\begin{table}[!hp]
\caption{Examples of Adversarial Attacks in Finance}\label{attackstable}
\begin{longtable}{|p{25mm}|p{30mm}|p{70mm}|}
\hline \thead{Failures} & \thead{Description} & \thead{Example} \\
\hline 
Reward Hacking 
& When training, the stated reward differs from a true reward. 
& A learning agent was trained to create a perfect hedge, however transaction costs were poorly modelled, leading to poor performance. \\
\hline 
Side Effects 
& A reinforcement learning system disrupts the environment by advancing its goal. 
& A model has learned an order execution strategy for an illiquid asset, but by executing this strategy, changes the dynamics of the order book significantly, leading to increased risk.\\
\hline 
Distributional Shifts 
& The system is trained on one environment, but unable to adapt to changes. & A pricing model was trained on data during normal times, and is unable to react to the higher correlations between assets during crises. \\
\hline 
Natural Adversarial Examples. 
& Even without being attacked the system fails from natural errors.
& A pricing model was trained individually for each strike and maturity, resulting in arbitrageable prices being offered in the market.  \\
\hline Common Corruptions
& The system is not able to deal with common corruptions. 
& A pricing model failed due to a halt on trading being placed on a closely related underlying instrument. \\
\hline Incomplete Testing 
& The system is not tested on the right environment nor over multiple periods. 
& A pricing model is tested only on one exchange, but is deployed in multiple locations with differing market behaviours. \\
\hline Poisoning attack 
& Contaminate training phase. 
& Contaminated data is introduced into a pricing model, for example when using sentiment analysis based on social media. \\
\hline Model stealing 
& Recover the entire model.
& A proprietary model is trained and can be queried online by counterparties. By repeated queries it is possible that the inputs can be matched with the outputs, to reverse engineer the original model. \\
\hline Model inversion 
& Recover hidden features.
& A pricing model is trained using proprietary trading data on market impact. The fitted model is then made public, without the underlying data. By repeated queries, it may be possible to extract the training data used \citep{fredrikson2015model}. \\
\hline Reprogramming system 
& Repurpose system for other use. 
& An online pricing model is used to identify expected future market volatility. \\
\hline
\end{longtable}
\end{table}
Failures Description Example
Reward Hacking When training, the
stated reward dif-
fers from a true re-
ward. A learning agent was trained to create a per-
fect hedge, however transaction costs were
poorly modelled, leading to poor performance.
Side Effects A reinforcement
learning system
disrupts the en-
vironment by
advancing its goal. A model has learned an order execution strat-
egy for an illiquid asset, but by executing this
strategy, changes the dynamics of the order
book significantly, leading to increased risk.
Distributional
Shifts The system is
trained on one
environment, but
unable to adapt to
changes. A pricing model was trained on data dur-
ing normal times, and is unable to react to
the higher correlations between assets during
crises.
Natural Adver-
sarial Examples. Even without being
attacked the system
fails from natural
errors. A pricing model was trained individually for
each strike and maturity, resulting in arbi-
trageable prices being offered in the market.
Common Cor-
ruptions The system is
not able to deal
with common
corruptions. A pricing model failed due to a halt on trading
being placed on a closely related underlying
instrument.
Incomplete
Testing The system is
not tested on the
right environment
nor over multiple
periods. A pricing model is tested only on one ex-
change, but is deployed in multiple locations
with differing market behaviours.
Poisoning at-
tack Contaminate train-
ing phase. Contaminated data is introduced into a pric-
ing model, for example when using sentiment
analysis based on social media.
Model stealing Recover the entire
model. A proprietary model is trained and can be
queried online by counterparties. By repeated
queries it is possible that the inputs can be
matched with the outputs, to reverse engineer
the original model.
Model inversion Recover hidden fea-
tures. A pricing model is trained using proprietary
trading data on market impact. The fitted
model is then made public, without the un-
derlying data. By repeated queries, it may
be possible to extract the training data used
(Fredrikson et al., 2015).
Reprogramming
system Repurpose system
for other use. An online pricing model is used to identify ex-
pected future market volatility.