A forecaster's automatic orders are cancellable for 24 hours: what does that take from a supplier skewing its inputs?

## Two different purchases When a team says "we should make this model robust", they are usually proposing to change the model so its output does not move under some family of input changes. That is one way to spend a fixed defence budget. Containment is another: leave the model's behaviour alone and bound what a wrong output can cost. A cancellation window and a value threshold that routes large orders to a buyer are containment. The distinction is worth stating precisely, because the two are not substitutes in the same currency. | | What it buys | What it costs | What it misses | | --- | --- | --- | --- | | Robustness training | Output stability inside one stated change family | Clean accuracy on all traffic, plus a multiple on training compute | Anything outside that family, and every non-adversarial failure | | Containment | A ceiling on the loss per wrong output | Buyer time on approvals, a day of working-capital latency, a reversal process | Attacks that stay inside the ceiling and are never looked at | ## What the window changes for the adversary Before containment, the supplier's task is: move the forecast. After it, their task is: move the forecast **and** keep the resulting order below the value threshold **and** keep it unremarkable for the length of the window. Two of those three conditions have nothing to do with the model. They are about whether a human notices. That conversion is the point. It turns an ML-robustness problem into a review-and-reversal problem, and reviews are a mature thing to buy and to audit. It also forces the attack into a shape that is easier to see over time: many small pushes rather than one large one, which shows up as sustained drift in a supplier's declared lead times or in the variance of orders on their lines. ## Why the norm-ball apparatus barely applies here anyway There is a second, more specific reason to be sceptical of the robustness purchase in this deployment. The perturbation machinery that dominates the literature is built for continuous inputs, where an adversary is allowed to move every coordinate by a small amount and the threat model is a norm together with a radius. Supplier document fields are not that. A lead time is a whole number of days; a pack size is a contractual quantity; a price break is a negotiated figure. There is no small epsilon to grant, because the available moves are discrete and are constrained by what a plausible, contractually valid document contains. A robustness result obtained under a continuous perturbation budget does not transfer to that input space, so the line item would buy less than its name suggests even before you ask whether an adversary exists. ## What containment costs, and who pays it Nothing here is free. The value threshold spends a buyer's attention on every order above it, and setting it low enough to matter means spending a lot of attention. The window spends a day of latency in the ordering pipeline and requires a cancellation path that suppliers will accept. The reversal itself has a relationship cost. Those are real, and they are paid out of the same fixed quarterly budget as the robustness work, which is exactly why the comparison has to be made explicitly rather than assumed. ## Where the window does not help Three failure modes deserve naming, because an interviewer will push on them: 1. **Nobody looks.** A window is only a control if an order in it is actually inspected against something. An unmonitored 24 hours is a delay, not a defence. 2. **The threshold is set by value, not by strangeness.** A stream of orders each just under the cap passes every check while the aggregate is badly wrong. Value thresholds do not see aggregates. 3. **The adversary reads the containment.** Any published or guessable threshold becomes a design constraint the adversary optimises under. That is the adaptive move, and it is the residual the window leaves behind. That residual is what watching the shape of submitted inputs is for: sustained one-directional movement in a single counterparty's declared fields, or order variance on their lines that has no matching demand signal. It is a cheaper thing to fund than a robust retraining programme, and it catches the slow version of the attack that containment alone does not. ## The framing to carry into the interview Robustness makes the model harder to move. Containment makes movement worth less. Monitoring makes movement visible. Against an adversary who is slow, blind and attributable, the second and third are usually the better use of the same hours, and saying so with the costs attached is the answer an interviewer is listening for.