REVIEW 3 major objections 5 minor 2 references
Artificial intelligence and cybersecurity in banking sector: opportunities and risks
T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash
Pith's one-line read The paper argues that banks adopting machine learning must secure the models themselves, because adversarial attacks and dual-use AI tools target training data, predictions, and model structure.
desk verdict A competent narrative review of known ML security threats in banking, undermined by an unsourced anecdote presented as fact; no new research but not misleading in its core recommendations. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The framework that carries the argument is the attack taxonomy and the model-property checklist. Adversarial attacks—data extraction, data poisoning, model extraction, and evasion—are organized by attacker access, from black-box to white-box and grey-box, and the paper pairs them with required model properties: security, trust, resilience, and robustness. This pairing lets the authors convert general AI-risk talk into a specific recommendation: train on adversarial examples, simulate attacks, and assess vulnerabilities before deployment.
What would settle it
A systematic audit of public banking cyber-incident reports from 2019 to 2024 that finds no confirmed data-poisoning or evasion attack against a fraud-detection model would undercut the paper's premise that these attacks are an immediate danger; a benchmark showing adversarial training markedly worsens accuracy on clean transaction data would test whether its main defense is affordable.
Extended reading notes
Core claim
On the paper's own terms, the central claim is that machine learning in banking is a double-edged surface: it improves fraud detection, decision-making, and customer service, but its dependence on training data and learned boundaries exposes it to data poisoning, evasion, extraction, and model inversion, while generative AI gives attackers scalable phishing tools. The conclusion is that secure deployment is conditional on building models with security, trust, resilience, and robustness, and on continuous defensive research. The paper is a synthesis rather than an experiment, and its contribution is to reframe banking AI adoption as a cybersecurity problem with machine-learning-specific defenses.
Load-bearing premise
The paper's urgency assumes that adversarial attacks demonstrated in machine-learning research actually reach real banking systems; its only concrete banking incident of data poisoning is presented without a source.
Editorial extensions
If this is right
- Banks should treat fraud-detection, credit-scoring, and customer-service machine-learning models as attack surfaces and budget for adversarial training and model validation before deployment.
- Security testing should include simulations of black-box, white-box, and grey-box attacks, because the attacker's level of access determines which defenses are needed.
- Generative AI tools should not be deployed in banking without safeguards, since they are dual-use and can automate phishing and malicious content.
- Regulators should expect machine-learning-specific security requirements, not just data-protection rules, because data poisoning and extraction target the model itself.
- Defensive research must continue after deployment, because attackers adapt and evasion techniques evolve over time.
Reading between the lines
- A reader should not infer from the text that data-poisoning attacks on bank fraud models are documented events, because the one concrete banking example given in Section 4.2 is presented without a source; the paper's urgency would be stronger with verified incident data.
- If adversarial robustness becomes a regulatory requirement, the likely near-term effect is higher model-development costs and slower AI rollouts for smaller banks, since defensive training and evaluation require additional data, expertise, and testing time.
- A testable extension would be to benchmark fraud-detection models with and without adversarial training on perturbed transaction streams; the paper implies but does not show that robustness can be added without unacceptable accuracy loss on clean data.
- The same framework transfers to other critical sectors such as healthcare, energy, and payments infrastructure, where the banking-specific language can be replaced by sector-specific model inventories and threat models.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. This paper is a short narrative review of artificial intelligence and machine learning applications in the banking sector and the associated cybersecurity risks. It opens with industry statistics on AI adoption, surveys ML use cases in fraud detection, customer service, and intrusion detection, and then catalogs attacks on ML models, including data extraction, data poisoning, model extraction, and evasion attacks. It closes with a recommendation that banks invest in adversarial training, robust model validation, and continuous defensive research before and during ML deployment. The manuscript contains no original experiments, datasets, equations, or systematic methodology; its support is a selective assembly of industry reports and academic references.
Significance. If the paper's claims were fully supported, it would provide a concise and accessible overview for banking practitioners and policymakers, and its general recommendation to prioritize secure, robust ML development is consistent with a broad cybersecurity literature. The paper's strengths are its clear organization and its use of recent industry sources such as Gartner and Kaspersky, alongside standard ML security references. However, it makes no original contribution, and as detailed in the major comments, its most banking-specific supporting example is unsourced and its argument for transferring generic ML attack findings to banking systems is not developed. The practical significance is therefore modest: the recommendations are plausible but not grounded in a systematic or banking-specific evidence base.
major comments (3)
- [§4.2] The sentence 'An example of a data poisoning attack occurred in a financial institution where attackers manipulated training data for fraud detection, resulting in the system approving fraudulent transactions as legitimate' is stated twice, verbatim, and it is given no citation or verifiable detail such as the institution, date, or source. This is presented as a factual occurrence and is the only concrete banking-specific example in the paper. Because the urgency of the recommendation depends on such incidents being real or representative, the authors should either provide a reliable source for this incident or explicitly relabel it as a hypothetical illustrative scenario.
- [§4.2 and §5] The paper extrapolates from adversarial-example research in computer vision, such as pixel perturbations in Goodfellow et al. (2014b) and pose changes in Alcorn et al. (2019), to the banking sector without discussing whether those attack modes transfer to real banking ML pipelines, which typically use tabular feature spaces, automated decision rules, and human-in-the-loop review. This transfer is load-bearing for the recommendation that banks should invest heavily in adversarial training and robust validation. The authors should either cite banking-specific studies on adversarial ML or explicitly state the transfer assumption and discuss its limitations.
- [§5 and References] The manuscript is presented as a synthesis of evidence, but it gives no methodological account of how sources were selected, no inclusion or exclusion criteria, and no quality assessment of the cited works. Consequently, the 'findings' in Section 5 are based on a selective narrative rather than a systematic review. If this is intended as a narrative or position paper, the authors should say so and temper the force of the conclusions; if it is intended to be systematic, a methods subsection is required.
minor comments (5)
- [§4.2] The unsourced data-poisoning example appears twice in the same section; one of the two occurrences should be removed.
- [§4.2 and References] The name 'Kobal' appears in the text while the reference list has 'Koball'; this should be made consistent.
- [Footnotes] The affiliation footnote spells 'Faculty' as 'Faculry'; this should be corrected.
- [Abstract and §4 heading] The abstract contains the typo 'espcially' and the Section 4 heading spells 'INTELIGENCE' for 'INTELLIGENCE'; these should be corrected.
- [§4.2] The phrase 'Gray B ox' has an erroneous space and should read 'Gray Box'.
Circularity Check
No circularity: the paper is a literature-based review with no derivation, fitted parameters, or predictions that reduce to their own inputs.
full rationale
This manuscript is a narrative survey of AI/ML applications and cyber risks in banking. It contains no equations, no fitted parameters, no computational derivations, and no quantitative predictions that could be equivalent to inputs by construction. The central recommendation—that banks should invest in adversarial training and robust model validation—is argued from external sources such as Goodfellow et al. (2014), Khadka et al. (2024), Koball et al. (2024), and Gartner reports rather than from the paper's own outputs. The two self-citations (Kovačević 2023 and Radenković et al. 2023) are used for background statements about machine learning categories and staged AI adoption in banking; neither self-citation carries the central defensive-strategy claim, and no uniqueness theorem or fitted result is imported from them. The repeated unsourced anecdote in Section 4.2 about a data-poisoning attack on a financial institution is a factual-evidence weakness, not circularity: it is an unverified empirical premise, not a step that reduces to its own conclusion. Therefore no circular step can be exhibited with the required specificity, and the honest finding is no significant circularity.
Assumptions & free parameters
assumptions (3)
- domain assumption The taxonomy of ML attacks (data extraction, data poisoning, model extraction, evasion) and black/white/gray-box categories is accepted as given.
- domain assumption Adversarial perturbations that are imperceptible to humans can change ML model outputs, and this threat generalizes to banking applications.
- domain assumption Industry surveys from Gartner and Kaspersky accurately reflect the state and trajectory of AI adoption and cyber threats in banking.
Cite this review
Pith. "Pith review of Artificial intelligence and cybersecurity in banking sector: opportunities and risks." pith.science (2026). https://pith.science/paper/YA6QOIO3
@misc{pith2026241204495,
author = {Pith},
title = {Pith review of: Artificial intelligence and cybersecurity in banking sector: opportunities and risks},
year = {2026},
howpublished = {\url{https://pith.science/paper/YA6QOIO3}},
note = {Machine review of arXiv:2412.04495}
}
read the original abstract
The rapid advancements in artificial intelligence (AI) have presented new opportunities for enhancing efficiency and economic competitiveness across various industries, espcially in banking. Machine learning (ML), as a subset of artificial intelligence, enables systems to adapt and learn from vast datasets, revolutionizing decision-making processes, fraud detection, and customer service automation. However, these innovations also introduce new challenges, particularly in the realm of cybersecurity. Adversarial attacks, such as data poisoning and evasion attacks, represent critical threats to machine learning models, exploiting vulnerabilities to manipulate outcomes or compromise sensitive information. Furthermore, this study highlights the dual-use nature of AI tools, which can be used by malicious users. To address these challenges, the paper emphasizes the importance of developing machine learning models with key characteristics such as security, trust, resilience and robustness. These features are essential to mitigating risks and ensuring the secure deployment of AI technologies in banking sectors, where the protection of financial data is paramount. The findings underscore the urgent need for enhanced cybersecurity frameworks and continuous improvements in defensive mechanisms. By exploring both opportunities and risks, this paper aims to guide the responsible integration of AI in the banking sector, paving the way for innovation while safeguarding against emerging threats.
Reference graph
Works this paper leans on
-
[6]
Why is the Finance Sector a Target for Cyber Attacks?
https://doi.org/10.3390/electronics9061017 Buchanan, A. B. (n.d.). A National Security Research Agenda for Cybersecurity and Artificial Intelligence CSET Issue Brief. Chin, K. (2 024). “Why is the Finance Sector a Target for Cyber Attacks?”, UpGuard. Online: https://www.upguard.com/blog/finance-sector-cyber-attacks Gartner. (2024a, a). 2024 Board of Direc...
-
[9763]
https://doi.org/10.1007/s00500-021-05893-0 Kovačević, A. (2023). Mašinsko Učenje i Sajber Bezbednost. Zbornik Radova Sa Konferencije Strateški i Normativni Okvir Republike Srbije Za Reagovanje Na Savremene Bezbednosne Rizike . https://scholar.google.com/scholar?cluster=5529511828921685811&hl=en&inst=10367 705725260204636&oi=scholarr Li, Y., Yang, X., Wu, ...
arXiv 2023
Reviewed August 12, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.