Adversarial Training for Tabular Credit Scoring: A Multi-Attack Robustness Evaluation in P2P Lending

Gijs A. F. Niewzwaag; Marijn G. S. Veth; Manuele Massei; Marcos R. Machado

Source-linked AI summary

Adversarial Training for Tabular Credit Scoring: A Multi-Attack Robustness Evaluation in P2P Lending

Gijs A. F. Niewzwaag, Marijn G. S. Veth, Manuele Massei, Marcos R. Machado

arXiv:2609.09945v1Sep 9, 2026cs.LGq-fin.RMstat.ML

TL;DR

Adversarial manipulation threatens the reliability of automated P2P credit scoring, while existing evidence offers limited guidance on robustness across attack types. The paper benchmarks three model families and multiple applicant-mutable attacks, finding that mixed adversarial training provides the most balanced robustness across heterogeneous attacks while preserving clean-test performance.

Problem
Robustness evidence for tabular P2P credit scoring is limited, especially for cross-attack generalisation beyond single attack–defence evaluations.
Method
The study evaluates three tabular model families under four applicant-mutable attacks and mixed training–testing regimes using Lending Club data.
Results
Adversarial training improves robustness most strongly against matched attacks, transfers within gradient-based attacks, transfers weakly to non-gradient corruption, and mixed training gives the most balanced robustness.
Takeaways & Limitations
Credit-model governance should use multi-attack stress testing because single-attack defences can overstate resilience to heterogeneous manipulation.
Takeaways & Limitations
The curated Lending Club subset and fixed preprocessing pipeline may not generalise across lenders, periods, feature sets, or operational constraints, requiring lender-specific validation.

Abstract

from arXiv · show

Machine learning-based credit scoring is increasingly central to Peer-to-Peer (P2P) lending, yet its resilience to adversarial manipulation, where applicants strategically alter self-reported inputs to secure favourable decisions, remains poorly understood. Most adversarial-robustness evidence comes from image and text domains and evaluates a single attack against a matching defence, offering little guidance on how defences generalise across attack types in tabular credit data. We address this with a systematic train-test robustness benchmark on a large Lending Club subset, spanning three model families (logistic regression, a feed-forward neural network, and a transformer for tabular data) and four attacks confined to applicant-mutable features: Fast Gradient Sign Method (FGSM), Projected Gradient Descent (PGD), Salt-and-Pepper (S&P) noise, and DeepFool, plus a mixed-attack regime. Across a full grid evaluated with stratified cross-validation, adversarial training sharply improves robustness against the attack it is trained on and transfers well within the gradient-based family, but transfers weakly to non-gradient corruption, so single-attack defences overstate real-world resilience. Mixed training delivers the most balanced robustness across heterogeneous attacks while preserving clean-test performance, supporting multi-attack stress testing in credit-model governance.

1. Introduction

P2P credit scoring increasingly depends on automated models whose vulnerability to strategic input manipulation remains insufficiently understood. This study evaluates adversarial training across attack families to assess robustness and cross-attack generalisation.

Strategic perturbations of applicant inputs can exploit model decision boundaries and produce more favourable credit decisions or degrade risk models.
Credit scoring is a high-risk AI application requiring accuracy, resilience to perturbations, auditability, and oversight throughout deployment.
Prior adversarial-robustness evidence is limited by domain mismatch and narrow attack–defence evaluations, leaving cross-attack generalisation in P2P credit data insufficiently studied.
The study benchmarks adversarial training on Lending Club data against gradient-based and non-gradient attacks, including FGSM, PGD, DeepFool, and Salt-and-Pepper noise.
Its contribution is a mixed training–testing evaluation that constrains perturbations to applicant-mutable features and examines which training choices preserve performance under manipulation.

2. Literature Review

The literature contrasts flexible but less interpretable ML credit models with limited, domain-specific evidence on adversarial robustness in P2P lending. This study targets gaps in multi-attack and mixed training–testing evaluation for structured credit data.

Credit risk modelling: ML credit models expand data and pattern-processing capabilities but introduce trade-offs in interpretability, validation complexity, regulatory compliance, and robustness.
Credit risk modelling: P2P lending relies heavily on algorithmic risk assessment while using flexible data sourcing and feature engineering, increasing both opportunities and vulnerabilities.
Adversarial ML and robustness: Adversarial training augments data with perturbed examples to encourage more resilient decision boundaries, though clean-data accuracy can decline.
Research gaps: Credit-risk robustness research provides limited evidence for structured datasets because image- and text-oriented protocols do not capture tabular constraints, discreteness, or plausibility requirements.
Research gaps: Existing financial studies often use single-pair attack–defence assessments, providing limited insight into robustness against adaptive, combined, or gradient-free attacks.
Research gaps: The study addresses these gaps with systematic multi-attack testing and mixed training–testing strategies that quantify cross-attack generalisation on real-world P2P lending data.

3. Materials and Methods

The study combines a reproducible Lending Club preprocessing pipeline with a train-test robustness matrix spanning three model families and heterogeneous adversarial perturbations.

Experimental design: The benchmark covers logistic regression, a feed-forward neural network, and a transformer-based tabular model against FGSM, PGD, DeepFool, S&P, and mixed perturbations.The design evaluates clean and adversarially augmented training regimes across clean and attacked test sets.
Dataset and exploration: The dataset is a curated Lending Club subset with numerical and categorical borrower, loan, and credit-history features, including substantial class imbalance.Fully Paid loans substantially outnumber Charged Off loans, motivating class weighting during training.
Preprocessing pipeline: Preprocessing removes unavailable or implausible values, encodes categorical variables, imputes selected missing values, and scales continuous inputs to [0, 1].The pipeline drops issue d to prevent leakage and applies feature-specific missing-value handling before modelling.
Evaluation protocol: The evaluation uses an 80% training and 20% test split with class-weighted loss, while stratified 5-fold cross-validation supports comparisons across models, training regimes, and attacks.Performance is measured with ROC AUC, accuracy, precision, recall, F1-score, and adversarial accuracy.
Attack specification: FGSM and PGD use gradient-based white-box perturbations, DeepFool seeks the nearest decision boundary, and S&P flips feature values to extremes as a non-gradient corruption.Targeted FGSM and PGD variants push Charged Off cases toward the Fully Paid class.

4. Results and Discussions

Across model families, adversarial training improves robustness most when training and test attacks match, while mixed training offers the most balanced protection across heterogeneous attacks. Clean-trained models remain vulnerable to targeted perturbations, and robustness transfer is weak from gradient-based attacks to Salt-and-Pepper corruption.

Impact of adversarial attacks on clean-trained models: Clean-trained models lose discrimination under every tested perturbation without collapsing, with ROC AUC falling to 0.855–0.864 under Salt-and-Pepper across model families.Logistic regression falls from ROC AUC 0.904 clean to 0.862 under FGSM/PGD and 0.870 under DeepFool; the transformer reaches 0.856 under DeepFool.
Evaluation design: Five-fold and broader stratified cross-validation confirm that the observed vulnerability patterns are not driven by a single train-test split.The study evaluates 1- through 5-fold stratified cross-validation across the same clean-train and attacked-test settings.
Impact of adversarial attacks on clean-trained models: FGSM and PGD reduce predicted defaults, whereas Salt-and-Pepper increases predicted defaults across all three models.For logistic regression, predicted defaults fall from 17,232.2 clean to 15,946.8 under FGSM; for the neural network, they fall from 17,688.0 to 16,617.2.
Adversarial training and cross-attack generalisation: Matched FGSM/PGD adversarial training raises ROC AUC substantially and transfers well between the two gradient-based attacks across all three model families.Neural-network ROC AUC reaches 0.952–0.959, transformer ROC AUC reaches up to 0.980, and logistic-regression ROC AUC reaches 0.947–0.948 on matched tests.
Adversarial training and cross-attack generalisation: Gradient-based training transfers weakly to Salt-and-Pepper corruption, while Salt-and-Pepper training does not strengthen FGSM/PGD resistance.Gradient-trained models attain ROC AUC around 0.852–0.861 on Salt-and-Pepper tests, whereas Salt-and-Pepper training gives the strongest Salt-and-Pepper performance but not cross-family robustness.
Adversarial training and cross-attack generalisation: Mixed training provides the most balanced robustness across attacks while preserving clean performance, matching the best single-attack results for the transformer on FGSM/PGD tests.The transformer reaches clean-test accuracy 0.825, DeepFool accuracy 0.826, and FGSM/PGD accuracy 0.865 with ROC AUC 0.979.

5. Conclusion

The study benchmarks adversarial robustness in P2P credit scoring across model families and attack mechanisms, finding that matched and mixed adversarial training improve resilience while exposing important transfer limits.

Adversarial training substantially improves robustness against the attack family used during training, especially for gradient-based perturbations.These gains are reported across the evaluated credit-scoring models relative to clean-trained baselines under attack.
Salt-and-Pepper training produces smaller robustness gains and transfers less effectively across attack families than gradient-based training.
The benchmark compares logistic regression, feed-forward neural-network, and transformer-based credit models using a systematic multi-attack train–test evaluation.
Robustness profiles differ by architecture and perturbation mechanism, so strong clean accuracy alone does not guarantee resilience under manipulation.
Limitations and future research: The study’s results may not generalise fully beyond the curated Lending Club subset, fixed preprocessing pipeline, and stylised attack models.The authors note boundaries involving other lenders, periods, feature sets, operational constraints, and realistic borrower-fraud mechanisms.
Limitations and future research: Future work should evaluate constraint-aware, black-box, and scenario-based attacks alongside distribution shift, governance, explainability, and compliance requirements.

Appendix A. Cross-validation results

Appendix A reports fold-averaged performance for the three evaluated model families under adversarial training and testing configurations.

Tables A.14–A.16 report mean cross-validation performance for logistic regression, neural-network, and transformer models under adversarial training and testing configurations.Values are fold-averaged and rounded to three decimal digits.

Appendix B. External replication on a second P2P dataset (Prosper)

The Prosper replication preserves the study’s main qualitative robustness patterns while showing that absolute performance and the best-performing architecture can change on a smaller, weaker-signal dataset.

Prosper is roughly an order of magnitude smaller than Lending Club, with test folds of approximately 3,900 versus 62,600 observations.
Clean ROC AUC on Prosper is 0.70–0.71 for all three models, below the 0.90–0.91 reported on Lending Club.
The Prosper replication reproduces matched-training gains, strong transfer within the gradient family, and weak cross-family transfer.The replicated evaluation uses the same model families, attacks, mutable-feature constraints, and mixed regime as the main analysis.
The mixed regime remains the most balanced policy across five test conditions, although matched gradient training achieves higher gradient-test scores on Prosper.The neural network achieves ROC AUC values of 0.699–0.761 across the mixed regime without a catastrophic cell.
Table B.18 presents a complete ROC AUC train-by-test robustness grid, with fold-averaged means, cross-fold standard deviations, and bold matched attack–defence cells.
The feed-forward network gains most from adversarial training on Prosper, whereas the FT-Transformer improves only modestly and logistic regression benefits least.Matched FT-Transformer cells range from 0.712–0.716.