How RiskHedge certifies a hedge decision

1Why not accept the cheap answer?

A risk engine compares candidate hedges by the tail loss of the hedged book over many market scenarios and keeps the least risky few. Exact evaluation reprices every option in every scenario, so systems use price bounds, caches, proxies or learned surrogates instead. These can be accurate on average and still swap the last chosen hedge for the first rejected one when the two are close.

The obvious approach is to rank by the approximate numbers and accept the result. Model validation describes how good an approximation is in aggregate, but it does not by itself establish that this hedge decision matches exact evaluation, and a wrong ranking looks exactly like a right one.

RiskHedge asks a narrower question: when may an approximate computation be allowed to decide which hedges are chosen? The answer is fail-closed. Accept only when a certificate proves exact-set equivalence; otherwise buy exact information or fall back. Uncertainty produces more computation, not an unqualified decision.

2Buy exact prices until the decision is fixed

Each bar below is a hedge's risk interval: its exact risk lies somewhere inside. Buy exact prices and the bars narrow. The choice is certified once the three chosen bars sit entirely to the left of the other three. Switch on the midpoint shortcut to see a cheap ranking pick the wrong third hedge with nothing to warn you.

3The gate in one picture

• Are the bounds usable? The price-bound provider must be available and valid, the bounds must belong to the current input, and the call must be in the registered scope. A stale input is recomputed; any other failure falls back to exact evaluation.
• Can any exact value change the choice? If every chosen hedge is better at its worst than every rejected hedge at its best, the gate returns CERTIFIED with the exact top-3 set.
• What if it can? Buy up to 8 more exact primitives and test again; if the budget runs out, return EXACT_FALLBACK. Every run writes a safety record a separate checker can replay.

4How it was tested one synthetic Merton pipeline

The decision chooses the 3 least risky of 24 hedge packages by expected shortfall over 64 market scenarios, on a book that is long one stock. Exhaustive evaluation needs 320 shared exact option-pricing primitives; work is the fraction of those paid after the initial bounds.

Baseline. The midpoint baseline gets the same input, bounds, risk measure and tie rule, replaces each interval by its midpoint, ranks and accepts. It pays no exact prices, so it is not work matched.

Two stages. A discovery study (120 instances) required midpoint errors in at least two strata, found only 3 in one, and stopped. A new registration then fixed fresh seeds, references, quotas, bins and the single confirmatory test before any confirmation outcome was computed. The two studies are never pooled. The 200 confirmation instances were enriched near the decision boundary: 50 near-tie, wide-bound cases (B1) and 150 others (B2–B5).

5Results

6Where the shortcut fails, and what certainty costs

7What the results mean

• Errors are silent. The baseline's output looks the same whether it is right or wrong. Every one of its 10 errors swapped only the third chosen hedge, all in the near-tie, wide-bound group (pre-specified Fisher test, p = 0.016).
• Ambiguity becomes work. 35 instances were certified from the initial bounds and 165 after refinement; none needed exhaustive pricing.
• The certificate adds stopping. A fixed budget either wastes work or leaves errors; the certificate says when each instance can stop.

8The companion paper EvoRobust, NeurIPS 2026

The EvoRobust paper, by the same authors, asks a related general question: which expensive tests must be run before a risk-sensitive choice is logically fixed? Its Merton option-pricing instantiation shows what certified price bounds can look like:

• Bounds for Merton European options on a declared domain (spot 90 to 110, volatility 0.1 to 0.3, no dividends), from a Taylor polynomial with an analytic remainder bound and an inspectable proof.
• A paid query returns a narrower certified interval, never a point. If intervals still overlap after every query, the status is unresolved and no decision is returned, so an exact tie is not forced.
• The certification is conditional: the remainder bound is a hand proof and the interval arithmetic library is trusted. The paper states that certification preserves decisions, not wall-clock time.

9Limitations and what didn’t work

Scope

• One synthetic pipeline. Everything comes from one Merton jump-diffusion option-hedging pipeline with 24 candidates, 64 scenarios and a top-3 choice, with four distinct exact decisions per study. There is no real portfolio data.
• A deliberately difficult population. The confirmation instances were enriched near the decision boundary, so 5.0% is a study-population rate, not a deployment error rate. All 10 baseline errors lie in one bin (B1). Their excess expected shortfall is 0.15–0.98%, and the paper attaches no materiality threshold to it.
• The first study stopped. The discovery study required midpoint errors in at least two strata but found only 3, all in one, and its verdict was STOP. The confirmation study is a separate registration; the two are never pooled.
• Work is not cost. Work counts only the exact primitives paid after the initial bounds. Building the cheap certified price bounds is not counted and no wall-clock time was measured, so neither their cost nor any speedup is established.

What the evidence does not show

• No claim beyond the decision. The paper makes no claim of a speedup, adversarial robustness, security, privacy, fraud or AML detection, regulatory compliance or production certification, and none of superiority over other heuristics. The guard faults test detection by the inherited checks, not end-to-end recovery or an adversary.
• The comparison with fixed budgets is post hoc. The registered baseline pays no exact prices and is not work matched. The budgets in the work-matched comparison were chosen after seeing the results, so the 1.88× figure is in-sample and holds only among the budgets tried. Errors were not monotone in the budget: 13 for each budget from 8 to 32 primitives, against 10 with none.
• Invalid bounds can pass. Post hoc, corrupted bounds with valid identity metadata produced 13 false certificates (1 sparse, 12 dense), and every one passed reference-free replay. The sampled audit, which costs 2.5% of exhaustive work at 8 samples, flags the dense case with probability 1 but the sparse case with only 0.19, and it reuses the same pricer.
• Learned surrogates are not covered. With a learned surrogate and split-conformal sets, all 320 primitives were covered at once on only 95, 97 and 149 of 200 instances at the three levels (post hoc). The guarantee does not apply to them, and the zero wrong decisions seen there come from a smooth, accurate surrogate, not from a guarantee.
• A hard budget cap leaves most instances undecided. Post hoc, with a cap of 32 paid primitives, 95 of 200 instances certified and 105 exhausted the cap. Fallback and refusal made no wrong decision there, while an uncertified midpoint rule at the same budget was wrong on 13. The refusal path is a minimal prototype in the evaluation harness, not a registered component.

Implementation and reproducibility

• Assumed, not proved. The guarantee needs price bounds that are valid for the current input (A1) and a call in the registered scope (A2). A1 is inherited from the certified pricer, not independently proved. The certificate is sufficient, not necessary: overlapping intervals may fail to certify a correct ranking, and exact ties with non-degenerate intervals do not certify.
• Replay is internal. It checks the recorded decision path, does not recompute the price bounds or prove A1, and was written by the same team that wrote the producer. It is not formal verification.
• Harness and inherited code. In the evaluation harness, refinement and fallback read the same precomputed direct-pricing reference that defines ground truth. The pricing engine, bound provider, scheduler and work accounting come from an existing unpublished implementation; the paper's claims concern how they are composed.
• Registration and archive. The registrations are project-internal hash manifests sealed minutes before execution; they were not externally timestamped or placed in a public registry. The archive with records, hashes and commands is available from the authors on request.

10Open questions

1. What does certification cost end to end?

   The work count leaves out building the cheap certified price bounds, and the paper measured no wall-clock time for the gate. A timing study of bound construction would show whether the exact pricing saved outweighs it.

2. Does it hold beyond one synthetic book?

   All evidence comes from one synthetic Merton pipeline with four distinct exact decisions per study. Real portfolios, other pricers and other decisions are untested.

3. Can learned models supply valid bounds?

   The conformal sets of the learned surrogate covered every primitive on only 95, 97 and 149 of 200 instances (post hoc), so the guarantee does not apply to them. Bounds a learned model could certify are an open question.

11Notation and the certificate

Candidate $j$ has exact risk $q_j$: the empirical expected shortfall of the hedged book's scenario losses at tail mass 5%. The exact decision $D^{\star }$ is the first $k$ candidates in the lexicographic order of $(q_j,{\mathrm{i}\mathrm{d}}_j)$. A shortcut holds an interval $[{\ell }_j,u_j]$ per candidate, computed from primitive price enclosures by interval arithmetic.

Soundness. Assume (A1) every primitive enclosure contains the true model value for the current input, and (A2) the call is within the registered scope $1\le k<m$. Scenario losses are linear in the primitives and empirical expected shortfall is non-decreasing in each loss, so $q_j\in [{\ell }_j,u_j]$. If $D$ is certified then $D=D^{\star }$.

12Full results

Percentage intervals are Wilson 95% intervals. Work is the median fraction of the 320 shared primitives paid after the initial bounds (1 = exhaustive); the B4–B5 median is 0.0016. Of the fault runs, 40 fell back exactly and 20 recomputed and certified (median work 0.061). REFUSED was never emitted across both studies (0 of 740 gate records).

Post hoc, not registered. All 10 midpoint errors had boundary risk above 100, which 19 of the 200 instances had. With corrupted bounds but valid identity metadata the gate produced 13 false certificates (1 sparse, 12 dense). The sampled audit costs 2.5% of exhaustive work at 8 samples.

13In brief

14Sources

Paper: Certify the Decision, Not the Shortcut: Fail-Closed Screening for Financial Risk Decisions, Yingzhi Tang and Yuhe Sui, Financial AI Security, Privacy, and Safety Workshop (FinAI-SPS) at ICAIF 2026, poster. The workshop is non-archival and does not publish papers; the archive is available from the authors on request.

Numbers and labels follow the camera-ready paper: Fig. 1 (decision flow), Sections 2 to 5, and Appendices C (registered criteria), D and H (post hoc audits and experiments) and G (boundary-risk quintiles, with its data file).

Back to top ↑