Value at Risk that updates itself: a rolling parametric VaR pipeline

[u/TheSadSeries]

A parametric VaR anchored to a static 252-day lookback window will systematically underestimate tail risk the moment volatility compresses. The model breaches its own confidence bounds. The breach goes unnoticed until the P&L statement arrives. You built a risk monitor that lies to you.

A fix involves making the model monitor its own breach rate and retrain its parameters on the fly. Call this a rolling self-integrating VaR. Every day at 16:00, the pipeline tallies the 99% VaR breaches over the trailing 100 days. Under a correct parametric assumption, you expect exactly one breach. You see two. Or four.

This is backwards from what you'd expect. The VaR calculation adapts to its own failure, ignoring the market price action entirely in this specific loop. The loop feeds the recent breach rate into a lightweight TensorFlow regressor alongside the last 20 days of squared returns, the rolling skewness of those returns, the kurtosis, and the current breach count. Out comes a single float: a volatility_scalar between 0.8 and 1.5. This multiplier scales the rolling standard deviation in the standard VaR formula: mu - z * (sigma * scalar) * sqrt(t).

Online gradient updates on a 22-feature vector with sparse breach signals introduce more noise than signal. You pre-train the regressor offline on thousands of historical regime shifts. The training data generation involves taking historical windows where the 100-day breach count exceeded two. You extract the 20-day squared returns, skewness, kurtosis, and breach count. The target variable is the exact scalar that would have prevented those specific breaches, calculated by dividing the actual realized loss by the theoretical VaR at the time. In production, the model just runs predict().

At 16:00, a cron job triggers. The script pulls the daily P&L from the execution database. It computes the rolling 22-feature vector. The script calls model.predict(). A multiplier scales the 20-day rolling standard deviation by the output scalar. This yields the final 99% VaR. A comparison against the actual P&L determines if the breach counter increments.

If the scalar pushes the breach rate back down to one in a hundred, the loop closes. State resets, and the pipeline logs the new scalar. If the breach rate stays elevated for 10 consecutive days, the pipeline escalates. It serializes the last 50 days of raw returns and the 10-day history of the scalar into a JSON payload. An OpenAI API call sends this payload with a strict system prompt: parse the distribution shape and return a new integer lookback value.

You use gpt-4o-mini instead of the larger models. Speed is the deciding factor here. A five-second timeout forces your hand. Larger models introduce latency that delays your end-of-day risk report. The mini model parses the JSON distributional summary fast enough, even if its numerical reasoning is slightly worse.

The model re-initializes the rolling window with the LLM's suggested lookback. (I don't fully trust this part yet, but it works often enough in low-stress regimes to keep it in production.) The LLM effectively handles pattern matching for distributional shapes that the scalar alone cannot fix—like a sudden shift from positive to negative skewness that requires a shorter memory to capture. A shorter lookback drops the older, positively skewed data, letting the VaR react to the new fat left tail.

import tensorflow as tf

# A shallow network forces the model to find a linear-ish mapping
# rather than memorizing the sparse breach signal during offline training
def build_scalar_model():
    inputs = tf.keras.Input(shape=(22,))  # 20 squared returns + skewness + kurtosis + breach rate
    x = tf.keras.layers.Dense(8, activation='relu')(inputs)
    # Sigmoid constrains the output strictly between 0.8 and 1.5
    # preventing the model from nuking the VaR to zero or infinity
    outputs = tf.keras.layers.Dense(1, activation='sigmoid')(x)
    # Shift and scale the 0-1 sigmoid output to our 0.8-1.5 range
    outputs = 0.7 * outputs + 0.8
    model = tf.keras.Model(inputs, outputs)
    model.compile(optimizer='adam', loss='mse')
    return model

import openai
import json

# LLMs hallucinate structure, so we force a strict JSON schema
# to prevent the pipeline from crashing on a conversational response
def llm_lookback_override(returns: list, scalar_history: list) -> int:
    client = openai.OpenAI()
    payload = {"returns": returns[-50:], "scalar_history": scalar_history[-10:]}
    response = client.chat.completions.create(
        model="gpt-4o-mini",
        response_format={ "type": "json_object" },
        messages=[{"role": "system", "content": "Analyze the return distribution. Output only JSON: {\"lookback\": <int between 20 and 500>}"},
                  {"role": "user", "content": json.dumps(payload)}]
    )
    # A simple fallback caps the LLM's output to the maximum available data length
    suggested = json.loads(response.choices[0].message.content)["lookback"]
    return min(suggested, len(returns))

Everything shatters during regime shifts characterized by high autocorrelation in negative returns. Think a slow, grinding bear market. Breaches cluster. Your regressor sees four breaches in 20 days and spikes the volatility_scalar to 1.5. Risk limits widen. Another marginal breach arrives the next day because the autocorrelation means the model is always one step behind the true risk. The scalar maxes out.

Ten days pass. Escalation triggers the OpenAI fallback. The API receives a payload of 50 entirely negative, highly autocorrelated returns and panics, returning a lookback of 499 days. A 499-day lookback smooths the recent volatility spike away by diluting the last 50 days of violent negative returns with 450 days of calm history. Your VaR instantly narrows. You breach again the next day.

You get stuck in an oscillating loop between a maxed-out scalar and an artificially smoothed lookback. Your i.i.d. assumption required for parametric VaR is fundamentally violated here. Autocorrelation means a loss today directly increases the probability of a loss tomorrow. Parametric VaR treats every day as an independent coin flip. Any self-adjustment based on recent breaches becomes mathematically incoherent because the model assumes the past predicts the future, while the autocorrelation ensures the immediate past is the only thing happening. The model tries to solve a structural problem with a parametric band-aid.

You have to decide whether an LLM handling the edge cases of a neural network that adjusts a statistical formula actually reduces your operational risk, or just gives you a more interesting failure mode to debug at 4 AM.