3473
0.2535
0.2674
0.2944
Improvement
0.0230
0.0673
0.0590
0.0504
0.0544
33


Reviews:
[{"review_id": "i7YJ35epfC", "reviewer": "Reviewer_RmzV", "summary": "This paper investigates the robustness of deep hedging strategies, a data-driven approach for hedging financial derivatives. The authors first demonstrate that standard deep hedging models are highly susceptible to small adversarial perturbations in the underlying data distribution, which can lead to significant performance degradation. To address this vulnerability, the paper proposes a novel adversarial training framework specifically designed for deep hedging.\nThe core of their contribution is framing the problem within Distributionally Robust Optimization (DRO). They formulate a min-max optimization problem where a hedging agent minimizes a risk measure while an adversary searches for the worst-case distribution within a Wasserstein ball around the nominal data distribution. Since this problem is computationally intractable, the authors derive a tractable approximation by reformulating the search for the worst-case distribution as a direct perturbation of the empirical data samples. Based on this reformulation, they develop two practical algorithms, Wasserstein Projection Gradient Descent (WPGD) and Wasserstein Budget Projection Gradient Descent (WBPGD), to generate these adversarial distributions.\nThrough extensive experiments on the Heston model, the authors show that their adversarially trained strategies are not only more resilient to these attacks but also achieve substantially better out-of-sample and out-of-distribution performance, especially when the training dataset is small.", "questions": "Refer to the section on weaknesses. I seek an interactive dialogue with authors during the rebuttal phase. If the concerns outlined in the weaknesses section are addressed thoroughly, I am willing to consider raising my score.", "limitations": "Yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 2, "originality": 2, "strengths_and_weaknesses": "**Strengths:**\n\nThe paper addresses a critical and practical problem: the robustness of deep hedging strategies to model misspecification. While deep hedging has gained popularity, its performance relies heavily on the quality of the training data. This work is the first to systematically unify distributional adversarial training with the deep hedging framework, providing a principled method to enhance robustness against uncertainties in financial markets. The authors ground their approach in the well-established theory of Distributionally Robust Optimization (DRO). The key theoretical contribution is the computationally tractable reformulation of the adversarial optimization problem over a Wasserstein ball. By leveraging sensitivity analysis results and connecting them to the deep hedging problem, they provide a practical and theoretically justified algorithm for a problem that is otherwise intractable due to the non-convexity of the neural network loss function.\n\nThe experimental validation is comprehensive and well-designed. The authors first clearly establish the problem by showing that standard deep hedging strategies are indeed vulnerable to their proposed attacks, with performance degrading significantly under minor, statistically plausible perturbations. The results on adversarial training are particularly strong. The finding that robust training significantly improves out-of-sample and out-of-distribution performance, especially in low-data regimes (e.g., a 54% lower mean hedging loss with N=5,000 samples), is a powerful demonstration of the method's practical benefit. This suggests the method acts as an effective regularizer.\nThe evaluation on an out-of-distribution dataset generated with perturbed model parameters further strengthens the claim of generalizability and robustness.\n\n**Weaknesses:**\n\nWhile the paper is strong, there are a few areas where it could be improved or that merit further discussion. The core of the proposed method relies on approximating the infinite-dimensional Wasserstein DRO problem with a finite-dimensional optimization over the empirical samples (Equation 3.14). This approximation is shown to be accurate for an infinitesimally small perturbation radius\n δ (as δ → 0). However, the experiments use finite, non-trivial values for\n δ (up to 0.5). A discussion on the tightness of this approximation for the radii used in the experiments would strengthen the paper's claims. While the empirical results are strong, it is unclear how much performance is left on the table compared to solving the true (but intractable) DRO problem. The authors rightly identify the sensitivity to the choice of the Wasserstein radius δ as a limitation. This is a crucial practical point. The paper presents results for adversarially trained models with\n δ=0.01 and δ=0.1 but does not detail how these values were chosen. A sensitivity analysis or discussion on a principled method for selecting\n δ (e.g., via a validation set) would significantly increase the practical value of this work. The results in Table 3 clearly show the trade-off between nominal performance and robustness, and more guidance on navigating this trade-off would be beneficial. The paper is motivated by the general problem of \"model misspecification\" and \"distributional shifts\". The proposed adversarial training provides robustness against a specific, worst-case perturbation within a Wasserstein ball. While powerful, this may not cover all types of realistic distribution shifts in financial markets, such as sudden regime changes or structural breaks that might alter the underlying data-generating process in ways not well-captured by a Wasserstein neighborhood. Acknowledging this limitation and contextualizing the specific nature of the robustness achieved would be helpful.", "was_revised": true, "final_justification": "The exploration of adversarial robustness within the realm of financial engineering is particularly noteworthy. Consequently, I shall strive to enhance my score.  (border acceptance)\n\nHowever, I do not consider the paper to be strong enough to be accepted to the NIPS conference.", "rebuttal": "Dear reviewer,\n\nThank you for your time and effort in reviewing our paper and for your fruitful suggestions. \n\nTo start with, we would like to share 2 new experiments conducted after our submission. \n\n**Experiment 1: GAD process with real-market data**\n\nIn the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P\\&L(eq2.2) below.\n\n| Method| Dataset | AAPL| AMZN| BRK-B| GOOGL| MSFT|\n|-|-|-|-|-|-|-|\n| Clean| FIX| -2.261  | -0.981  | -2.086  | -1.275  | -4.341  |\n| Clean| ROB| -0.830  | -0.849  | -0.281  | 0.026   | -0.223  |\n| Adv  | FIX| **-0.579**  | **-0.291**  | **-0.127**  | -0.459  | -0.564  |\n| Adv  | ROB| -0.739  | -0.860  | -0.294  | **0.199**  | **-0.144**  |\n\nThe results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.\n\nThis setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.\n\n**Experiment 2: Heston model with transaction cost**\n\nIn addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.\n\n| N      | clean  | S-attack | SV-attack |\n|-|-|-|-|\n| 5000   | 2.8441 | 2.8237   | 2.8249    |\n| 10000  | 2.7993 | 2.7919   | 2.7929    |\n| 20000  | 2.7606 | 2.7510   | 2.7511    |\n| 50000  | 2.6419 | 2.6064   | 2.6137    |\n| 100000 | 2.4719 | 2.3869   | 2.3880    |\n\nNext, we would like to address your comments one by one.\n\n**Weaknesses**\n>... However, the experiments use finite, non-trivial values for δ (up to 0.5). A discussion on the tightness of this approximation for the radii used in the experiments would strengthen the paper's claims. While the empirical results are strong, it is unclear how much performance is left on the table compared to solving the true (but intractable) DRO problem...\n\nAs discussed in Equation 3.13, the proposed algorithm is a tractable approximation of the infinite-dimensional Wasserstein DRO problem and recovers the true objective up to\no(δ) as δ→0. This theoretical guarantee provides a first-order justification for our formulation.\n\nWe acknowledge, however, that in practice we use finite (and sometimes moderately large) values of δ, and the approximation error for such values is not explicitly characterized. Although we do not provide a formal characterization of the approximation error at finite radii, the empirical results suggest that the method remains effective. Quantifying the tightness of the approximation for finite δ is indeed an important question, and we agree that further theoretical or empirical analysis of this aspect could strengthen the robustness guarantees of the method. We consider this a promising direction for future research.\n\n>The paper presents results for adversarially trained models with δ=0.01 and δ=0.1 but does not detail how these values were chosen. A sensitivity analysis or discussion on a principled method for selecting δ (e.g., via a validation set) would significantly increase the practical value of this work. The results in Table 3 clearly show the trade-off between nominal performance and robustness, and more guidance on navigating this trade-off would be beneficial.\n\nWe would first like to clarify that our approach to hyperparameter selection, including the choice of the Wasserstein radius δ, is described in Appendix D. For experiments on simulated data, we perform a grid search over a range of values and select the configuration that performs best on a held-out validation set.\n\nRegarding Table 3, we believe there may have been a misunderstanding. This table is not intended to evaluate the out-of-sample performance of the trained strategies with optimized hyperparameters, but rather to illustrate how different strategies respond to adversarial attacks of increasing strength. The losses shown are evaluated on the training data, and the columns represent the magnitude of the adversarial perturbation applied at test time (not the training δ). As expected, the loss increases with larger perturbations across all models. \n\nIn this table, we compare three strategies: clean training, adversarial training with δ = 0.01, and adversarial training with δ = 0.1. These values are not the result of hyperparameter optimization but are representative runs chosen to illustrate the trade-off between nominal performance and robustness, as discussed in Section 5.3.\n\n>... While powerful, this may not cover all types of realistic distribution shifts in financial markets, such as sudden regime changes or structural breaks that might alter the underlying data-generating process in ways not well-captured by a Wasserstein neighborhood.\n\nWhile our primary experiments are based on simulated data using well-established models such as Black-Scholes and Heston, we agree that evaluation on real-world data is essential for assessing practical relevance. To this end, we have included an additional experiment (see **Experiment 1** from above) using historical market data, as introduced earlier. This setting captures both the distributional shift induced by market volatility and the discrepancy between the assumed model dynamics and real-world behavior, offering a meaningful test of robustness. We believe this experiment complements the synthetic benchmarks and reinforces the method’s applicability in real financial environments.\n\nWe acknowledge that robustness within a Wasserstein ball addresses a specific form of local distributional shift and may not fully capture all types of structural changes or regime shifts observed in financial markets. As discussed in the last paragraph of the main text, exploring alternative ambiguity set geometries or hybrid formulations that better account for global distributional changes is indeed a promising direction for future research.\n\n**Question**\n\n>Refer to the section on weaknesses. I seek an interactive dialogue with authors during the rebuttal phase.\n\nWe sincerely appreciate the reviewer’s openness to discussion and willingness to reconsider the score. We have carefully addressed the concerns outlined in the weaknesses section in our detailed responses and welcome any further questions or clarifications during the rebuttal phase."}, {"review_id": "a1wdYxi2J5", "reviewer": "Reviewer_P7ou", "summary": "This paper tackles \"robust deep hedging\" under realistic market uncertainties by utilizing the concept of adversarial robustness. The authors build on the idea of distributional shift by designing Wasserstein-based adversarial attacks in the distributional space, and propose an adversarial training framework that aims to enhance the robustness of hedging strategies.", "questions": "While the authors simulate OOD settings via controlled distributional shifts (e.g., Figure 1), I wonder whether real-world market uncertainty—such as the COVID-19 crisis or post-2008 volatility—could be used as a more realistic evaluation. For example, training on pre-crisis data and testing on crisis-period data could provide further insight into the robustness of the proposed method under naturally occurring distribution shifts.", "limitations": "See weakness and questions.", "rating": 4, "confidence": 1, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "## Strength\n\n- It is highly interesting how the concept of adverarial training can be utilized in the practical setting.\n- The proposed method is based on distributional attack, which is more general than point-wise perturbation and more relevant to real-world risk\n\n## Weakness.\n\n-The number of experiments is limited, and the evaluation seems insufficient to verify the practical applicability of the proposed method.\n\n- It is unclear how well the OOD experiment in Figure 1 reflects real-world financial data. The data seems to be generated based on simple randomness from a uniform distribution, which may not be sufficient to represent realistic market uncertainties.\n\n-  Figure 3 (In the appendix) shows that when the number of training samples is sufficiently large, there is little to no performance gap between robust training and clean training. This suggests that the benefit of robust training mainly appears in low-data regimes. Therefore, it raises questions about the practical effectiveness of the proposed method when ample training data is available.\n\n## Comments.\n\n- As I have limited domain knowledge in finance, I would like to carefully consider the opinions of other reviewers.\n\n- The idea of applying the concept of adversarial robustness to financial engineering is highly interesting.", "was_revised": true, "final_justification": "See comments. I keep my rating.", "rebuttal": "Dear reviewer,\n\nThank you for your time and effort in reviewing our paper and for your fruitful suggestions. \n\nTo start with, we would like to share 2 new experiments conducted after our submission. \n\n**Experiment 1: GAD process with real-market data**\n\nIn the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P\\&L(eq2.2) below.\n\n| Method| Dataset | AAPL| AMZN| BRK-B| GOOGL| MSFT|\n|-|-|-|-|-|-|-|\n| Clean| FIX| -2.261  | -0.981  | -2.086  | -1.275  | -4.341  |\n| Clean| ROB| -0.830  | -0.849  | -0.281  | 0.026   | -0.223  |\n| Adv  | FIX| **-0.579**  | **-0.291**  | **-0.127**  | -0.459  | -0.564  |\n| Adv  | ROB| -0.739  | -0.860  | -0.294  | **0.199**  | **-0.144**  |\n\nThe results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.\n\nThis setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.\n\n**Experiment 2: Heston model with transaction cost**\n\nIn addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.\n\n| N      | clean  | S-attack | SV-attack |\n|-|-|-|-|\n| 5000   | 2.8441 | 2.8237   | 2.8249    |\n| 10000  | 2.7993 | 2.7919   | 2.7929    |\n| 20000  | 2.7606 | 2.7510   | 2.7511    |\n| 50000  | 2.6419 | 2.6064   | 2.6137    |\n| 100000 | 2.4719 | 2.3869   | 2.3880    |\n\nNext, we would like to address your comments one by one.\n\n**Weakness**\n\n> The number of experiments is limited...\n\nWe acknowledge that the original submission primarily focused on synthetic experiments, which limited the scope of practical evaluation. To address this concern, we conducted additional experiments after submission, including both real-world market data and more complex hedging scenarios. These new results, as introduced in our text above, provide a broader evaluation of our method and could address the concerns in the following points.\n\n>It is unclear how well the OOD experiment in Figure 1 reflects real-world financial data...\n\nThe OOD setting in Figure 1 was designed to highlight the robustness properties of the proposed strategy under distributional shifts, though it may not fully capture the complexity of real financial markets. To address this limitation, we conducted an additional experiment using historical market data as introduced in **Experiment 1**. This naturally introduces realistic and substantial distribution shifts. The results confirm that our method remains effective under real-world market uncertainty, reinforcing its practical relevance.\n\n>...when the number of training samples is sufficiently large, there is little to no performance gap between robust training and clean training...\n\nSuch an observation is reasonable and consistent with our findings when the underlying model is relatively simple. In these cases, we observe that the performance of clean strategies plateaus as the sample size increases, indicating that the empirical distribution with 100,000 samples closely approximates the true distribution, thereby reducing the observed benefit of robust training. In the second experiment introduced above, we incorporated transaction costs into the hedging problem, adding nonlinearity and increasing the overall complexity. Under this more realistic setting, we observe that performance no longer plateaus as the sample size increases, and adversarial training continues to outperform clean training even with 100,000 samples. This suggests that the advantage of robust training is not limited to low-data regimes but also extends to more complex or imperfectly specified environments, where model uncertainty remains significant despite the availability of large training datasets.\n\n**Question**\n\n>...whether real-world market uncertainty—such as the COVID-19 crisis or post-2008 volatility—could be used as a more realistic evaluation. For example, training on pre-crisis data and testing on crisis-period data...\n\nThe additional **Experiment 1** directly addresses this question by training on pre-COVID historical data and testing on real market data from March 2020. In this case, adversarially trained strategies continue to outperform standard training."}, {"review_id": "geIdjLX9BK", "reviewer": "Reviewer_CwkA", "summary": "This paper investigates the robustness of deep hedging strategies against distributional shifts by developing adversarial attacks and training methods. It demonstrates that classical deep hedging models are vulnerable to small perturbations in the input distribution, leading to significant performance degradation. It uses pointwise adversarial attacks to the distributional setting using Wasserstein balls. The approach includes two novel algorithms (WPGD and WBPGD) for generating adversarial distributions and shows empirical improvements in out-of-sample and out-of-distribution performance on Black-Scholes and Heston models.", "questions": "1. How do the proposed algorithms scale with the number of time steps T and the dimensionality of the input space? What are the computational complexity bounds?\n2. How should practitioners choose the Wasserstein radius in real applications? Is there a principled way to select this parameter based on market characteristics?\n3. How sensitive are the results to the choice of neural network architecture? Would the conclusions hold for more modern architectures (e.g., transformers, LSTMs)?\n4. Do adversarial examples generated against one hedging model transfer to other models? This would have implications for robustness evaluation.", "limitations": "While the paper seems interesting, my concern is that the paper focus on a niche area (ML-quantitative finance). The impact of the work for ML community may not be significant.", "rating": 3, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "# Strengths\n\n- The paper seems to be novel in the sense of systematically applying distributional adversarial attacks to deep hedging.\n- The paper provides theoretical grounding by extending sensitivity analysis results from Wasserstein DRO to the deep hedging setting.\n- The proposed algorithms (WPGD/WBPGD) offer computationally efficient approximations to the theoretically intractable Wasserstein DRO problem through clever reformulations.\n\n# Weaknesses\n\n- The evaluation is restricted to only two classical financial models (Black-Scholes and Heston). More complex or realistic market models would strengthen the claims.\n- All experiments use simulated data from parametric models. Validation on real market data would be more convincing for practical applications.\n- While the paper claims computational tractability, there's insufficient analysis of the computational cost compared to standard deep hedging, especially for large-scale problems.", "was_revised": false, "final_justification": "", "rebuttal": "Dear reviewer,\n\nThank you for your time and effort in reviewing our paper and for your fruitful suggestions. \n\nTo start with, we would like to share 2 new experiments conducted after our submission. \n\n**Experiment 1: GAD process with real-market data**\n\nIn the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P\\&L(eq2.2) below.\n\n| Method| Dataset | AAPL| AMZN| BRK-B| GOOGL| MSFT|\n|-|-|-|-|-|-|-|\n| Clean| FIX| -2.261  | -0.981  | -2.086  | -1.275  | -4.341  |\n| Clean| ROB| -0.830  | -0.849  | -0.281  | 0.026   | -0.223  |\n| Adv  | FIX| **-0.579**  | **-0.291**  | **-0.127**  | -0.459  | -0.564  |\n| Adv  | ROB| -0.739  | -0.860  | -0.294  | **0.199**  | **-0.144**  |\n\nThe results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.\n\nThis setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.\n\n**Experiment 2: Heston model with transaction cost**\n\nIn addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.\n\n| N      | clean  | S-attack | SV-attack |\n|-|-|-|-|\n| 5000   | 2.8441 | 2.8237   | 2.8249    |\n| 10000  | 2.7993 | 2.7919   | 2.7929    |\n| 20000  | 2.7606 | 2.7510   | 2.7511    |\n| 50000  | 2.6419 | 2.6064   | 2.6137    |\n| 100000 | 2.4719 | 2.3869   | 2.3880    |\n\nNext, we would like to address your comments one by one.\n\n**Weakness 1**\n\nWe selected the Black-Scholes and Heston models to establish a clear and interpretable benchmark aligned with prior work in the deep hedging literature. We conducted additional experiments after submission, including both real-world market data and more complex hedging scenarios.\n\n**Weakness 2**\n\nAs described at the start, **Experiment 1** directly addresses this question by training on pre-COVID historical data and evaluating on real market data from March 2020, hence capturing realistic distribution shifts.\n\n**Weakness 3**\n\nWe appreciate the reviewer’s concern regarding computational cost. Details on training time and hardware setup are provided in Appendix D. In summary, adversarial training is approximately 10 times more computationally demanding than standard deep hedging, due to the additional inner optimization steps during the adversarial attacks required at each update. While this increase is notable, we believe it is acceptable given the intended use case. Deep hedging is typically applied in risk management settings where models are trained offline, and hedging decisions are executed in real time using a relatively small network. Importantly, the execution time of a trained strategy is comparable regardless of whether it was trained adversarially or classically. Nevertheless, we recognize that improving training efficiency for large-scale or high-frequency retraining scenarios remains a valuable direction for future research.\n\n**Questions 1**\n\nTo the best of our knowledge, formal computational complexity bounds are not available even for classical deep hedging, and deriving such bounds remains an open problem in the literature. As a result, scalability is typically assessed through empirical performance.\n\nTo illustrate this, we report the average training time per epoch (in seconds) under varying sequence length T and input dimensions using the Black-Scholes model:\n\nClean Training \n| Input Dim | T = 30 | T = 60 | T = 90 |\n|-|-|-| -|\n| 1             | 0.683  | 0.9968 | 1.4033  |\n| 2             | 0.6769 | 1.0883 | 1.4580   |\n| 4             | 0.6825 | 1.0753 | 1.4703  |\n\nAdversarial Training\n| Input Dim | T = 30 | T = 60  | T = 90 |\n|-|-|-| -|\n| 1             | 6.7717 | 11.5758 | 17.1915 |\n| 2             | 6.513  | 12.1548 | 16.9313 |\n| 4             | 6.2556 | 11.5872 | 17.0486 |\n\nThese results indicate that the runtime for training scales reasonably with increasing sequence length T for both clean and adversarial training. In our experiments, the input dimension does not affect the runtime, likely due to the underlying GPU architecture utilizing efficient tensor operation parallelization techniques.\n\n**Questions 2**\n\nIn our experiments on simulated data, we performed a grid search over a range of hyperparameter values, including the Wasserstein radius, and selected parameters based on validation performance. However, in the real market experiment introduced above, we did not have access to a dedicated validation set. Instead, we report results averaged over a fixed set of hyperparameter configurations, which helps avoid post-selection bias.\n\nIn general, selecting the Wasserstein radius in distributionally robust optimization (DRO) is a well-known challenge and remains an open research problem. To our knowledge, there is no widely accepted principled method for determining this parameter based solely on observable market characteristics (see, e.g., [13]). As shown in Table 4, we do not observe a consistent pattern in the optimal radius across different models, though there is a general trend that overly large radii may degrade performance. Developing a principled selection procedure through statistical uncertainty or market volatility is a valuable direction for future work.\n\n**Questions 3**\n\nIn this work, we adopt a standard RNN-based architecture, which is widely used in the deep hedging literature and aligns naturally with the sequential structure of hedging problems. Our empirical results suggest that this architecture is sufficient to capture the relevant temporal dependencies and deliver strong performance in the settings considered.\n\nWhile it would certainly be interesting to explore more modern architectures such as LSTMs or transformers—particularly in higher-dimensional or more complex market environments—doing so would introduce additional considerations related to model capacity, regularization, and hyperparameter tuning. These aspects, while important, are somewhat beyond the main focus of this work. As our primary goal is to investigate robustness under distributional shifts, we believe the key conclusions can be expected to generalize to other architectures.\n\n**Questions 4**\n\nIn our current work, we focus on generating adversarial perturbations tailored to the model being trained, and do not evaluate whether these perturbations also degrade the performance of other independently trained models. This is an intriguing direction, and investigating the transferability of adversarial examples in the hedging context could indeed offer valuable insights into the nature of distributional vulnerabilities and robustness. We see this as an interesting avenue for future research.\n\n**Limitation**\n\nWe thank the reviewer for finding our work interesting. While we agree that the paper primarily addresses questions relevant to quantitative finance, the methods and techniques we develop are not limited to that domain. More broadly, our work contributes to the field of robust decision-making based on time-series data, particularly in low-data regimes. This class of problems is rich and general, encompassing stochastic control problems that arise prominently in engineering (e.g., robotics), systems biology, and economics, among other areas.\n\nThe distributionally robust optimization (DRO) framework we employ to model adversarial robustness has gained significant attention in the machine learning community over the past decade. However, most existing DRO approaches are confined to the i.i.d. setting and assume access to large amounts of data—for instance, in image classification tasks. In contrast, our work addresses the largely unexplored regime of time-series data with limited training samples. From this broader perspective, we demonstrate that DRO-based modeling can yield substantial performance improvements in such settings."}, {"review_id": "TzaYYphPNU", "reviewer": "Reviewer_sQgP", "summary": "This paper investigates the robustness of classical deep hedging strategies under distributional shifts using the concept of adversarial attacks. The authors demonstrate that standard deep hedging models are highly vulnerable to small perturbations in the input distribution, leading to significant performance degradation. To address this, they propose an adversarial training framework tailored to increase the robustness of deep hedging strategies.", "questions": "See Weaknesses. \n\nI think the idea of enhancing robustness through distributional adversarial attacks is innovative and holds potential for practical applications in financial risk management.However, the paper lacks a coherent flow, making it challenging for readers to follow the logical progression of ideas. Additionally,the paper would benefit from a more detailed discussion on the limitations of existing methods and how the proposed approach overcomes these limitations.", "limitations": "N/A", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n\n1. The paper introduces a novel framework that combines distributional adversarial training with deep hedging. This might be the first work to address the robustness of deep hedging strategies under distributional shifts using adversarial training.\n\n2. The paper develops specific algorithms (e.g., Wasserstein Projection Gradient Descent and Wasserstein Budget Projection Gradient Descent) tailored for distributional adversarial attacks in the context of deep hedging. These algorithms are well-designed and computationally efficient.\n\n3. The paper includes extensive numerical experiments that demonstrate the effectiveness of the proposed adversarial training framework. The results show consistent outperformance of adversarially trained strategies over classical methods in terms of out-of-sample and out-of-distribution performance.\n\nWeaknesses:\n\n1. While the paper presents an interesting approach to enhancing the robustness of deep hedging strategies using adversarial training, I have significant concerns regarding the writing and structure of the paper. Specifically, the paper lacks a literature review or related work section, which is crucial for providing context and situating the work within the broader field. This omission makes it difficult for AI conferences and readers, especially those not deeply familiar with the specific domain, to understand the background, the development of the field, and the unique contributions of this work. Additionally, the paper does not include a conclusion section, which is essential for summarizing the findings and highlighting the significance of the research. \n\n2. The experiments primarily rely on simulated data from well-known financial models (e.g., Heston and Black-Scholes). While these models are widely used, they may not fully capture the complexities of real-world financial markets. The paper could benefit from additional experiments using real-world financial data to further validate the robustness and effectiveness of the proposed methods.", "was_revised": true, "final_justification": "Thanks for the authors' responses. The rebuttal has addressed most of my concerns. The quality of the article will be further improved based on the author's current feedback.\n\nAs stated in my initial evaluation, this paper introduces a Wasserstein framework that combines distributional adversarial training with deep hedging. The topic is meaningful and this work might be the first to address the robustness of deep hedging strategies under distributional shifts using adversarial training.\n\nConsidering that the technical contribution outweighs other minor issues (like writing and experiments)，I keep my original positive rating.", "rebuttal": "Dear reviewer,\n\nThank you for your time and effort in reviewing our paper and for your fruitful suggestions. \n\nTo start with, we would like to share 2 new experiments conducted after our submission. \n\n**Experiment 1: GAD process with real-market data**\n\nIn the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P\\&L(eq2.2) below.\n\n| Method| Dataset | AAPL| AMZN| BRK-B| GOOGL| MSFT|\n|-|-|-|-|-|-|-|\n| Clean| FIX| -2.261  | -0.981  | -2.086  | -1.275  | -4.341  |\n| Clean| ROB| -0.830  | -0.849  | -0.281  | 0.026   | -0.223  |\n| Adv  | FIX| **-0.579**  | **-0.291**  | **-0.127**  | -0.459  | -0.564  |\n| Adv  | ROB| -0.739  | -0.860  | -0.294  | **0.199**  | **-0.144**  |\n\nThe results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.\n\nThis setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.\n\n**Experiment 2: Heston model with transaction cost**\n\nIn addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.\n\n| N      | clean  | S-attack | SV-attack |\n|-|-|-|-|\n| 5000   | 2.8441 | 2.8237   | 2.8249    |\n| 10000  | 2.7993 | 2.7919   | 2.7929    |\n| 20000  | 2.7606 | 2.7510   | 2.7511    |\n| 50000  | 2.6419 | 2.6064   | 2.6137    |\n| 100000 | 2.4719 | 2.3869   | 2.3880    |\n\nNext, we would like to address your comments one by one.\n\n**Weakness**\n\n>...the paper lacks a literature review or related work section...the paper does not include a conclusion section.\n\nWe thank the reviewer for this valuable observation. We fully agree that clearly situating our work within the broader literature is important, especially for readers unfamiliar with the intersection of deep hedging and adversarial robustness.\n\nIn Section 1 of our original submission, we integrated a discussion of related works throughout the Introduction (lines 31–36, 54–61) and also included a dedicated \"Further related work\" paragraph at the end of the section. However, we acknowledge that this scattered format may have made it difficult to appreciate the progression and relevance of these works.\n\nTo address this, we have revised the manuscript to include a dedicated and more detailed Related Work section, which systematically:\n\n+ Reviews the evolution of deep hedging from its inception [2] to recent methodological extensions. In particular, we now highlight [11] as a key example of addressing parameter misspecification within the deep hedging framework.\n\n+ Discusses distributionally robust optimization (DRO) frameworks, particularly those based on Wasserstein metrics [13, 17, 18].\n\n+ Connects adversarial training literatures like [19-22] from classical machine learning to the distributional setting in our financial context.\n\nWe believe this revision significantly improves accessibility and contextual clarity for readers from both the finance and AI communities.\n\nMotivated by the reviewer's comment about the missing conclusion, we will add the following conclusion to our revised paper:\n\n*We presented a robust deep hedging framework that leverages adversarial training under Wasserstein ambiguity to address the challenges of model misspecification and distributional shifts. By formulating the distributionally robust optimization problem as a minimax objective and approximating it through a tractable reformulation, we demonstrated how deep hedging strategies can be trained adversarially. Empirical results across a variety of widely used synthetic models and data regimes show that adversarially trained strategies achieve improved out-of-sample and out-of-distribution performance, especially under structural changes or limited data availability. Further experiments on real market data suggest that these strategies also generalize well beyond simulated settings, maintaining robustness in periods of market stress. These findings underscore the practical value of robust training methods in financial environments characterized by uncertainty and instability.*\n\n>The experiments primarily rely on simulated data from well-known financial models (e.g., Heston and Black-Scholes). While these models are widely used, they may not fully capture the complexities of real-world financial markets...\n\nWe agree with the reviewer that real-world evaluation is essential. The added experiment directly addresses this concern. As shown in **Experiment 1**, adversarially trained strategies continue to outperform standard training even under real market conditions. We believe this experiment complements the synthetic benchmarks and provides further evidence of the practical applicability of our approach.\n\n**Question**\n>...the paper lacks a coherent flow...Additionally, the paper would benefit from a more detailed discussion on the limitations of existing methods and how the proposed approach overcomes these limitations.\n\nFollowing your advice in the previous comment, we will add a more detailed Related Work section as well as a Conclusion section (see our proposed conclusion above). In addition, since the final version allows for an extra page, we plan to include two new experiments based on real-world market data. We believe these additions will improve the overall coherence of the paper and help readers follow the logical progression of our contributions more easily.\n\nRegarding the limitations of existing methods, we highlight in Section 5.1 how classical deep hedging strategies are vulnerable to adversarial attacks, underscoring the practical need for improved robustness. We will also include a clearer discussion comparing our approach to [11]. While [11] enhances robustness by modifying the model parametrically, its effectiveness remains highly dependent on the specific parameterization chosen. In contrast, our method focuses on distributional robustness, operating over a Wasserstein ball around the empirical distribution without relying on any parametric model structure. This enables our approach to handle distributional shifts more broadly and provides robustness that is independent of model specification."}]

Author rebuttal:

Meta-review: This paper introduces a distributional adversarial training framework for deep hedging, grounded in Wasserstein DRO. The method is novel, theoretically motivated, and empirically effective, with added experiments on real market data and transaction costs. While some concerns on scope and clarity were raised, the rebuttal addressed them satisfactorily. Overall, this is a solid and timely contribution.
Decision: Accept (poster)