Title: Distributional Adversarial Attacks and Training in Deep Hedging
Venue: NeurIPS 2025
Accepted: yes
Keywords: deep hedging

distributionally robust optimization

adversarial attack

stochastic control

quantitative risk management

quantitative finance
Abstract: In this paper, we study the robustness of classical deep hedging strategies under distributional shifts by leveraging the concept of adversarial attacks. We first demonstrate that standard deep hedging models are highly vulnerable to small perturbations in the input distribution, resulting in significant performance degradation. Motivated by this, we propose an adversarial training framework tailored to increase the robustness of deep hedging strategies. Our approach extends pointwise adversarial attacks to the distributional setting and introduces a computationally tractable reformulation of the adversarial optimization problem over a Wasserstein ball. This enables the efficient training of hedging strategies that are resilient to distributional perturbations. Through extensive numerical experiments, we show that adversarially trained deep hedging strategies consistently outperform their classical counterparts in terms of out-of-sample performance and resilience to model misspecification. Additional results indicate that the robust strategies maintain reliable performance on real market data and remain effective during periods of market change. Our findings establish a practical and effective framework for robust deep hedging under realistic market uncertainties.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the robustness of classical deep hedging strategies under distributional shifts using the concept of adversarial attacks. The authors demonstrate that standard deep hedging models are highly vulnerable to small perturbations in the input distribution, leading to significant performance degradation. To address this, they propose an adversarial training framework tailored to increase the robustness of deep hedging strategies.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. The paper introduces a novel framework that combines distributional adversarial training with deep hedging. This might be the first work to address the robustness of deep hedging strategies under distributional shifts using adversarial training.\n\n2. The paper develops specific algorithms (e.g., Wasserstein Projection Gradient Descent and Wasserstein Budget Projection Gradient Descent) tailored for distributional adversarial attacks in the context of deep hedging. These algorithms are well-designed and computationally efficient.\n\n3. The paper includes extensive numerical experiments that demonstrate the effectiveness of the proposed adversarial training framework. The results show consistent outperformance of adversarially trained strategies over classical methods in terms of out-of-sample and out-of-distribution performance.\n\nWeaknesses:\n\n1. While the paper presents an interesting approach to enhancing the robustness of deep hedging strategies using adversarial training, I have significant concerns regarding the writing and structure of the paper. Specifically, the paper lacks a literature review or related work section, which is crucial for providing context and situating the work within the broader field. This omission makes it difficult for AI conferences and readers, especially those not deeply familiar with the specific domain, to understand the background, the development of the field, and the unique contributions of this work. Additionally, the paper does not include a conclusion section, which is essential for summarizing the findings and highlighting the significance of the research. \n\n2. The experiments primarily rely on simulated data from well-known financial models (e.g., Heston and Black-Scholes). While these models are widely used, they may not fully capture the complexities of real-world financial markets. The paper could benefit from additional experiments using real-world financial data to further validate the robustness and effectiveness of the proposed methods.\n\nQUESTIONS:\nSee Weaknesses. \n\nI think the idea of enhancing robustness through distributional adversarial attacks is innovative and holds potential for practical applications in financial risk management.However, the paper lacks a coherent flow, making it challenging for readers to follow the logical progression of ideas. Additionally,the paper would benefit from a more detailed discussion on the limitations of existing methods and how the proposed approach overcomes these limitations.\n\nLIMITATIONS:\nN/A", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-29"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the robustness of deep hedging strategies against distributional shifts by developing adversarial attacks and training methods. It demonstrates that classical deep hedging models are vulnerable to small perturbations in the input distribution, leading to significant performance degradation. It uses pointwise adversarial attacks to the distributional setting using Wasserstein balls. The approach includes two novel algorithms (WPGD and WBPGD) for generating adversarial distributions and shows empirical improvements in out-of-sample and out-of-distribution performance on Black-Scholes and Heston models.\n\nSTRENGTHS AND WEAKNESSES:\n# Strengths\n\n- The paper seems to be novel in the sense of systematically applying distributional adversarial attacks to deep hedging.\n- The paper provides theoretical grounding by extending sensitivity analysis results from Wasserstein DRO to the deep hedging setting.\n- The proposed algorithms (WPGD/WBPGD) offer computationally efficient approximations to the theoretically intractable Wasserstein DRO problem through clever reformulations.\n\n# Weaknesses\n\n- The evaluation is restricted to only two classical financial models (Black-Scholes and Heston). More complex or realistic market models would strengthen the claims.\n- All experiments use simulated data from parametric models. Validation on real market data would be more convincing for practical applications.\n- While the paper claims computational tractability, there's insufficient analysis of the computational cost compared to standard deep hedging, especially for large-scale problems.\n\nQUESTIONS:\n1. How do the proposed algorithms scale with the number of time steps T and the dimensionality of the input space? What are the computational complexity bounds?\n2. How should practitioners choose the Wasserstein radius in real applications? Is there a principled way to select this parameter based on market characteristics?\n3. How sensitive are the results to the choice of neural network architecture? Would the conclusions hold for more modern architectures (e.g., transformers, LSTMs)?\n4. Do adversarial examples generated against one hedging model transfer to other models? This would have implications for robustness evaluation.\n\nLIMITATIONS:\nWhile the paper seems interesting, my concern is that the paper focus on a niche area (ML-quantitative finance). The impact of the work for ML community may not be significant.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-01"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper tackles \"robust deep hedging\" under realistic market uncertainties by utilizing the concept of adversarial robustness. The authors build on the idea of distributional shift by designing Wasserstein-based adversarial attacks in the distributional space, and propose an adversarial training framework that aims to enhance the robustness of hedging strategies.\n\nSTRENGTHS AND WEAKNESSES:\n## Strength\n\n- It is highly interesting how the concept of adverarial training can be utilized in the practical setting.\n- The proposed method is based on distributional attack, which is more general than point-wise perturbation and more relevant to real-world risk\n\n## Weakness.\n\n-The number of experiments is limited, and the evaluation seems insufficient to verify the practical applicability of the proposed method.\n\n- It is unclear how well the OOD experiment in Figure 1 reflects real-world financial data. The data seems to be generated based on simple randomness from a uniform distribution, which may not be sufficient to represent realistic market uncertainties.\n\n-  Figure 3 (In the appendix) shows that when the number of training samples is sufficiently large, there is little to no performance gap between robust training and clean training. This suggests that the benefit of robust training mainly appears in low-data regimes. Therefore, it raises questions about the practical effectiveness of the proposed method when ample training data is available.\n\n## Comments.\n\n- As I have limited domain knowledge in finance, I would like to carefully consider the opinions of other reviewers.\n\n- The idea of applying the concept of adversarial robustness to financial engineering is highly interesting.\n\nQUESTIONS:\nWhile the authors simulate OOD settings via controlled distributional shifts (e.g., Figure 1), I wonder whether real-world market uncertainty—such as the COVID-19 crisis or post-2008 volatility—could be used as a more realistic evaluation. For example, training on pre-crisis data and testing on crisis-period data could provide further insight into the robustness of the proposed method under naturally occurring distribution shifts.\n\nLIMITATIONS:\nSee weakness and questions.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 1, "CLARITY": 2, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper investigates the robustness of deep hedging strategies, a data-driven approach for hedging financial derivatives. The authors first demonstrate that standard deep hedging models are highly susceptible to small adversarial perturbations in the underlying data distribution, which can lead to significant performance degradation. To address this vulnerability, the paper proposes a novel adversarial training framework specifically designed for deep hedging.\nThe core of their contribution is framing the problem within Distributionally Robust Optimization (DRO). They formulate a min-max optimization problem where a hedging agent minimizes a risk measure while an adversary searches for the worst-case distribution within a Wasserstein ball around the nominal data distribution. Since this problem is computationally intractable, the authors derive a tractable approximation by reformulating the search for the worst-case distribution as a direct perturbation of the empirical data samples. Based on this reformulation, they develop two practical algorithms, Wasserstein Projection Gradient Descent (WPGD) and Wasserstein Budget Projection Gradient Descent (WBPGD), to generate these adversarial distributions.\nThrough extensive experiments on the Heston model, the authors show that their adversarially trained strategies are not only more resilient to these attacks but also achieve substantially better out-of-sample and out-of-distribution performance, especially when the training dataset is small.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**\n\nThe paper addresses a critical and practical problem: the robustness of deep hedging strategies to model misspecification. While deep hedging has gained popularity, its performance relies heavily on the quality of the training data. This work is the first to systematically unify distributional adversarial training with the deep hedging framework, providing a principled method to enhance robustness against uncertainties in financial markets. The authors ground their approach in the well-established theory of Distributionally Robust Optimization (DRO). The key theoretical contribution is the computationally tractable reformulation of the adversarial optimization problem over a Wasserstein ball. By leveraging sensitivity analysis results and connecting them to the deep hedging problem, they provide a practical and theoretically justified algorithm for a problem that is otherwise intractable due to the non-convexity of the neural network loss function.\n\nThe experimental validation is comprehensive and well-designed. The authors first clearly establish the problem by showing that standard deep hedging strategies are indeed vulnerable to their proposed attacks, with performance degrading significantly under minor, statistically plausible perturbations. The results on adversarial training are particularly strong. The finding that robust training significantly improves out-of-sample and out-of-distribution performance, especially in low-data regimes (e.g., a 54% lower mean hedging loss with N=5,000 samples), is a powerful demonstration of the method's practical benefit. This suggests the method acts as an effective regularizer.\nThe evaluation on an out-of-distribution dataset generated with perturbed model parameters further strengthens the claim of generalizability and robustness.\n\n**Weaknesses:**\n\nWhile the paper is strong, there are a few areas where it could be improved or that merit further discussion. The core of the proposed method relies on approximating the infinite-dimensional Wasserstein DRO problem with a finite-dimensional optimization over the empirical samples (Equation 3.14). This approximation is shown to be accurate for an infinitesimally small perturbation radius\n δ (as δ → 0). However, the experiments use finite, non-trivial values for\n δ (up to 0.5). A discussion on the tightness of this approximation for the radii used in the experiments would strengthen the paper's claims. While the empirical results are strong, it is unclear how much performance is left on the table compared to solving the true (but intractable) DRO problem. The authors rightly identify the sensitivity to the choice of the Wasserstein radius δ as a limitation. This is a crucial practical point. The paper presents results for adversarially trained models with\n δ=0.01 and δ=0.1 but does not detail how these values were chosen. A sensitivity analysis or discussion on a principled method for selecting\n δ (e.g., via a validation set) would significantly increase the practical value of this work. The results in Table 3 clearly show the trade-off between nominal performance and robustness, and more guidance on navigating this trade-off would be beneficial. The paper is motivated by the general problem of \"model misspecification\" and \"distributional shifts\". The proposed adversarial training provides robustness against a specific, worst-case perturbation within a Wasserstein ball. While powerful, this may not cover all types of realistic distribution shifts in financial markets, such as sudden regime changes or structural breaks that might alter the underlying data-generating process in ways not well-captured by a Wasserstein neighborhood. Acknowledging this limitation and contextualizing the specific nature of the robustness achieved would be helpful.\n\nQUESTIONS:\nRefer to the section on weaknesses. I seek an interactive dialogue with authors during the rebuttal phase. If the concerns outlined in the weaknesses section are addressed thoroughly, I am willing to consider raising my score.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-07-03"}