Dear reviewer,

Thank you for your time and effort in reviewing our paper and for your fruitful suggestions.

To start with, we would like to share 2 new experiments conducted after our submission.

Experiment 1: GAD process with real-market data

In the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P&L(eq2.2) below.

The results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.

This setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.

Experiment 2: Heston model with transaction cost

In addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.

Next, we would like to address your comments one by one.

Weakness

...the paper lacks a literature review or related work section...the paper does not include a conclusion section.

We thank the reviewer for this valuable observation. We fully agree that clearly situating our work within the broader literature is important, especially for readers unfamiliar with the intersection of deep hedging and adversarial robustness.

In Section 1 of our original submission, we integrated a discussion of related works throughout the Introduction (lines 31–36, 54–61) and also included a dedicated "Further related work" paragraph at the end of the section. However, we acknowledge that this scattered format may have made it difficult to appreciate the progression and relevance of these works.

To address this, we have revised the manuscript to include a dedicated and more detailed Related Work section, which systematically:

• Reviews the evolution of deep hedging from its inception [2] to recent methodological extensions. In particular, we now highlight [11] as a key example of addressing parameter misspecification within the deep hedging framework.

• Discusses distributionally robust optimization (DRO) frameworks, particularly those based on Wasserstein metrics [13, 17, 18].

• Connects adversarial training literatures like [19-22] from classical machine learning to the distributional setting in our financial context.

We believe this revision significantly improves accessibility and contextual clarity for readers from both the finance and AI communities.

Motivated by the reviewer's comment about the missing conclusion, we will add the following conclusion to our revised paper:

We presented a robust deep hedging framework that leverages adversarial training under Wasserstein ambiguity to address the challenges of model misspecification and distributional shifts. By formulating the distributionally robust optimization problem as a minimax objective and approximating it through a tractable reformulation, we demonstrated how deep hedging strategies can be trained adversarially. Empirical results across a variety of widely used synthetic models and data regimes show that adversarially trained strategies achieve improved out-of-sample and out-of-distribution performance, especially under structural changes or limited data availability. Further experiments on real market data suggest that these strategies also generalize well beyond simulated settings, maintaining robustness in periods of market stress. These findings underscore the practical value of robust training methods in financial environments characterized by uncertainty and instability.

The experiments primarily rely on simulated data from well-known financial models (e.g., Heston and Black-Scholes). While these models are widely used, they may not fully capture the complexities of real-world financial markets...

We agree with the reviewer that real-world evaluation is essential. The added experiment directly addresses this concern. As shown in Experiment 1, adversarially trained strategies continue to outperform standard training even under real market conditions. We believe this experiment complements the synthetic benchmarks and provides further evidence of the practical applicability of our approach.

Question

...the paper lacks a coherent flow...Additionally, the paper would benefit from a more detailed discussion on the limitations of existing methods and how the proposed approach overcomes these limitations.

Following your advice in the previous comment, we will add a more detailed Related Work section as well as a Conclusion section (see our proposed conclusion above). In addition, since the final version allows for an extra page, we plan to include two new experiments based on real-world market data. We believe these additions will improve the overall coherence of the paper and help readers follow the logical progression of our contributions more easily.

Regarding the limitations of existing methods, we highlight in Section 5.1 how classical deep hedging strategies are vulnerable to adversarial attacks, underscoring the practical need for improved robustness. We will also include a clearer discussion comparing our approach to [11]. While [11] enhances robustness by modifying the model parametrically, its effectiveness remains highly dependent on the specific parameterization chosen. In contrast, our method focuses on distributional robustness, operating over a Wasserstein ball around the empirical distribution without relying on any parametric model structure. This enables our approach to handle distributional shifts more broadly and provides robustness that is independent of model specification.

Thanks for the authors' responses. The rebuttal has addressed most of my concerns. The quality of the article will be further improved based on the author's current feedback.

As stated in my initial evaluation, this paper introduces a Wasserstein framework that combines distributional adversarial training with deep hedging. The topic is meaningful and this work might be the first to address the robustness of deep hedging strategies under distributional shifts using adversarial training.

Considering that the technical contribution outweighs other minor issues (like writing and experiments)，I keep my original positive rating.

Dear reviewer,

Thank you for your time and effort in reviewing our paper and for your fruitful suggestions.

To start with, we would like to share 2 new experiments conducted after our submission.

Experiment 1: GAD process with real-market data

In the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P&L(eq2.2) below.

The results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.

This setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.

Experiment 2: Heston model with transaction cost

In addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.

Next, we would like to address your comments one by one.

Weakness 1

We selected the Black-Scholes and Heston models to establish a clear and interpretable benchmark aligned with prior work in the deep hedging literature. We conducted additional experiments after submission, including both real-world market data and more complex hedging scenarios.

Weakness 2

As described at the start, Experiment 1 directly addresses this question by training on pre-COVID historical data and evaluating on real market data from March 2020, hence capturing realistic distribution shifts.

Weakness 3

We appreciate the reviewer’s concern regarding computational cost. Details on training time and hardware setup are provided in Appendix D. In summary, adversarial training is approximately 10 times more computationally demanding than standard deep hedging, due to the additional inner optimization steps during the adversarial attacks required at each update. While this increase is notable, we believe it is acceptable given the intended use case. Deep hedging is typically applied in risk management settings where models are trained offline, and hedging decisions are executed in real time using a relatively small network. Importantly, the execution time of a trained strategy is comparable regardless of whether it was trained adversarially or classically. Nevertheless, we recognize that improving training efficiency for large-scale or high-frequency retraining scenarios remains a valuable direction for future research.

Questions 1

To the best of our knowledge, formal computational complexity bounds are not available even for classical deep hedging, and deriving such bounds remains an open problem in the literature. As a result, scalability is typically assessed through empirical performance.

To illustrate this, we report the average training time per epoch (in seconds) under varying sequence length T and input dimensions using the Black-Scholes model:

Clean Training

Adversarial Training

These results indicate that the runtime for training scales reasonably with increasing sequence length T for both clean and adversarial training. In our experiments, the input dimension does not affect the runtime, likely due to the underlying GPU architecture utilizing efficient tensor operation parallelization techniques.

Questions 2

In our experiments on simulated data, we performed a grid search over a range of hyperparameter values, including the Wasserstein radius, and selected parameters based on validation performance. However, in the real market experiment introduced above, we did not have access to a dedicated validation set. Instead, we report results averaged over a fixed set of hyperparameter configurations, which helps avoid post-selection bias.

In general, selecting the Wasserstein radius in distributionally robust optimization (DRO) is a well-known challenge and remains an open research problem. To our knowledge, there is no widely accepted principled method for determining this parameter based solely on observable market characteristics (see, e.g., [13]). As shown in Table 4, we do not observe a consistent pattern in the optimal radius across different models, though there is a general trend that overly large radii may degrade performance. Developing a principled selection procedure through statistical uncertainty or market volatility is a valuable direction for future work.

Questions 3

In this work, we adopt a standard RNN-based architecture, which is widely used in the deep hedging literature and aligns naturally with the sequential structure of hedging problems. Our empirical results suggest that this architecture is sufficient to capture the relevant temporal dependencies and deliver strong performance in the settings considered.

While it would certainly be interesting to explore more modern architectures such as LSTMs or transformers—particularly in higher-dimensional or more complex market environments—doing so would introduce additional considerations related to model capacity, regularization, and hyperparameter tuning. These aspects, while important, are somewhat beyond the main focus of this work. As our primary goal is to investigate robustness under distributional shifts, we believe the key conclusions can be expected to generalize to other architectures.

Questions 4

In our current work, we focus on generating adversarial perturbations tailored to the model being trained, and do not evaluate whether these perturbations also degrade the performance of other independently trained models. This is an intriguing direction, and investigating the transferability of adversarial examples in the hedging context could indeed offer valuable insights into the nature of distributional vulnerabilities and robustness. We see this as an interesting avenue for future research.

Limitation

We thank the reviewer for finding our work interesting. While we agree that the paper primarily addresses questions relevant to quantitative finance, the methods and techniques we develop are not limited to that domain. More broadly, our work contributes to the field of robust decision-making based on time-series data, particularly in low-data regimes. This class of problems is rich and general, encompassing stochastic control problems that arise prominently in engineering (e.g., robotics), systems biology, and economics, among other areas.

The distributionally robust optimization (DRO) framework we employ to model adversarial robustness has gained significant attention in the machine learning community over the past decade. However, most existing DRO approaches are confined to the i.i.d. setting and assume access to large amounts of data—for instance, in image classification tasks. In contrast, our work addresses the largely unexplored regime of time-series data with limited training samples. From this broader perspective, we demonstrate that DRO-based modeling can yield substantial performance improvements in such settings.

Thank you again for your review. We wanted to kindly follow up on the rebuttal we provided. If possible, we would greatly appreciate any feedback you may have at this stage. If there are any remaining questions or points you’d like to discuss, we’d be very happy to provide further clarification.

We sincerely appreciate your time and feedback.

Dear reviewer,

Thank you for your time and effort in reviewing our paper and for your fruitful suggestions.

To start with, we would like to share 2 new experiments conducted after our submission.

Experiment 1: GAD process with real-market data

In the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P&L(eq2.2) below.

The results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.

This setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.

Experiment 2: Heston model with transaction cost

In addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.

Next, we would like to address your comments one by one.

Weaknesses

... However, the experiments use finite, non-trivial values for δ (up to 0.5). A discussion on the tightness of this approximation for the radii used in the experiments would strengthen the paper's claims. While the empirical results are strong, it is unclear how much performance is left on the table compared to solving the true (but intractable) DRO problem...

As discussed in Equation 3.13, the proposed algorithm is a tractable approximation of the infinite-dimensional Wasserstein DRO problem and recovers the true objective up to o(δ) as δ→0. This theoretical guarantee provides a first-order justification for our formulation.

We acknowledge, however, that in practice we use finite (and sometimes moderately large) values of δ, and the approximation error for such values is not explicitly characterized. Although we do not provide a formal characterization of the approximation error at finite radii, the empirical results suggest that the method remains effective. Quantifying the tightness of the approximation for finite δ is indeed an important question, and we agree that further theoretical or empirical analysis of this aspect could strengthen the robustness guarantees of the method. We consider this a promising direction for future research.

The paper presents results for adversarially trained models with δ=0.01 and δ=0.1 but does not detail how these values were chosen. A sensitivity analysis or discussion on a principled method for selecting δ (e.g., via a validation set) would significantly increase the practical value of this work. The results in Table 3 clearly show the trade-off between nominal performance and robustness, and more guidance on navigating this trade-off would be beneficial.

We would first like to clarify that our approach to hyperparameter selection, including the choice of the Wasserstein radius δ, is described in Appendix D. For experiments on simulated data, we perform a grid search over a range of values and select the configuration that performs best on a held-out validation set.

Regarding Table 3, we believe there may have been a misunderstanding. This table is not intended to evaluate the out-of-sample performance of the trained strategies with optimized hyperparameters, but rather to illustrate how different strategies respond to adversarial attacks of increasing strength. The losses shown are evaluated on the training data, and the columns represent the magnitude of the adversarial perturbation applied at test time (not the training δ). As expected, the loss increases with larger perturbations across all models.

In this table, we compare three strategies: clean training, adversarial training with δ = 0.01, and adversarial training with δ = 0.1. These values are not the result of hyperparameter optimization but are representative runs chosen to illustrate the trade-off between nominal performance and robustness, as discussed in Section 5.3.

... While powerful, this may not cover all types of realistic distribution shifts in financial markets, such as sudden regime changes or structural breaks that might alter the underlying data-generating process in ways not well-captured by a Wasserstein neighborhood.

While our primary experiments are based on simulated data using well-established models such as Black-Scholes and Heston, we agree that evaluation on real-world data is essential for assessing practical relevance. To this end, we have included an additional experiment (see Experiment 1 from above) using historical market data, as introduced earlier. This setting captures both the distributional shift induced by market volatility and the discrepancy between the assumed model dynamics and real-world behavior, offering a meaningful test of robustness. We believe this experiment complements the synthetic benchmarks and reinforces the method’s applicability in real financial environments.

We acknowledge that robustness within a Wasserstein ball addresses a specific form of local distributional shift and may not fully capture all types of structural changes or regime shifts observed in financial markets. As discussed in the last paragraph of the main text, exploring alternative ambiguity set geometries or hybrid formulations that better account for global distributional changes is indeed a promising direction for future research.

Question

Refer to the section on weaknesses. I seek an interactive dialogue with authors during the rebuttal phase.

We sincerely appreciate the reviewer’s openness to discussion and willingness to reconsider the score. We have carefully addressed the concerns outlined in the weaknesses section in our detailed responses and welcome any further questions or clarifications during the rebuttal phase.

Dear reviewer,

Thank you for your time and effort in reviewing our paper and for your fruitful suggestions.

To start with, we would like to share 2 new experiments conducted after our submission.

Experiment 1: GAD process with real-market data

In the paper [11], the authors investigate hedging strategies trained on synthetic data generated from a generalized affine diffusion (GAD) process and evaluated on real market prices of leading S&P 500 companies during the COVID-19 crash in March 2020. Following their setup, we construct two training datasets: FIX, where model parameters are fixed based on historical pre-COVID estimates, and ROB, where parameters are sampled from intervals inferred from the same historical data to incorporate model uncertainty. Clean and adversarial training are applied to both datasets, using the entropic risk measure the same as in the Black-Scholes model. As there is no validation set to choose hyperparameters, for adversarial training, we fix the sample size to $N=100,000$ and take the average across six $(α, δ)$ pairs. We provide the average P&L(eq2.2) below.

The results show that clean training on the ROB dataset outperforms FIX, confirming the findings of [11]. More importantly, adversarial training consistently improves performance across all settings. Even when ROB-clean outperforms FIX-clean, adversarial training on ROB yields further gains. This highlights the strength of adversarial training in improving robustness under model misspecification.

This setup captures not only the distributional shift caused by market volatility but also the mismatch between assumed model dynamics and real-world behavior, offering a meaningful test of robustness. Our results demonstrate that adversarially trained strategies outperform standard training in this challenging real-market scenario, supporting the practical value of adversarial training methods we proposed.

Experiment 2: Heston model with transaction cost

In addition, we extend our study to the Heston model with transaction costs by incorporating an additional cost term into the loss function. The experimental setup otherwise remains identical to the cost-free case. As shown in the following table, like in Fig.1, the adversarially trained strategy consistently outperforms the clean one across all sample sizes. Interestingly, unlike the case without transaction costs—where performance plateaus beyond a certain data size—the hedging loss here continues to decline as the number of training samples increases. This suggests that even with 100,000 samples, the data may not fully represent the true distribution. In such scenarios, adversarial training provides a clear advantage, underscoring its potential to improve robustness under data scarcity or distributional uncertainty.

Next, we would like to address your comments one by one.

Weakness

The number of experiments is limited...

We acknowledge that the original submission primarily focused on synthetic experiments, which limited the scope of practical evaluation. To address this concern, we conducted additional experiments after submission, including both real-world market data and more complex hedging scenarios. These new results, as introduced in our text above, provide a broader evaluation of our method and could address the concerns in the following points.

It is unclear how well the OOD experiment in Figure 1 reflects real-world financial data...

The OOD setting in Figure 1 was designed to highlight the robustness properties of the proposed strategy under distributional shifts, though it may not fully capture the complexity of real financial markets. To address this limitation, we conducted an additional experiment using historical market data as introduced in Experiment 1. This naturally introduces realistic and substantial distribution shifts. The results confirm that our method remains effective under real-world market uncertainty, reinforcing its practical relevance.

...when the number of training samples is sufficiently large, there is little to no performance gap between robust training and clean training...

Such an observation is reasonable and consistent with our findings when the underlying model is relatively simple. In these cases, we observe that the performance of clean strategies plateaus as the sample size increases, indicating that the empirical distribution with 100,000 samples closely approximates the true distribution, thereby reducing the observed benefit of robust training. In the second experiment introduced above, we incorporated transaction costs into the hedging problem, adding nonlinearity and increasing the overall complexity. Under this more realistic setting, we observe that performance no longer plateaus as the sample size increases, and adversarial training continues to outperform clean training even with 100,000 samples. This suggests that the advantage of robust training is not limited to low-data regimes but also extends to more complex or imperfectly specified environments, where model uncertainty remains significant despite the availability of large training datasets.

Question

...whether real-world market uncertainty—such as the COVID-19 crisis or post-2008 volatility—could be used as a more realistic evaluation. For example, training on pre-crisis data and testing on crisis-period data...

The additional Experiment 1 directly addresses this question by training on pre-COVID historical data and testing on real market data from March 2020. In this case, adversarially trained strategies continue to outperform standard training.

Thank you again for your review. We wanted to kindly follow up on the rebuttal we provided. If possible, we would greatly appreciate any feedback you may have at this stage. If there are any remaining questions or points you’d like to discuss, we’d be very happy to provide further clarification.

We sincerely appreciate your time and feedback.