FinSec: A Generative Defensive Agent for Financial Dialogue Security via Multi-Stage Rollout

FinSec: A Generative Defensive Agent for Financial Dialogue Security via Multi-Stage Rollout | Research Square window.SnipcartSettings = { analytics: { enabled: false } }; (function() { var accessVector = localStorage.getItem('access_vector') || ''; window.dataLayer = window.dataLayer || []; if (accessVector) { window.dataLayer.push({ user: { profile: { profileInfo: { snid: accessVector } } } }); } })(); (function(w,d,s,l,i){w[l]=w[l]||[];w[l].push({'gtm.start':new Date().getTime(),event:'gtm.js'});var f=d.getElementsByTagName(s)[0],j=d.createElement(s),dl=l!='dataLayer'?'&l='+l:'';j.async=true;j.src='https://www.googletagmanager.com/gtm.js?id='+i+dl;f.parentNode.insertBefore(j,f);})(window,document,'script','dataLayer','GTM-K279D39R'); Browse Preprints In Review Journals COVID-19 Preprints AJE Video Bytes Research Tools Research Promotion AJE Professional Editing AJE Rubriq About Preprint Platform In Review Editorial Policies Our Team Advisory Board Help Center Sign In Submit a Preprint Cite Share Download PDF Article FinSec: A Generative Defensive Agent for Financial Dialogue Security via Multi-Stage Rollout XIAOTONG JIANG, JUN WU This is a preprint; it has not been peer reviewed by a journal. https://doi.org/ 10.21203/rs.3.rs-8606482/v1 This work is licensed under a CC BY 4.0 License Status: Under Revision Version 1 posted 11 You are reading this latest preprint version Abstract With the rapid adoption of large language models(LLMs) and agents in financial services, ensuring conversational safety under stringent regulatory constraints has become increasingly challenging. However, existing methods typically rely on simple semantic or fixed-rule sets, which are inadequate for dynamic, multi-turn interactions and for specific financial compliance requirements. To address these issues, we propose FinSec, a generative defensive agent with a multi-stage rollout mechanism for financial-agent dialogues. FinSec integrates suspicious behavior pattern detection, delayed-risk and adversarial inference, and semantic safety analysis to risk fusion decision-making, and ultimately to the autonomous generation of structured defensive intervention strategies. This enables structured, interpretable, end-to-end identification of real-world financial risks. While preserving model utility, FinSec significantly improves robustness in detecting high-risk conversations. Experimental results show that FinSec achieves state-of-the-art performance. For overall detection, FinSec attains an F1 score of 90.13%, outperforming baseline models by 6–14%; its attack success rate (ASR) is reduced to 9.09%, significantly limiting unsafe outputs. Furthermore, FinSec achieves about 9.7%improvement in the area under the precision–recall curve (AUPRC) over generic frameworks. Moreover, in the evaluation of the utility–risk trade-off, FinSec reaches a composite score of 0.909, providing strong and efficient safety guarantees for financial-agent conversations. Physical sciences/Engineering Physical sciences/Mathematics and computing Large language models Financial Security Adversarial robustness Autonomous Agent AI safety Full Text Additional Declarations No competing interests reported. Cite Share Download PDF Status: Under Revision Version 1 posted Editorial decision: Revision requested 22 Apr, 2026 Reviews received at journal 07 Mar, 2026 Reviewers agreed at journal 02 Mar, 2026 Reviewers agreed at journal 02 Mar, 2026 Reviews received at journal 02 Mar, 2026 Reviewers agreed at journal 02 Mar, 2026 Reviewers invited by journal 02 Mar, 2026 Editor assigned by journal 02 Mar, 2026 Editor invited by journal 02 Feb, 2026 Submission checks completed at journal 21 Jan, 2026 First submitted to journal 21 Jan, 2026 You are reading this latest preprint version Research Square lets you share your work early, gain feedback from the community, and start making changes to your manuscript prior to peer review in a journal. As a division of Research Square Company, we’re committed to making research communication faster, fairer, and more useful. We do this by developing innovative software and high quality services for the global research community. Our growing team is made up of researchers and industry professionals working together to solve the most critical problems facing scientific publishing. Also discoverable on Platform About Our Team In Review Editorial Policies Advisory Board Help Center Resources Author Services Accessibility API Access RSS feed Manage Cookie Preferences © Research Square 2026 | ISSN 2693-5015 (online) Privacy Policy Terms of Service Do Not Sell My Personal Information {"props":{"pageProps":{"initialData":{"identity":"rs-8606482","acceptedTermsAndConditions":true,"allowDirectSubmit":false,"archivedVersions":[],"articleType":"Article","associatedPublications":[],"authors":[{"id":600680047,"identity":"adbc0129-4f36-4f54-bd4c-68c60d897ecf","order_by":0,"name":"XIAOTONG JIANG","email":"","orcid":"","institution":"Waseda University","correspondingAuthor":false,"prefix":"","firstName":"XIAOTONG","middleName":"","lastName":"JIANG","suffix":""},{"id":600680048,"identity":"26fb760b-01cf-4a87-98b8-03a73c6ff0c4","order_by":1,"name":"JUN WU","email":"data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZAAAAAyAQMAAABI0h/eAAAABlBMVEX///8AAABVwtN+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAA10lEQVRIiWNgGAWjYBACxgYQWQHEzAiBBCK0nCFFC0RZG7oZ+ADzjNxj0rzz7OTM2RnYJH78sZHtb2B49gCvBTPy0qR5tyUbWzYzsEn2tqUZzzjAkG6AX0uO2W3ebcyJGw4zsN3gbTic2HCAIU2CsJY59WAtN//8+Z84nzgtQMNBWm7zsB1I3EBQS88b859zjh03NjjM2P5bti3ZeONhAn4xbM8xNnhTUy1ncP7wYcM3f+xk5x3vSXuAV0sDwkIok5knDZ8OBnksYuzH8GoZBaNgFIyCEQcAq9hLRVJaFAEAAAAASUVORK5CYII=","orcid":"","institution":"Waseda University","correspondingAuthor":true,"prefix":"","firstName":"JUN","middleName":"","lastName":"WU","suffix":""}],"badges":[],"createdAt":"2026-01-15 03:38:04","currentVersionCode":1,"declarations":"","doi":"10.21203/rs.3.rs-8606482/v1","doiUrl":"https://doi.org/10.21203/rs.3.rs-8606482/v1","draftVersion":[],"editorialEvents":[],"editorialNote":"","failedWorkflow":false,"files":[{"id":104403088,"identity":"8be70755-513b-4669-98cf-ca81d348e6ca","added_by":"auto","created_at":"2026-03-11 12:17:27","extension":"pdf","order_by":1,"title":"","display":"","copyAsset":false,"role":"manuscript-pdf","size":6900095,"visible":true,"origin":"","legend":"","description":"","filename":"FinSecSciRep1.pdf","url":"https://assets-eu.researchsquare.com/files/rs-8606482/v1_covered_97290f7b-31e6-4dae-a313-fd307a8be53b.pdf"}],"financialInterests":"No competing interests reported.","formattedTitle":"FinSec: A Generative Defensive Agent for Financial Dialogue Security via Multi-Stage Rollout","fulltext":[],"fulltextSource":"","fullText":"","funders":[],"hasAdminPriorityOnWorkflow":false,"hasManuscriptDocX":false,"hasOptedInToPreprint":true,"hasPassedJournalQc":"","hasAnyPriority":false,"hideJournal":false,"highlight":"","institution":"","isAcceptedByJournal":false,"isAuthorSuppliedPdf":true,"isDeskRejected":"","isHiddenFromSearch":false,"isInQc":false,"isInWorkflow":false,"isPdf":true,"isPdfUpToDate":true,"isWithdrawnOrRetracted":false,"journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true},"keywords":"Large language models, Financial Security, Adversarial robustness, Autonomous Agent, AI safety","lastPublishedDoi":"10.21203/rs.3.rs-8606482/v1","lastPublishedDoiUrl":"https://doi.org/10.21203/rs.3.rs-8606482/v1","license":{"name":"CC BY 4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"manuscriptAbstract":"With the rapid adoption of large language models(LLMs) and agents in financial services, ensuring conversational safety under stringent regulatory constraints has become increasingly challenging. However, existing methods typically rely on simple semantic or fixed-rule sets, which are inadequate for dynamic, multi-turn interactions and for specific financial compliance requirements. To address these issues, we propose FinSec, a generative defensive agent with a multi-stage rollout mechanism for financial-agent dialogues. FinSec integrates suspicious behavior pattern detection, delayed-risk and adversarial inference, and semantic safety analysis to risk fusion decision-making, and ultimately to the autonomous generation of structured defensive intervention strategies. This enables structured, interpretable, end-to-end identification of real-world financial risks. While preserving model utility, FinSec significantly improves robustness in detecting high-risk conversations. Experimental results show that FinSec achieves state-of-the-art performance. For overall detection, FinSec attains an F1 score of 90.13%, outperforming baseline models by 6–14%; its attack success rate (ASR) is reduced to 9.09%, significantly limiting unsafe outputs. Furthermore, FinSec achieves about 9.7%improvement in the area under the precision–recall curve (AUPRC) over generic frameworks. Moreover, in the evaluation of the utility–risk trade-off, FinSec reaches a composite score of 0.909, providing strong and efficient safety guarantees for financial-agent conversations.","manuscriptTitle":"FinSec: A Generative Defensive Agent for Financial Dialogue Security via Multi-Stage Rollout","msid":"","msnumber":"","nonDraftVersions":[{"code":1,"date":"2026-03-05 17:32:07","doi":"10.21203/rs.3.rs-8606482/v1","editorialEvents":[{"type":"communityComments","content":0},{"type":"decision","content":"Revision requested","date":"2026-04-22T07:27:21+00:00","index":"","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-03-07T14:33:29+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"224009032251439292657802079650543600137","date":"2026-03-02T15:15:00+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"272927731405154261779592547082106970216","date":"2026-03-02T14:26:28+00:00","index":"hide","fulltext":""},{"type":"editorInvitedReview","content":"","date":"2026-03-02T13:56:59+00:00","index":"hide","fulltext":""},{"type":"reviewerAgreed","content":"326730159734176958160399838574380350132","date":"2026-03-02T13:56:10+00:00","index":"hide","fulltext":""},{"type":"reviewersInvited","content":"","date":"2026-03-02T13:03:39+00:00","index":"","fulltext":""},{"type":"editorAssigned","content":"","date":"2026-03-02T09:39:54+00:00","index":"","fulltext":""},{"type":"editorInvited","content":"","date":"2026-02-02T09:32:24+00:00","index":"","fulltext":""},{"type":"checksComplete","content":"","date":"2026-01-22T02:54:42+00:00","index":"","fulltext":""},{"type":"submitted","content":"Scientific Reports","date":"2026-01-22T02:51:53+00:00","index":"","fulltext":""}],"status":"published","journal":{"display":true,"email":"[email protected]","identity":"scientific-reports","isNatureJournal":false,"hasQc":true,"allowDirectSubmit":false,"externalIdentity":"scirep","sideBox":"Learn more about [Scientific Reports](http://www.nature.com/srep/)","snPcode":"","submissionUrl":"","title":"Scientific Reports","twitterHandle":"","acdcEnabled":true,"dfaEnabled":true,"editorialSystem":"stoa","reportingPortfolio":"Scientific Reports","inReviewEnabled":true,"inReviewRevisionsEnabled":true}}],"origin":"","ownerIdentity":"663e77ff-a755-4c93-ae23-a76eef33fde4","owner":[],"postedDate":"March 5th, 2026","published":true,"recentEditorialEvents":[],"rejectedJournal":[],"revision":"","amendment":"","status":"in-revision","subjectAreas":[{"id":63923222,"name":"Physical sciences/Engineering"},{"id":63923223,"name":"Physical sciences/Mathematics and computing"}],"tags":[],"updatedAt":"2026-04-22T07:39:44+00:00","versionOfRecord":[],"versionCreatedAt":"2026-03-05 17:32:07","video":"","vorDoi":"","vorDoiUrl":"","workflowStages":[]},"version":"v1","identity":"rs-8606482","journalConfig":"researchsquare"},"__N_SSP":true},"page":"/article/[identity]/[[...version]]","query":{"redirect":"/article/rs-8606482","identity":"rs-8606482","version":["v1"]},"buildId":"XKTyCvWXoU3ODBz1xrDgd","isFallback":false,"isExperimentalCompile":false,"dynamicIds":[84888],"gssp":true,"scriptLoader":[]}