A demand forecaster was judged to face no adaptive adversary: what product change flips that verdict?

## A verdict, not a property "This deployment does not face an adaptive adversary" is a defensible engineering conclusion and a useful one: it is what lets you decline to spend a quarter of engineering hours on robustness work that would buy nothing here. But it is a conclusion about a *configuration*, not about a model. The model is unchanged when the configuration changes, and the configuration changes for product reasons that have nothing to do with security. The senior skill is knowing which facts the verdict rests on, writing them down beside the verdict, and naming the events that oblige a re-check. ## The four load-bearing facts **1. Who writes the inputs, and are they attributable.** In the original assessment, the only outside writer is a contracted supplier submitting documents under their own account. That single fact prices the attack: it is traceable, it is a contract breach as well as a manipulation, and there is a relationship at stake. The change that removes it is a familiar product move: a self-serve onboarding portal, a marketplace where any registered seller submits catalogue and lead-time data, an ingested third-party or public feed with no signature and no accountable author. The moment an input has an anonymous or free-to-create writer, the cost side of the adversary's calculation collapses. **2. Is the decision reversible, and does a human sit on the costly path.** The approval threshold and the cancellation window are what stop a moved forecast from being money. Product will erode both for good reasons: buyers complain about approval load so the threshold rises; a supplier demands firm orders so the cancellation window is dropped; a new category ships with automatic ordering and no equivalent controls. Each of those converts a bounded nuisance into a bankable loss, and it is the single most common way this verdict goes stale. **3. What a wrong output is worth to the writer.** A model that reorders low-value consumables and one that commits seven figures of seasonal stock have the same architecture and completely different adversary pictures. Expanding the forecaster to higher-value lines, to a category with thin margins where a competitor benefits from a stock-out, or to a decision that is itself the product, all raise the payoff without changing a line of model code. **4. What comes back to the writer, and how fast.** In the original picture the supplier sees only the purchase order that eventually arrives: one coarse, delayed observation per cycle. Anything that speeds or enriches that loop is a material change. Publishing forecasts to suppliers in a portal, exposing a planning API, showing a confidence band or an explanation of which factors drove a quantity, all convert a blind adversary into one who can search. Handing out the model itself, in a partner integration or an on-device deployment, is the extreme version: parameters in the writer's hands make every input change cheap to evaluate offline before it is ever submitted. ## How to record it so it survives Write the assessment as a short conditional statement rather than a verdict line: no unattributable writer on any input; every automatic action reversible for a stated window; a human approval above a stated value; nothing returned to the writer but the eventual order. Attach the re-check triggers to the things that actually change those clauses: a new input source, a new ingestion channel, a change to the approval threshold or the window, a new category with a higher order value, any new surface that shows model output to an outside party, any distribution of the model outside your infrastructure. Those triggers are worth wiring to the events that already exist in an engineering organisation, so the re-check is prompted rather than remembered. ## What the verdict never covered Two boundaries keep the answer honest. - **No adaptive adversary is not no failure.** The same wrong order arrives from a broken feed, a unit mix-up or a genuine demand shock. Input validation, sanity bounds and reversibility earn their keep with no adversary in the picture at all, which is part of why they were the better buy. - **No adaptive adversary today is not a guarantee about tomorrow's incentives.** The four facts above are the ones you control. A change in the market, such as a shortage that makes an inflated lead time genuinely profitable to declare, changes the payoff without anyone shipping anything. That is the argument for a periodic re-check rather than a purely event-driven one. ## What an interviewer is listening for Not a list of attacks. They want to hear that you treated "no adaptive adversary" as a dated, conditional finding with named dependencies; that you can say which product decisions invalidate it; and that you know the most likely one is not an exotic ML change but somebody quietly raising an approval threshold to reduce a buyer's workload.