Adversarial Stress Evaluation

For five lessons this course has hammered a single idea: in markets, someone is on the other side of your trade, and they are not rooting for you. You learned that markets are adversarial (lesson 1), that a few basis points of engineered noise can flip a position (adversarial examples, lesson 2), that your training data and your model itself are attack surfaces (poisoning and extraction, lesson 3), and that a live model drifts out from under its own assumptions (lesson 4).

This is the capstone, and it turns the knife on the one thing you’ve been quietly trusting the whole time: your own evaluation. Because here is the uncomfortable truth — if the world is adversarial, then the test must be adversarial too. An i.i.d. test set is graded by Nature, who is indifferent. A deployed strategy is graded by an opponent, who picks the worst case on purpose. Score yourself against the indifferent referee and you will pass; the hostile referee is the one who actually settles your P&L.

And there’s a second twist that makes this the hardest lesson to be honest in: a robustness claim is even easier to fake than an alpha claim. You already know alpha inflates with the number of backtests you ran (the deflated Sharpe). Robustness inflates the same way — except the knob you cheat with is the strength of the adversary you chose to test against, and you have every incentive to choose a weakling. This lesson is about keeping score honestly when every instinct, and every incentive, pushes you to lie to yourself.

Why i.i.d. test accuracy is the wrong scorecard

Analogy. Imagine certifying a bridge by driving the average car across it a thousand times. It passes beautifully. Then a freight company — who read your spec sheet — sends a truck loaded to the exact weight that maximizes stress on the one weak girder. Nature sends you average cars. An adversary sends you the truck. The honest load rating is the heaviest load the bridge survives, not the typical load it carries.

Definition. Two different questions, two different scorecards:

• Average-case (i.i.d.) evaluation asks: what is performance under the same distribution the data was drawn from? Formally, the expected loss over the test distribution $P_{\text{test}} = P_{\text{train}}$. This is what test accuracy, backtest Sharpe, and a clean cross-validation all measure.
• Worst-case (robust) evaluation asks: what is performance under the worst distribution in an uncertainty set, or against the strongest attack an adversary can mount? Formally, robust loss is a maximization wrapped in your evaluation,

$\mathcal{L}_{\text{robust}}(f) = \max_{\delta \in \mathcal{S}} \; \mathcal{L}\big(f(x + \delta),\, y\big),$

where $\mathcal{S}$ is the set of perturbations the opponent is allowed (recall the $L_p$-ball budget from lesson 2). The $\max$ is the whole point: you report performance at the corner the adversary aims for, not in the comfortable middle Nature samples.

Worked example. A model classifies “long / flat / short” on engineered features and scores 95% accuracy on its i.i.d. test set. You then run the strongest projected gradient descent attack from lesson 2 — PGD with 50 steps inside the allowed perturbation budget — and re-measure. Accuracy collapses to 10%. Do the arithmetic on what that means for trading: of every 100 decisions the live opponent steers you toward, roughly 90 are wrong, and the adversary chose which 100. The 95% is a fact about a world with no opponent; the 10% is a fact about the world you actually trade in.

The correct report is both numbers, side by side — and the one you size the position on is the worst-case 10%, because that is the one the market will collect against.

When to use it

Use worst-case evaluation as the default scorecard for anything that will face a strategic counterparty: execution algos, market-making quotes, any signal that moves size in a liquid name. Average-case accuracy is fine as a sanity floor (if it’s bad average, don’t bother with worst case), but it is never the deploy decision. Report both; size on the worst.

Robustness claims are easier to fake than alpha claims

Analogy. Alpha fraud is buying 200 lottery tickets and bragging about the one that hit. Robustness fraud is subtler and worse: it’s hiring your own sparring partner, telling them to go easy, and then declaring yourself a champion when they tap out. You didn’t just get lucky — you chose the opponent, and choosing a weak one is the cheapest possible way to manufacture a robustness number that looks great and means nothing.

Definition. This is the robustness-evaluation trap from lesson 1, now stated as an inflation result. Recall the deflated Sharpe: when you select the best of $N$ noisy backtests, the expected maximum Sharpe under the null (no real skill) grows with

$\mathbb{E}[\max \text{SR}] \approx \sigma_{\text{SR}} \cdot \sqrt{2 \ln N}.$

Robust accuracy inflates the same direction but along a different axis. Alpha inflates with the number of trials; robust accuracy inflates as the attack you evaluate against gets weaker. A weak attack barely searches the perturbation set, so it finds few failures, so your “robust accuracy” stays high — a number that flatters you exactly the way a max-over-many-backtests flatters you. You are not measuring robustness; you are measuring the gentleness of your sparring partner.

Worked example. A defender reports the headline number “robust accuracy 60%.” Read the fine print and it was measured against FGSM — the single-step, weak attack from lesson 2. Re-run the evaluation against PGD-50 — the strong, multi-step attack that actually searches the budget — and robust accuracy falls to 8%.

The 60% is the fakeable number. It is not a lie about what happened — FGSM really did only knock accuracy to 60% — it is a lie by selection of opponent. The defender chose the attack that flattered them, the way an alpha cheat chooses the backtest that flattered them. Tie it back to lesson 1’s trap: surviving the easy interior of the uncertainty set tells you nothing about the worst corner, and a weak attack only ever pokes the interior.

When to use it

Apply this skepticism every time you see a robustness number — your own most of all. Before believing “we are robust,” demand the adversary’s spec: attack family, perturbation budget, step count, and number of restarts. If the write-up only quotes a single-step or black-box attack, treat the robustness claim as unverified, the way you’d treat a Sharpe with no deflation as unearned.

Gradient masking and false robustness

Analogy. Imagine a safe that looks impregnable because it’s coated in grease — every time a thief tries to read the dial by feel, their fingers slip. You run your test (a thief who reads dials by feel) and declare victory. Then a thief who uses a stethoscope, ignoring the dial entirely, opens it in thirty seconds. The grease never made the lock stronger; it just defeated the one tool your test happened to use. That’s gradient masking.

Definition. Gradient masking (or obfuscated gradients, Athalye, Carlini & Wagner, 2018) is a defense that appears robust because it breaks the attacker’s gradient signal rather than actually flattening the loss surface around the input. Gradient-based attacks like PGD need a useful $\nabla_x \mathcal{L}$ to know which way to push; if the defense makes that gradient uninformative — shattered, stochastic, or vanishing — the attack wanders blindly and appears to fail. The vulnerability is still there; you’ve just hidden the map to it. The authors identified three telltale tells that you’re masking rather than defending:

1. Robust to weak attacks but not strong ones. Robust accuracy is high against single-step FGSM but collapses under multi-step PGD with enough iterations and restarts.
2. Black-box beats white-box. A transfer or query-based attack with less information outperforms the white-box attack with full gradient access. This is backwards — full knowledge should never do worse — and it’s the loudest alarm bell.
3. Unbounded attacks don’t reach 0% accuracy. If you let the perturbation budget grow without limit and the model still classifies correctly, the attack is broken, not the model is robust. With an unbounded budget any honest attack should drive accuracy to zero (you can perturb the input into literally anything).

Worked example — the diagnostic table. You audit a defense and collect four numbers:

Read the pattern, not the headline. The white-box numbers (78%, 71%) look like a robust defense. But the black-box attack with no gradient access does far more damage (22%) than the white-box attack with full access — the impossible reversal — and the unbounded attack never reaches 0%. Two of the three tells fire at once. This defense is not robust; it is masking. The honest robust accuracy is somewhere near that 22% (or lower, once someone runs an adaptive gradient-free attack designed for it).

Market reframe. A strategy that survives your gentle simulated opponent — a backtest replay with random noise, a slippage model you tuned to be forgiving — but dies the moment a real adaptive opponent probes it. The simulated opponent is your obfuscated gradient: it can’t find the weak spot because your simulation hid the map. The live market sends the stethoscope.

When to use it

Run the gradient-masking checklist on any defense before you trust its robustness number: compare weak vs strong attacks, white-box vs black-box, and bounded vs unbounded budgets. If strong < weak in damage, if black-box > white-box in damage, or if unbounded attacks leave accuracy above zero, stop — the number is masking, not robustness, and your next move is an adaptive attack built specifically for this defense.

Red-teaming your own strategy

Analogy. A castle’s defenders run drills against their own soldiers, who attack the front gate every time because that’s the drill. The castle never falls — in the drill. A real siege army studies the walls, finds the unguarded postern, and walks in. Red-teaming is hiring soldiers whose entire job is to think like the siege army and attack your postern before the enemy does. Their success is your success, because they fail cheaply where the market fails expensively.

Definition. Red-teaming is the discipline of standing up an internal adversary team whose explicit mandate is to break your own strategy before deployment — and to be rewarded for breaking it, not for confirming it works. A real red-team uses five tools:

1. Adaptive attacks. Attack the specific defense, don’t reuse a generic off-the-shelf attack. (A generic attack against a masking defense is exactly how false robustness slips through; the adaptive attack is built to defeat this model’s tricks.)
2. Worst-case historical replay. Replay the worst regime your data contains — the 2008 meltdown, the 2010 flash crash, the 2020 March collapse — not the average backtest window. Nature already ran one adversarial scenario for you; don’t average it away.
3. Adversarial scenario generation. Synthesize stress scenarios that target the strategy’s leverage points, rather than sampling plausible-but-easy ones.
4. Stress the execution assumptions. Attack your fills, your slippage model, and your capacity. A 2.0 Sharpe that assumes mid-price fills and infinite liquidity is a fantasy; the red-team makes the fills hostile and the book thin.
5. Assume the opponent knows your model. Kerckhoffs’s principle, lesson 1: design the attack as if the adversary has read your code, knows your features, and has seen your weights. Security that relies on the opponent’s ignorance is not security.

The danger a red-team guards against is survival by luck under a bad evaluation process. You can pass an evaluation for the wrong reason — a weak test that never probed your real weakness — and a passing grade tells you nothing about whether your process was sound. The process-vs-outcome matrix makes this explicit:

Worked example. A strategy is put through 10 stress scenarios. Nine are randomly generated — plausible market moves sampled from history — and it passes all nine. The tenth is adaptive: the red-team studied the strategy, found it leans heavily on a single order-book imbalance feature (echoing lesson 1’s single-feature fragility), and crafted a scenario that spoofs exactly that feature. The strategy fails the tenth. A naive reading says “90% pass rate, ship it.” The correct reading: the nine passes are the easy interior of the uncertainty set; the one adaptive failure is the worst corner, and the worst corner is where the opponent lives. That single adaptive scenario outweighs all nine random ones combined, because it’s the only one that imitates a real, thinking adversary.

When to use it

Stand up a red-team for any strategy that will hold meaningful size or interact with a strategic counterparty. Make adaptive attacks and worst-regime replay mandatory gates, not optional extras, and never let the team that built the strategy be the only team that evaluates it — the builder is the worst possible referee, because they unconsciously test the cases they already know survive.

The honest robustness scorecard

Analogy. A serious bridge inspection report doesn’t say “the bridge is fine.” It states the load rating, the heaviest test load applied, the safety margin, the inspection methodology, the known weak points, and the maximum traffic before the bridge gets closed. The honest robustness scorecard is that report for your strategy — and like a bridge report, it’s worthless if it omits how hard you actually pushed.

Definition. The honest robustness scorecard reports everything a hostile referee would demand to audit your claim, not just the claim. Each line exists to close a specific hole this course has shown you:

Note the deflation line carefully: it’s the same idea as deflating Sharpe for the number of architectures you tried in Deep Learning for Market Data, just relabeled. Every defense and every configuration you evaluate is another trial; the best one’s robust accuracy is a maximum over noisy trials and inflates with $\sqrt{2 \ln N}$ exactly like a best-of-N Sharpe. Report the deflated number, not the victory-lap one.

Worked example. Two write-ups for the same strategy. Which would you fund?

Write-up A is the higher number and the worse strategy. Write-up B’s 41% looks worse on the slide and is far more likely to survive contact with a real opponent, because it was measured against one. Fund B.

When to use it

Make the scorecard the deliverable of every robustness exercise — the artifact that gates deployment, gets reviewed, and gets revisited when regimes shift. If any of its seven lines is missing, the claim is incomplete and the strategy doesn’t ship. Treat a robustness write-up with no named strong attack and no deflation the way you’d treat a Sharpe with no trial count: interesting, unverified, and not yet investable.

Recap

You started this course believing the market might fall to a firehose of predictive power, and you end it knowing that the firehose’s worst enemy is its own evaluation. The i.i.d. test set is graded by an indifferent Nature; the deployed strategy is graded by a hostile opponent who picks the worst case on purpose — so the worst-case number is the one that trades. Robustness claims inflate even more easily than alpha claims, because the knob you cheat with is the strength of the sparring partner you chose, and gradient masking lets a defense look robust by hiding the map to its own weakness. The fix is to red-team yourself with adaptive, Kerckhoffs-aware, worst-regime attacks — rewarding the team for breaking you — and to publish an honest scorecard that reports clean and worst-case metrics, names the strongest attack, deflates for the configs tried, stresses execution, and ships with a kill switch.