Adversarial training improves credit scoring model resilience to multiple attacks
Adversarial Training for Tabular Credit Scoring: A Multi-Attack Robustness Evaluation in P2P Lending
Machine Learning
Summary
Machine learning helps decide who gets loans, but some people might try to trick these systems by changing their answers. The authors studied how training models to defend against trick attempts improves their strength not just against one kind of trick, but several types. They found that training on many types of tricks at once makes the models more balanced and better at spotting different cheating methods. This helps make loan decisions more reliable even when people try to game the system.
What this means in practice
- •For credit risk analysts: Enhance loan approval models by using multi-attack adversarial training to better withstand applicant manipulation in peer-to-peer lending data.
- •For fraud detection teams: Develop more reliable detection systems by stress-testing models with varied attack types to improve resilience against different fraud strategies.
Tested on one dataset.
Authors
Gijs A. F. Niewzwaag, Marijn G. S. Veth, Manuele Massei, Marcos R. Machado
Abstract
Machine learning-based credit scoring is increasingly central to Peer-to-Peer (P2P) lending, yet its resilience to adversarial manipulation, where applicants strategically alter self-reported inputs to secure favourable decisions, remains poorly understood. Most adversarial-robustness evidence comes from image and text domains and evaluates a single attack against a matching defence, offering little guidance on how defences generalise across attack types in tabular credit data. We address this with a systematic train-test robustness benchmark on a large Lending Club subset, spanning three model families (logistic regression, a feed-forward neural network, and a transformer for tabular data) and four attacks confined to applicant-mutable features: Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Salt-and-Pepper (S&P) noise, and DeepFool, plus a mixed-attack regime. Across a full grid evaluated with stratified cross-validation, adversarial training sharply improves robustness against the attack it is trained on and transfers well within the gradient-based family, but transfers weakly to non-gradient corruption, so single-attack defences overstate real-world resilience. Mixed training delivers the most balanced robustness across heterogeneous attacks while preserving clean-test performance, supporting multi-attack stress testing in credit-model governance.