BiasMix-Finance: Post-Generation KYC Guardrails for LLM Portfolio Advice

# BiasMix-Finance: Post-Generation KYC Guardrails for LLM Portfolio Advice
Source: [https://arxiv.org/html/2608.28646](https://arxiv.org/html/2608.28646)
###### Abstract

Large language models \(LLMs\) can generate plausible\-sounding ETF portfolios while silently violating basic KYC\-style constraints on risk, fees, and diversification\. This is especially problematic in*agentic*multi\-turn advisory systems, where each draft recommendation can become an action unless guarded by an auditable enforcement layer\. We study a model\-agnostic, asset\-agnostic*post\-generation guardrail*pipeline: \(i\) enforce a strict JSON allocation schema, \(ii\) validate allocations against numeric caps, and \(iii\) when violations occur,*deterministically*project the output to the nearest feasible portfolio via a convex quadratic program \(QCQP\)\. We introduceBiasMix\-Finance \(Mini\), a compact stress\-test benchmark for*constrained decision\-making under biased LLM generations*, with a 16\-ETF universe, three investor profiles, and eight bias prompts\. Across three models and three inference modes \(direct, critique, self\-consistency\), first\-pass generations violate at least one cap in47\.6–85\.7%of test cases \(67\.2%pooled\), but the convex projection layer reduces*final feasibility violations to0%*while requiring only a*small correction distance*\(test pooled medianD=‖w∗−w0‖2=0\.066D=\\\|w^\{\*\}\-w\_\{0\}\\\|\_\{2\}=0\.066\), indicating that the guardrail typically preserves the intent of the original allocation\. We report violation rates and correction distances with confidence intervals, and paired model comparisons with multiple\-testing correction\. To support reproducibility, we release the dataset, prompts, caps, and code in our public GitHub[repository](https://github.com/gauravkukreja06/biasmix-finance)\.

## 1Introduction

Large language models \(LLMs\) are increasingly used to generate financial summaries, recommendations, and portfolio allocations\[[33](https://arxiv.org/html/2608.28646#bib.bib17),[34](https://arxiv.org/html/2608.28646#bib.bib18)\]\. However, in regulated advisory settings, recommendations are expected to reflect customer\-specific facts and suitability obligations\[[12](https://arxiv.org/html/2608.28646#bib.bib31),[13](https://arxiv.org/html/2608.28646#bib.bib32)\]\. In our controlled setting, we operationalize this idea as hard numeric caps on risk, fees, and diversification, which are also standard in constrained portfolio construction\[[21](https://arxiv.org/html/2608.28646#bib.bib9),[19](https://arxiv.org/html/2608.28646#bib.bib8),[6](https://arxiv.org/html/2608.28646#bib.bib3)\]\. Prompting and reasoning\-mode variations \(e\.g\., critique, self\-consistency\) are inherently probabilistic and cannot guarantee constraint satisfaction on every run\[[29](https://arxiv.org/html/2608.28646#bib.bib15),[28](https://arxiv.org/html/2608.28646#bib.bib14),[20](https://arxiv.org/html/2608.28646#bib.bib34)\]\. This motivatespost\-generation enforcement: we treat the LLM output as a draft allocation and apply deterministic verification and repair, combining audit\-style validation with convex feasibility projection\[[24](https://arxiv.org/html/2608.28646#bib.bib30),[26](https://arxiv.org/html/2608.28646#bib.bib20),[6](https://arxiv.org/html/2608.28646#bib.bib3)\]\. Crucially, our goal is*not*to solve a classical portfolio\-optimization problem \(e\.g\., maximizing risk\-adjusted return under constraints\)\[[21](https://arxiv.org/html/2608.28646#bib.bib9),[5](https://arxiv.org/html/2608.28646#bib.bib26),[14](https://arxiv.org/html/2608.28646#bib.bib27)\]\. Instead, we study an*auditing and repair*problem: how to reliably detect and minimally correct*irrational or constraint\-violating*allocations produced by an LLM, while preserving the model’s intended allocation structure as much as possible\[[26](https://arxiv.org/html/2608.28646#bib.bib20),[3](https://arxiv.org/html/2608.28646#bib.bib29),[24](https://arxiv.org/html/2608.28646#bib.bib30)\]\. More broadly, this setting is adjacent to LLM alignment and policy\-following work\[[22](https://arxiv.org/html/2608.28646#bib.bib11),[1](https://arxiv.org/html/2608.28646#bib.bib1)\], but differs because correctness depends on satisfying externally specified constraints that can be verified by deterministic checks\. Because these constraints are externally specified and mechanically checkable, the task is a natural testbed for*post\-hoc verification and repair*pipelines that are model\-agnostic and transferable to other constrained decision\-making domains \(e\.g\., resource allocation, scheduling, or policy compliance\)\. We study a controlled portfolio\-allocation setting: given an ETF universe and a scenario describing \(i\) a risk profile with caps and \(ii\) a bias\-inducing context \(e\.g\., “small\-cap hype”\), the LLM emits portfolio weights under a strict JSON schema\. A key challenge is that biased or preference\-shaping contexts can systematically push generations toward concentrated, high\-volatility, or otherwise non\-compliant allocations\. To evaluate guardrails under these realistic failure modes, we adopt abias\-induction methodology: we programmatically generate scenarios that combine standardized risk profiles with bias “recipes” \(e\.g\., anchoring on a sector, FOMO tilts, inertia, fee neglect\), producing a stress\-test suite for constraint\-violating drafts\. We then measure constraint violations*before*repair and the magnitude of correction required*after*repair\. Our goal is to quantify how much prompt reasoning modes reduce violations*prior*to enforcement, and how much post\-hoc guardrails must change the portfolio to make it compliant\. In this sense, we treat BiasMix\-Finance \(Mini\) as a stress\-test benchmark for*constrained decision\-making under biased generations*, complementing broader evaluation efforts in safe and reliable LLM deployment\. To verify that BiasMix prompts elicit the intended behavioral tilts, Appendix Table[6](https://arxiv.org/html/2608.28646#A3.T6)shows representative first\-pass LLM outputs \(held\-out test\) for each bias recipe\. We focus on post\-generation enforcement, which is especially relevant for*agentic*financial advisors that operate in multi\-turn loops and tool\-call to validate actions\. Section[7](https://arxiv.org/html/2608.28646#S7)discusses how deterministic verify\-and\-repair acts as a governance mechanism inside autonomous advisor systems\.

#### Contributions\.

We emphasize that the contribution is a*methodology and evaluation framework*for deploying LLMs in constrained financial decision workflows, rather than a new optimization technique, the QCQP projection is used as a deterministic repair operator\.

- •Treating LLM outputs as auditable drafts:We treat LLM\-generated allocations as*auditable drafts*that must satisfy explicitly specified, mechanically checkable KYC\-style numeric caps, enabling transparent logging of \(draft, violations, repaired output\) for governance and oversight\.
- •Bias\-induced stress testing as an evaluation primitive:We construct 72 scenario instances \(train/dev/test\) that combine three risk profiles with eight behavioral “bias recipes” and three random seeds, over a fixed 16\-ETF universe\. This controlled design isolates how different prompts and models respond to the same constraints and bias contexts, and makes bias induction itself a reproducible evaluation primitive for constrained decision\-making under LLM outputs\.
- •Deterministic repair as a first\-class safety mechanism:We formalize the feasible set induced by volatility, fee, HHI concentration, and max single\-asset/sector caps, and compute the nearest feasible portfolio via a constrained quadratic program, solved with standard convex optimization tools\[[6](https://arxiv.org/html/2608.28646#bib.bib3),[8](https://arxiv.org/html/2608.28646#bib.bib4),[23](https://arxiv.org/html/2608.28646#bib.bib33),[27](https://arxiv.org/html/2608.28646#bib.bib13)\]\.
- •Reproducible statistical evaluation across splits, models, and modes:We report per\-cap violation rates with Wilson 95% confidence intervals\[[32](https://arxiv.org/html/2608.28646#bib.bib16)\], correction\-distance and metric\-delta confidence intervals via bootstrap\[[11](https://arxiv.org/html/2608.28646#bib.bib5)\], and paired model comparisons on correction distance with Wilcoxon tests plus BH\-FDR correction\[[30](https://arxiv.org/html/2608.28646#bib.bib19),[4](https://arxiv.org/html/2608.28646#bib.bib2)\]\.

## 2Problem Setup

Universe\.Letnndenote the number of ETFs in the universe \(heren=16n=16\) and letw∈ℝnw\\in\\mathbb\{R\}^\{n\}denote portfolio weights\.

Scenario\.Each scenario provides \(i\) a risk profile with caps and \(ii\) a bias context string intended to nudge the model toward potentially non\-compliant allocations\. Caps include an annualized volatility ceilingσcap\\sigma\_\{\\mathrm\{cap\}\}, a weighted\-average expense ratio ceilingfcapf\_\{\\mathrm\{cap\}\}, a concentration ceilinghcaph\_\{\\mathrm\{cap\}\}based on the Herfindahl–Hirschman Index \(HHI\)\[[15](https://arxiv.org/html/2608.28646#bib.bib6),[16](https://arxiv.org/html/2608.28646#bib.bib7)\], and max single\-asset and max single\-sector weight caps\. Such constraints are standard in constrained portfolio construction and are commonly studied as practical overlays on mean–variance style allocations\[[21](https://arxiv.org/html/2608.28646#bib.bib9),[19](https://arxiv.org/html/2608.28646#bib.bib8)\]\.

Model output\.The LLM emits a draft portfoliow0w\_\{0\}\(JSON with nonnegative weights that sum to 1\)\. We compute summary metrics: riskσ⁡\(w\)=w⊤​Σ​w\\sigma\(w\)=\\sqrt\{w^\{\\top\}\\Sigma w\}\[[21](https://arxiv.org/html/2608.28646#bib.bib9)\], feeWAER⁡\(w\)=∑iwi⋅feei\\mathrm\{WAER\}\(w\)=\\sum\_\{i\}w\_\{i\}\\cdot\\mathrm\{fee\}\_\{i\}, and concentrationHHI⁡\(w\)=∑iwi2\\mathrm\{HHI\}\(w\)=\\sum\_\{i\}w\_\{i\}^\{2\}\.

Feasible set\.Let𝒞\\mathcal\{C\}be the set of portfolios satisfying all caps\. A draft is*violating*ifw0∉𝒞w\_\{0\}\\notin\\mathcal\{C\}\.

Post\-generation enforcement\.Whenw0w\_\{0\}violates any cap, we compute the nearest feasible portfolio

w∗=arg⁡minw⁡∥w−w0∥22s\.t\.w∈𝒞,w^\{\*\}=\\arg\\min\_\{w\}\\lVert w\-w\_\{0\}\\rVert\_\{2\}^\{2\}\\quad\\text\{s\.t\.\}\\quad w\\in\\mathcal\{C\},\(1\)and define the correction distance asD=∥w∗−w0∥2D=\\lVert w^\{\*\}\-w\_\{0\}\\rVert\_\{2\}\(Euclidean/L2 distance\)\. Projection operators are a standard way to enforce feasibility under convex constraints\[[6](https://arxiv.org/html/2608.28646#bib.bib3),[10](https://arxiv.org/html/2608.28646#bib.bib24)\], and related portfolio work often uses robust or constrained formulations to stabilize allocations under estimation error\[[5](https://arxiv.org/html/2608.28646#bib.bib26),[14](https://arxiv.org/html/2608.28646#bib.bib27),[2](https://arxiv.org/html/2608.28646#bib.bib28)\]\.

## 3Related Work

#### LLMs for finance\.

Domain\-specific financial LLMs such as BloombergGPT\[[33](https://arxiv.org/html/2608.28646#bib.bib17)\]and open efforts like FinGPT\[[34](https://arxiv.org/html/2608.28646#bib.bib18)\]show strong capability on financial NLP tasks; our focus differs in that we study*hard numeric constraint compliance*for portfolio\-weight outputs rather than text generation accuracy\.

#### Guardrails, auditing, and constrained outputs\.

Safety toolkits and classifiers \(e\.g\., NeMo Guardrails, Llama Guard\)\[[25](https://arxiv.org/html/2608.28646#bib.bib12),[18](https://arxiv.org/html/2608.28646#bib.bib10)\]and alignment methods such as RLHF and Constitutional AI\[[22](https://arxiv.org/html/2608.28646#bib.bib11),[1](https://arxiv.org/html/2608.28646#bib.bib1)\]primarily target content/policy enforcement\. Complementary work emphasizes*auditing*and*verification*of LLM outputs in high\-stakes settings via structured outputs, validation checks, and feedback loops\[[24](https://arxiv.org/html/2608.28646#bib.bib30),[26](https://arxiv.org/html/2608.28646#bib.bib20)\], and constrained/guided decoding provides guarantees for lexical or structural constraints\[[17](https://arxiv.org/html/2608.28646#bib.bib23),[31](https://arxiv.org/html/2608.28646#bib.bib35)\]\. Our setting requires satisfying quantitative constraints naturally expressed as convex restrictions over portfolio weights; this motivates optimization\-based post\-processing as an auditable repair layer\[[6](https://arxiv.org/html/2608.28646#bib.bib3)\]\. We discuss additional related work and context in Appendix[H](https://arxiv.org/html/2608.28646#A8)\.

## 4Methodology

Figure[1](https://arxiv.org/html/2608.28646#S4.F1)summarizes the end\-to\-end BiasMix\-Finance pipeline from scenario construction to deterministic feasibility via projection\[[6](https://arxiv.org/html/2608.28646#bib.bib3),[26](https://arxiv.org/html/2608.28646#bib.bib20)\]\.

![Refer to caption](https://arxiv.org/html/2608.28646v1/figs/fig_pipeline.jpg)Figure 1:End\-to\-end pipeline\.BiasMix scenario \+ bias recipe are composed into a structured prompt\. The LLM generates draft weights \(JSON\)\. We validate JSON and compute portfolio metrics against hard KYC caps\. If any constraint fails, we repair via convex projection \(QCQP\) to the nearest feasible portfolio; otherwise we accept directly\.### 4\.1Universe and scenarios

We construct a synthetic\-but\-controlled scenario suite over a fixed ETF universe ofn=16n=16liquid funds:SPY, VEA, VWO, VGT, XLE, XLF, XLV, XLY, XLP, XLI, XLRE, IWM, AGG, LQD, IEF, GLD\. Each scenario specifies an*as\-of*date \(we use2025\-09\-30\), a risk profile \(Conservative/Moderate/Aggressive\), and a*BiasMix*recipe that nudges the model toward a known behavioral bias \(e\.g\., “anchor tech”, “FOMO energy”, “small\-cap hype”\)\. Recipes are expressed as short natural\-language preferences \(not hard constraints\) so that first\-pass outputs can be either feasible or infeasible\. This design parallels behavioral stress testing in NLP evaluation: the goal is to systematically elicit failure modes under controlled perturbations\[[26](https://arxiv.org/html/2608.28646#bib.bib20)\]\. We generate 72 scenarios across 3 profiles and 8 bias recipes, with*three*random seeds per \(profile, recipe\) cell; split sizes are train/dev/test = 36/15/21, balanced across the three risk profiles \(each profile contributes 12/5/7 to train/dev/test\)\. We use train only for prompt and hyperparameter iteration \(e\.g\., mode temperatures, self\-consistency sample size K, and projection margins\)\. Dev a one\-time check that the tuned pipeline behaves similarly on unseen data\. We report results on test without further tuning\. Table[1](https://arxiv.org/html/2608.28646#S4.T1)summarizes the dataset\. We use train/dev/test splits only to avoid leakage from repeated prompt/solver tuning; split construction details are in Appendix B\.5\.

Table 1:BiasMix scenario breakdown \(72 total\) by risk profile and bias type\. Each \(profile, bias\) cell has 3 scenarios \(3 random seeds\)\.
### 4\.2Risk profiles and hard caps

All caps are defined over the portfolio functions in Section[2](https://arxiv.org/html/2608.28646#S2)\. For each risk profile we fix a cap vectorθ=\(σcap,fcap,hcap,amax,smax\)\\theta=\(\\sigma\_\{\\mathrm\{cap\}\},f\_\{\\mathrm\{cap\}\},h\_\{\\mathrm\{cap\}\},a\_\{\\max\},s\_\{\\max\}\)covering annualized volatility, weighted\-average expense ratio \(WAER\), concentration \(HHI\), and single\-asset / single\-sector limits\. Table[2](https://arxiv.org/html/2608.28646#S4.T2)lists the numerical values used in all experiments\.

Cap rationaleThe caps in Table[2](https://arxiv.org/html/2608.28646#S4.T2)are chosen as representative KYC\-style suitability heuristics inspired by customer\-specific suitability and diversification principles, not jurisdiction\-specific rules\[[12](https://arxiv.org/html/2608.28646#bib.bib31),[13](https://arxiv.org/html/2608.28646#bib.bib32),[19](https://arxiv.org/html/2608.28646#bib.bib8)\]; detailed justification and threshold sensitivity are in Appendix[B\.1](https://arxiv.org/html/2608.28646#A2.SS1)\.

Table 2:Risk\-profile caps used throughout\.σcap\\sigma\_\{\\mathrm\{cap\}\}is annualized volatility, WAER is weighted\-average expense ratio, HHI is concentration,amaxa\_\{\\max\}is max single\-asset weight, andsmaxs\_\{\\max\}is max single\-sector weight\.
### 4\.3Guardrail pipeline

Given a scenario, the model outputs portfolio weightsw0w\_\{0\}under a strict JSON schema\. We validatew0w\_\{0\}; if any constraint in𝒞⁡\(θ\)\\mathcal\{C\}\(\\theta\)is violated, we compute a nearest\-feasible projection:

w∗=arg⁡minw∈𝒞⁡\(θ\)⁡∥w−w0∥22\+λ​w⊤​Σ​w,w^\{\*\}\\;=\\;\\arg\\min\_\{w\\in\\mathcal\{C\}\(\\theta\)\}\\;\\lVert w\-w\_\{0\}\\rVert\_\{2\}^\{2\}\\;\+\\;\\lambda\\,w^\{\\top\}\\Sigma w,\(2\)where feasible set𝒞\\mathcal\{C\}is induced by the hard caps:

𝒞=\{w∈ℝn:𝟏⊤w=1,w≥0,σ\(w\)≤σcap,WAER\(w\)≤fcap,HHI\(w\)≤hcap,maxiwi≤acap,sector\_sum​\(w\)≤scap\}\\mathcal\{C\}=\\left\\\{w\\in\\mathbb\{R\}^\{n\}:\\begin\{aligned\} &\\mathbf\{1\}^\{\\top\}w=1,\\;w\\geq 0,\\\\ &\\sigma\(w\)\\leq\\sigma\_\{\\text\{cap\}\},\\;\\mathrm\{WAER\}\(w\)\\leq f\_\{\\text\{cap\}\},\\\\ &\\mathrm\{HHI\}\(w\)\\leq h\_\{\\text\{cap\}\},\\;\\max\\nolimits\_\{i\}w\_\{i\}\\leq a\_\{\\text\{cap\}\},\\\\ &\\text\{sector\\\_sum\}\(w\)\\leq s\_\{\\text\{cap\}\}\\end\{aligned\}\\right\\\}\(3\)λ=2×10−3\\lambda=2\\times 10^\{\-3\}is a small variance regularizer that discourages solutions sitting exactly on the risk boundary\. We report the*correction distance*D=∥w∗−w0∥2D=\\lVert w^\{\*\}\-w\_\{0\}\\rVert\_\{2\}\(Euclidean norm\)\. We solve the projection as a convex QCQP with standard solvers; numerical stability choices \(PSD jitter\), solver tolerances, fallback strategy, and robustness ablations are reported in the Appendix[D](https://arxiv.org/html/2608.28646#A4)

### 4\.4Models and providers

We evaluate three LLM backends: \(i\)*Gemini 2\.5 Flash*\(gemini\-2\.5\-flash\) via the Google GenAI Python SDK, \(ii\)*GPT\-5 nano*\(gpt\-5\-nano\) via the OpenAI Chat Completions API, and \(iii\) an open\-weight model served through an OpenAI\-compatible endpoint,*Llama 3\.3 70B Instruct Turbo*\(meta\-llama/Llama\-3\.3\-70B\-Instruct\-Turbo\)\.

### 4\.5Inference Strategies \(Modes\)

The unit of analysis is a*scenario*evaluated under a \(model, mode\) configuration\. We evaluate the models across three strategies: \(i\)Directgeneration, where the model is prompted to produce the target JSON output in a single shot; \(ii\)Critique, a multi\-turn approach where the model generates an internal draft and critique before emitting a corrected JSON\[[20](https://arxiv.org/html/2608.28646#bib.bib34)\]; and \(iii\)Self\-consistency \(SC\), whereK=5K=5candidates are sampled, and the candidate with the lowest pre\-projection violation is selected\[[28](https://arxiv.org/html/2608.28646#bib.bib14)\]\. All modes share the same post\-generation projection step when constraints are violated and enforce strict JSON outputs with up to R=3 retries on parse failure; once parsed, weights are validated and projected if needed\. Full decoding and parsing details are in the Appendix[E](https://arxiv.org/html/2608.28646#A5)\.

## 5Experimental protocol and statistical framework

We evaluate each scenario under a \(model, mode\) configuration and measure compliance on the first\-pass draftw0w\_\{0\}and after deterministic repairw∗w^\{\*\}\. Ourprimary endpointsare \(i\) first\-pass violation rate \(per\-cap and any\-cap\) and \(ii\) correction distanceD=∥w∗−w0∥2D=\\lVert w^\{\*\}\-w\_\{0\}\\rVert\_\{2\}\. We additionally report parse\-failure rate and before/after deltas inσ\\sigma, WAER, and HHI\. For violation rates we use Wilson 95% CIs\[[32](https://arxiv.org/html/2608.28646#bib.bib16)\]; forDDand deltas we use bootstrap 95% CIs\[[11](https://arxiv.org/html/2608.28646#bib.bib5)\]\. For paired model comparisons onDDwe use Wilcoxon signed\-rank tests with BH\-FDR correction\[[30](https://arxiv.org/html/2608.28646#bib.bib19),[4](https://arxiv.org/html/2608.28646#bib.bib2),[7](https://arxiv.org/html/2608.28646#bib.bib22)\]\. Full protocol details \(splits, resampling, and multiple\-testing family\) are in Appendix[F](https://arxiv.org/html/2608.28646#A6)\.

## 6Results

### 6\.1First\-pass violations on held\-out test

Table[4](https://arxiv.org/html/2608.28646#A3.T4)and Figure[2](https://arxiv.org/html/2608.28646#S6.F2)report pooled first\-pass violation rates on the test split\. Critique and self\-consistency tend to reduce violations relative to direct prompting, but do not guarantee compliance\. Violation rates are heterogeneous across BiasMix recipes and profiles; Appendix Figs\.[4](https://arxiv.org/html/2608.28646#A3.F4)–[6](https://arxiv.org/html/2608.28646#A3.F6)visualize test\-split violation heatmaps by bias type, profile, and model \(for each prompting mode\)\. Interpreting the magnitudes, prompting alone remains unreliable under hard KYC\-style caps: even the best test setting \(Gemini\+SC\) violates in nearly half of cases \(0\.4760\.476\), while the worst \(Gemini\+direct\) violates most of the time \(0\.8570\.857\)\. Self\-consistency helps most when the feasible region is larger \(Aggressive drops from0\.4760\.476to0\.0480\.048\), but tight regimes remain difficult: Conservative portfolios violate on all test scenarios across models/modes \(1\.01\.0\), motivating a deterministic verify\-and\-repair layer\. The Conservative regime is intentionally*extremely tight*: the intersection of a low volatility cap, a strict HHI concentration cap, and sector/asset limits induces a feasible region that is very small on the simplex\. In practice, this means the admissible set resembles a narrow polytope/conic slice that occupies a tiny fraction of the space of plausible\-looking portfolios\. Because prompting and reasoning modes remain probabilistic, they cannot reliably “hit” such a small feasible region in one shot, even when the generated portfolio appears sensible at a glance\. This is precisely the setting where deterministic post\-generation repair is necessary: it converts an intent\-bearing but infeasible draft into a compliant action while minimizing deviation from the draft, making hard\-cap satisfaction a property of the system interface rather than the sampling behavior of the model\.

### 6\.2Projection yields high final feasibility

Most failures arise at parse time \(invalid JSON\), not at constraint time\. On the held\-out test split, with strict schema prompting and up toR=3R=3retries, we observe*zero parse failures*and*100% post\-projection feasibility*across all models and modes \(Wilson 95% CIs: parse\-fail\[0,0\.155\]\[0,0\.155\], final pass\[0\.845,1\.0\]\[0\.845,1\.0\]; full table in Appendix[C\.2](https://arxiv.org/html/2608.28646#A3.SS2)\)\. Thus, reliability hinges primarily on structured output; once weights are parsed, solver\-based repair enforces constraints deterministically while preserving the LLM as an intent generator\.

### 6\.3How much correction is required?

Table[3](https://arxiv.org/html/2608.28646#S6.T3)quantify the adjustment required to reach feasibility, the corresponding visualization is in Appendix[C\.4](https://arxiv.org/html/2608.28646#A3.SS4)\. LowerDDindicates the model proposed a near\-feasible portfolio\. We interpretDDas a faithfulness signal: smallDDmeans projection only nudges the draft onto the feasible set, while largeDDmeans constraints substantially override the draft\. Consistent with tightness, corrections are smallest for Aggressive \(often near zero, especially with SC\), moderate for Moderate \(roughly0\.0180\.018–0\.1850\.185\), and largest for Conservative \(roughly0\.2200\.220–0\.4620\.462\), aligning with its near\-certain first\-pass violations\. In deployment, largeDDcan be surfaced as “constraint\-forced rebalancing,” while smallDDsupports the claim that guardrails can guarantee compliance without materially changing near\-feasible drafts\. Beyond L2 distance, intent is also preserved at a coarser granularity: Appendix Figs\.[7](https://arxiv.org/html/2608.28646#A3.F7)–[9](https://arxiv.org/html/2608.28646#A3.F9)plot draft vs\. projected*sector*allocations on the test split, with points concentrated near the diagonal\. On the held\-out test split \(pairs=21\), differences are significant indirectandcritiquebut notSC: gpt\-5\-nano vs meta\-llama/Llama\-3\.3\-70B\-Instruct\-Turbo is significant in direct \(pFDR=0\.0292p\_\{\\mathrm\{FDR\}\}\{=\}0\.0292\) and critique \(pFDR=0\.0098p\_\{\\mathrm\{FDR\}\}\{=\}0\.0098\), and Gemini\-2\.5\-flash vs meta\-llama/Llama\-3\.3\-70B\-Instruct\-Turbo is also significant in direct \(pFDR=0\.0669p\_\{\\mathrm\{FDR\}\}\{=\}0\.0669\) and critique \(pFDR=0\.0098p\_\{\\mathrm\{FDR\}\}\{=\}0\.0098\)\. Full results across splits and modes are in Appendix[7](https://arxiv.org/html/2608.28646#A3.T7)\.

Figure 2:Held\-out test: overall first\-pass violation rate \(pooled over profiles\) with Wilson 95% CIs\.Table 3:Test correction distanceDD\(bootstrap 95% CI\)\.D=∥w∗−w0∥2D=\\lVert w^\{\*\}\-w\_\{0\}\\rVert\_\{2\}\(unitless L2 distance on the simplex\); lower values mean the model output was closer to feasible before projection\.

## 7Implications for Agentic Financial AI

FinAI emphasizes*agentic*financial systems: autonomous or semi\-autonomous advisors that interact over multiple turns, call tools, and iteratively refine decisions under constraints\. Although BiasMix\-Finance is evaluated as a post\-generation guardrail for a single draft, the same verify\-and\-repair interface naturally composes with agent loops\. In this view, the LLM is an*intent generator*\(proposal policy\) and the guardrail is an*enforcement tool*that ensures every externally visible action satisfies hard KYC\-style constraints\.

#### Multi\-turn advisor interactions\.

As users update preferences or facts \(e\.g\., fee sensitivity, horizon, concentration tolerance\), a multi\-turn agent can treat each intermediate allocation as a tentative action, run validation and projection, and return a feasible portfolio at*every turn*\. Even if intermediate reasoning is noisy, deployed outputs remain within a clearly specified feasible region\. The correction distanceD=‖w∗−w0‖2D=\\\|w^\{\*\}\-w\_\{0\}\\\|\_\{2\}can be surfaced as an explanation signal for how strongly constraints overruled the draft \(“light nudge” vs\. “constraint\-forced rebalancing”\)\.

#### Iterative correction loops in autonomous agents\.

Agentic systems often operate as repeated propose–check–revise cycles\[[35](https://arxiv.org/html/2608.28646#bib.bib25),[20](https://arxiv.org/html/2608.28646#bib.bib34)\]\. Our pipeline provides a deterministic inner loop: propose an allocation, validate, project to feasibility, and feed the corrected portfolio back into the agent state\. This replaces brittle prompt\-only self\-correction with a tool\-grounded mechanism that enforces admissible actions whenever projection succeeds\.

#### Guardrails as governance mechanisms\.

In regulated settings, governance requires policies that are auditable, stable, and configurable \(e\.g\., per institution, jurisdiction, or product type\)\. Numeric caps and deterministic repair provide a concrete governance layer: constraints are explicit and versionable, and every recommendation can be logged with \(draft, violations, repair, andDD\)\.

#### Feedback adaptation from corrected feasible outputs\.

The \(draft→\\rightarrowprojected\) pairs produced by the guardrail are high\-signal supervision: they encode how a recommendation must change to satisfy policy\. This supports \(1\)*prompt\-level adaptation*that conditions on prior corrections to draft closer\-to\-feasible portfolios \(reducingDD\), and \(2\)*model\-level adaptation*using corrected outputs for fine\-tuning or preference learning, while retaining repair as a backstop\.

#### Regulatory sandboxing for agent\-based financial advisors\.

BiasMix\-Finance can serve as a lightweight*regulatory sandbox*by simulating multi\-turn dialogues: vary the investor profile, inject biased or adversarial instructions, and measure \(i\) first\-pass violation propensity, \(ii\) correction distanceDD, and \(iii\) stability of sector/asset allocations after repair\. Because the enforcement layer is deterministic and policy\-driven, the same sandbox can be repeated under different cap configurations to stress\-test agent behavior as governance tightens or loosens\.

Overall, the contribution is not only a reliable post\-processor for static drafts, but a composable*agent tool*for financial decision\-making: it turns probabilistic proposals into policy\-compliant actions for safer multi\-turn and autonomous advisory workflows\.

## 8Discussion, limitations, and future work

Prompting modes \(direct, critique, self\-consistency\) can reduce first\-pass violations, but they cannot guarantee satisfaction of hard numeric caps because generation remains probabilistic\. In contrast, the post\-generation projection step provides an auditable, model\-agnostic enforcement layer that deterministically returns a feasible portfolio \(when the cap set is feasible\), while minimizing deviation from the model’s proposal\.

Scope and limitations\.This study is intentionally scoped to*constraint compliance and robustness*, not portfolio optimality: we test whether LLM allocations can be made KYC\-feasible under explicit caps and quantify the minimal adjustment required \(correction distanceDD\)\. We therefore do not model expected returns, transaction costs, taxes, or utility\-based objectives\. We use a fixed*16\-ETF*universe as a controlled stress test; the guardrail is not tied to 16 assets and applies to any universe with fees, sector mappings, and a covariance estimate\. We also do not conduct real\-user or advisor\-in\-the\-loop studies, focusing instead on an auditable enforcement mechanism for downstream workflows\.

Additional discussion on universe design and generalization is provided in Appendix[G](https://arxiv.org/html/2608.28646#A7)\.

#### Transferability beyond portfolio allocation\.

The verify and repair pattern studied here applies to a broader class of*agentic financial decision systems*where an LLM proposes a structured action but correctness depends on hard, externally specified constraints\. Examples include budget allocation under category caps, product eligibility and suitability checks, policy\-compliant trade lists \(e\.g\., prohibited assets, minimum lot sizes, concentration and exposure limits\), disclosure and fee\-rule compliance, and structured credit/insurance recommendation drafts that must satisfy underwriting or regulatory rules\. Across these settings, the key systems principle is to separate*proposal generation*\(probabilistic, model\-driven\) from*admissibility enforcement*\(deterministic, auditable\)\. BiasMix\-style stress testing also transfers by inducing known behavioral pressures \(e\.g\., fee neglect, overconfidence, anchoring, recency\) and measuring \(i\) first\-pass violation propensity and \(ii\) the magnitude of repair required to restore compliance\. Thus, the primary contribution is a reusable governance\-oriented framework: explicit constraints, deterministic repair, and measurable faithfulness between draft and compliant action\.

Future work\.Promising extensions include \(i\) scaling to larger universes and adding liquidity/turnover constraints, \(ii\) replacing the fixed covariance with rolling or regime\-aware estimates, \(iii\) incorporating return\-aware or utility\-based objectives while preserving hard caps, and \(iv\) running human\-evaluation studies to assess whether corrected portfolios preserve user intent and improve trust and usability\.

## 9Conclusion

Post\-generation KYC\-style guardrails offer a practical and auditable way to enforce numeric investment constraints on top of LLM\-generated allocations\. Across models and prompting modes, we find that a convex nearest\-feasible projection can eliminate final constraint violations while keeping repairs bounded in L2 distance\. More generally, the same verify\-and\-repair pattern is*model\-agnostic*and*asset\-agnostic*: any LLM that emits a structured decision can be checked against hard constraints and deterministically repaired when needed, making the approach applicable beyond finance\. BiasMix\-Finance \(Mini\) serves as a stress\-test benchmark for constrained decision\-making under bias, enabling controlled comparisons of reasoning modes and models under identical caps and contexts\.

#### LLM usage disclosure\.

We used large language models as auxiliary tools for language polishing and limited code assistance \(e\.g\. code utilities, grammar, and LaTeX formatting\)\. All experimental design, implementation, data collection, analysis, results, and conclusions were produced and verified by the authors, who take full responsibility for the content of this paper\.

## References

- \[1\]Y\. Bai, S\. Kadavath, S\. Kundu, A\. Askell, J\. Kernion, A\. Jones, A\. Chen, A\. Goldie, A\. Mirhoseini, C\. McKinnon,et al\.\(2022\)Constitutional AI: harmlessness from AI feedback\.arXiv preprint arXiv:2212\.08073\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1)\.
- \[2\]A\. Ben\-Tal, L\. E\. Ghaoui, and A\. Nemirovski\(2009\)Robust optimization\.Princeton University Press\.Cited by:[§2](https://arxiv.org/html/2608.28646#S2.p5.2)\.
- \[3\]E\. M\. Bender, T\. Gebru, A\. McMillan\-Major, and S\. Shmitchell\(2021\)On the dangers of stochastic parrots: can language models be too big?\.InProceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency \(FAccT\),Cited by:[§1](https://arxiv.org/html/2608.28646#S1.p1.1)\.
- \[4\]Y\. Benjamini and Y\. Hochberg\(1995\)Controlling the false discovery rate: a practical and powerful approach to multiple testing\.Journal of the Royal Statistical Society: Series B57\(1\),pp\. 289–300\.Cited by:[§F\.4](https://arxiv.org/html/2608.28646#A6.SS4.p1.1),[4th item](https://arxiv.org/html/2608.28646#S1.I1.i4.p1.1),[§5](https://arxiv.org/html/2608.28646#S5.p1.1)\.
- \[5\]F\. Black and R\. Litterman\(1992\)Global portfolio optimization\.Financial Analysts Journal48\(5\),pp\. 28–43\.Cited by:[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§2](https://arxiv.org/html/2608.28646#S2.p5.2)\.
- \[6\]S\. Boyd and L\. Vandenberghe\(2004\)Convex optimization\.Cambridge University Press\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[3rd item](https://arxiv.org/html/2608.28646#S1.I1.i3.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§2](https://arxiv.org/html/2608.28646#S2.p5.2),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1),[§4](https://arxiv.org/html/2608.28646#S4.p1.1)\.
- \[7\]J\. Demšar\(2006\)Statistical comparisons of classifiers over multiple data sets\.Journal of Machine Learning Research7,pp\. 1–30\.Cited by:[§F\.4](https://arxiv.org/html/2608.28646#A6.SS4.p1.1),[§5](https://arxiv.org/html/2608.28646#S5.p1.1)\.
- \[8\]S\. Diamond and S\. Boyd\(2016\)CVXPY: a Python\-embedded modeling language for convex optimization\.Journal of Machine Learning Research17\(83\),pp\. 1–5\.Cited by:[3rd item](https://arxiv.org/html/2608.28646#S1.I1.i3.p1.1)\.
- \[9\]R\. Dror, G\. Baumer, S\. Shlomov, and R\. Reichart\(2018\)The hitchhiker’s guide to testing statistical significance in natural language processing\.InProceedings of the 56th Annual Meeting of the Association for Computational Linguistics \(ACL\),Cited by:[§F\.4](https://arxiv.org/html/2608.28646#A6.SS4.p1.1)\.
- \[10\]J\. Duchi, S\. Shalev\-Shwartz, Y\. Singer, and T\. Chandra\(2008\)Efficient projections onto theℓ1\\ell\_\{1\}\-ball for learning in high dimensions\.InProceedings of the 25th International Conference on Machine Learning \(ICML\),Cited by:[§2](https://arxiv.org/html/2608.28646#S2.p5.2)\.
- \[11\]B\. Efron and R\. Tibshirani\(1993\)An introduction to the bootstrap\.Chapman & Hall/CRC\.Cited by:[§F\.3](https://arxiv.org/html/2608.28646#A6.SS3.p1.1),[4th item](https://arxiv.org/html/2608.28646#S1.I1.i4.p1.1),[§5](https://arxiv.org/html/2608.28646#S5.p1.1)\.
- \[12\]Financial Industry Regulatory Authority\(2012\)FINRA rule 2090: know your customer\.Note:[https://www\.finra\.org/rules\-guidance/rulebooks/finra\-rules/2090](https://www.finra.org/rules-guidance/rulebooks/finra-rules/2090)Adopted by SR\-FINRA\-2010\-039 and amended by SR\-FINRA\-2011\-016, effective July 9, 2012; accessed: 2026\-06\-21Cited by:[§B\.1](https://arxiv.org/html/2608.28646#A2.SS1.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§4\.2](https://arxiv.org/html/2608.28646#S4.SS2.p2.1)\.
- \[13\]Financial Industry Regulatory Authority\(2012\)FINRA rule 2111: suitability\.Note:[https://www\.finra\.org/rules\-guidance/rulebooks/finra\-rules/2111](https://www.finra.org/rules-guidance/rulebooks/finra-rules/2111)Adopted by SR\-FINRA\-2010\-039 and amended by SR\-FINRA\-2011\-016 and SR\-FINRA\-2012\-027, effective July 9, 2012; later amended by SR\-FINRA\-2020\-007, effective June 30, 2020; accessed: 2026\-06\-21Cited by:[§B\.1](https://arxiv.org/html/2608.28646#A2.SS1.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§4\.2](https://arxiv.org/html/2608.28646#S4.SS2.p2.1)\.
- \[14\]D\. Goldfarb and G\. Iyengar\(2003\)Robust portfolio selection problems\.Mathematics of Operations Research28\(1\),pp\. 1–38\.Cited by:[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§2](https://arxiv.org/html/2608.28646#S2.p5.2)\.
- \[15\]O\. C\. Herfindahl\(1950\)Concentration in the steel industry\.Ph\.D\. Thesis,Columbia University\.Cited by:[§2](https://arxiv.org/html/2608.28646#S2.p2.1)\.
- \[16\]A\. O\. Hirschman\(1964\)The paternity of an index\.The American Economic Review54\(5\),pp\. 761–762\.Cited by:[§2](https://arxiv.org/html/2608.28646#S2.p2.1)\.
- \[17\]C\. Hokamp and Q\. Liu\(2017\)Lexically constrained decoding for sequence generation using grid beam search\.InProceedings of the 55th Annual Meeting of the Association for Computational Linguistics \(ACL\),Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px2.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1)\.
- \[18\]H\. Inan, K\. Upasani, J\. Chi, R\. Rungta, K\. Iyer, Y\. Mao, M\. Tontchev, Q\. Hu, B\. Fuller, D\. Testuggine, and M\. Khabsa\(2023\)Llama Guard: LLM\-based input\-output safeguard for human\-AI conversations\.arXiv preprint arXiv:2312\.06674\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1)\.
- \[19\]R\. Jagannathan and T\. Ma\(2003\)Risk reduction in large portfolios: why imposing the wrong constraints helps\.The Journal of Finance58\(4\),pp\. 1651–1683\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px3.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§2](https://arxiv.org/html/2608.28646#S2.p2.1),[§4\.2](https://arxiv.org/html/2608.28646#S4.SS2.p2.1)\.
- \[20\]A\. Madaan, N\. Tandon, P\. Gupta, S\. Hallinan, L\. Gao, S\. Wiegreffe, U\. Alon, N\. Dziri, S\. Prabhumoye, Y\. Yang, S\. Gupta, B\. P\. Majumder, K\. Hermann, S\. Welleck, A\. Yazdanbakhsh, and P\. Clark\(2023\)Self\-refine: iterative refinement with self\-feedback\.arXiv preprint arXiv:2303\.17651\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§4\.5](https://arxiv.org/html/2608.28646#S4.SS5.p1.1),[§7](https://arxiv.org/html/2608.28646#S7.SS0.SSS0.Px2.p1.1)\.
- \[21\]H\. Markowitz\(1952\)Portfolio selection\.The Journal of Finance7\(1\),pp\. 77–91\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px3.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§2](https://arxiv.org/html/2608.28646#S2.p2.1),[§2](https://arxiv.org/html/2608.28646#S2.p3.1)\.
- \[22\]L\. Ouyang, J\. Wu, X\. Jiang, D\. Almeida, C\. L\. Wainwright, P\. Mishkin, C\. Zhang, S\. Agarwal, K\. Slama, A\. Ray, J\. Schulman, J\. Hilton, F\. Kelton, L\. Miller, M\. Simens, A\. Askell, P\. Welinder, P\. Christiano, J\. Leike, and R\. Lowe\(2022\)Training language models to follow instructions with human feedback\.arXiv preprint arXiv:2203\.02155\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1)\.
- \[23\]B\. O’Donoghue, E\. Chu, N\. Parikh, and S\. Boyd\(2016\)Conic optimization via operator splitting and homogeneous self\-dual embedding\.Journal of Optimization Theory and Applications169\(3\),pp\. 1042–1068\.Cited by:[§D\.1](https://arxiv.org/html/2608.28646#A4.SS1.p1.1),[§D\.2](https://arxiv.org/html/2608.28646#A4.SS2.p1.1),[3rd item](https://arxiv.org/html/2608.28646#S1.I1.i3.p1.1)\.
- \[24\]I\. D\. Raji, A\. Smart, R\. N\. White, M\. Mitchell, T\. Gebru, B\. Hutchinson, J\. Smith\-Loud, D\. Theron, and P\. Barnes\(2020\)Closing the AI accountability gap: defining an end\-to\-end framework for internal algorithmic auditing\.InProceedings of the 2020 ACM Conference on Fairness, Accountability, and Transparency \(FAccT\),Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1)\.
- \[25\]T\. Rebedea, R\. Dinu, M\. N\. Sreedhar, C\. Parisien, and J\. Cohen\(2023\)NeMo Guardrails: a toolkit for controllable and safe LLM applications with programmable rails\.InProceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations,Singapore,pp\. 431–445\.External Links:[Document](https://dx.doi.org/10.18653/v1/2023.emnlp-demo.40)Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1)\.
- \[26\]M\. T\. Ribeiro, T\. Wu, C\. Guestrin, and S\. Singh\(2020\)Beyond accuracy: behavioral testing of NLP models with CheckList\.InProceedings of the 58th Annual Meeting of the Association for Computational Linguistics \(ACL\),Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px1.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1),[§4\.1](https://arxiv.org/html/2608.28646#S4.SS1.p1.1),[§4](https://arxiv.org/html/2608.28646#S4.p1.1)\.
- \[27\]B\. Stellato, G\. Banjac, P\. Goulart, A\. Bemporad, and S\. Boyd\(2020\)OSQP: an operator splitting solver for quadratic programs\.Mathematical Programming Computation12,pp\. 637–672\.Cited by:[§D\.2](https://arxiv.org/html/2608.28646#A4.SS2.p1.1),[3rd item](https://arxiv.org/html/2608.28646#S1.I1.i3.p1.1)\.
- \[28\]X\. Wang, J\. Wei, D\. Schuurmans, Q\. V\. Le, E\. H\. Chi, S\. Narang, A\. Chowdhery, and D\. Zhou\(2022\)Self\-consistency improves chain of thought reasoning in language models\.arXiv preprint arXiv:2203\.11171\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§4\.5](https://arxiv.org/html/2608.28646#S4.SS5.p1.1)\.
- \[29\]J\. Wei, X\. Wang, D\. Schuurmans, M\. Bosma, B\. Ichter, F\. Xia, E\. H\. Chi, Q\. V\. Le, and D\. Zhou\(2022\)Chain\-of\-thought prompting elicits reasoning in large language models\.arXiv preprint arXiv:2201\.11903\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px4.p1.1),[§1](https://arxiv.org/html/2608.28646#S1.p1.1)\.
- \[30\]F\. Wilcoxon\(1945\)Individual comparisons by ranking methods\.Biometrics Bulletin1\(6\),pp\. 80–83\.Cited by:[§F\.4](https://arxiv.org/html/2608.28646#A6.SS4.p1.1),[4th item](https://arxiv.org/html/2608.28646#S1.I1.i4.p1.1),[§5](https://arxiv.org/html/2608.28646#S5.p1.1)\.
- \[31\]B\. T\. Willard and R\. Louf\(2023\)Efficient guided generation for large language models\.arXiv preprint arXiv:2307\.09702\.Cited by:[Appendix H](https://arxiv.org/html/2608.28646#A8.SS0.SSS0.Px2.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px2.p1.1)\.
- \[32\]E\. B\. Wilson\(1927\)Probable inference, the law of succession, and statistical inference\.Journal of the American Statistical Association22\(158\),pp\. 209–212\.Cited by:[§F\.3](https://arxiv.org/html/2608.28646#A6.SS3.p1.1),[4th item](https://arxiv.org/html/2608.28646#S1.I1.i4.p1.1),[§5](https://arxiv.org/html/2608.28646#S5.p1.1)\.
- \[33\]S\. Wu, O\. Irsoy, S\. Lu, V\. Dabravolski, M\. Dredze, S\. Gehrmann, P\. Kambadur, D\. Rosenberg, and G\. Mann\(2023\)BloombergGPT: a large language model for finance\.arXiv preprint arXiv:2303\.17564\.Cited by:[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px1.p1.1)\.
- \[34\]H\. Yang, X\. Liu, and C\. D\. Wang\(2023\)FinGPT: open\-source financial large language models\.arXiv preprint arXiv:2306\.06031\.Cited by:[§1](https://arxiv.org/html/2608.28646#S1.p1.1),[§3](https://arxiv.org/html/2608.28646#S3.SS0.SSS0.Px1.p1.1)\.
- \[35\]S\. Yao, J\. Zhao, D\. Yu, N\. Du, I\. Shafran, K\. Narasimhan, and Y\. Cao\(2023\)ReAct: synergizing reasoning and acting in language models\.InInternational Conference on Learning Representations \(ICLR\),Cited by:[§7](https://arxiv.org/html/2608.28646#S7.SS0.SSS0.Px2.p1.1)\.

## Appendix AAppendix

## Appendix BPrompts, caps, and scenario template

### B\.1Cap rationale and sensitivity

The cap values in Table[2](https://arxiv.org/html/2608.28646#S4.T2)are intended to be representative of practical “KYC\-style” suitability heuristics rather than jurisdiction\-specific regulations\[[12](https://arxiv.org/html/2608.28646#bib.bib31),[13](https://arxiv.org/html/2608.28646#bib.bib32)\]\. They reflect: \(i\) lower volatility targets for conservative investors; \(ii\) a low\-cost fee budget typical of broad\-market ETFs \(e\.g\., 0\.20–0\.40% WAER\); \(iii\) diversification via concentration control \(HHI corresponds to an effective number of holdings of roughly1/HHI1/\\mathrm\{HHI\}\); and \(iv\) concentration limits that prevent over\-exposure to a single fund or sector\. \(We report threshold sensitivity analyses in this appendix\.\)

### B\.2Direct/Critique JSON schema

> \{"weights": \{"TICKER": 0\.00, "\.\.\.": 0\.00\}, "explanation": "<=120 words"\}

### B\.3SC JSON schema

- \{
- "candidates": \[\{"weights": \{"TICKER": 0\.00, \.\.\.\}, "explanation": "<=120 words"\},
- \.\.\.
- \]
- \}

### B\.4Example BiasMix prompts

We include two representative BiasMix contexts \(verbatim\) used to induce biased first\-pass allocations:

- •Anchor tech:*Strongly prefer VGT \(tech tilt\)\.*
- •Small\-cap hype:*Strongly prefer IWM \(small\-cap tilt\)\.*

### B\.5Train/dev/test splits

Although we do not train the language models, we use splits to avoid*evaluation leakage*from repeated prompt and guardrail tuning on the same scenarios\. We stratify scenarios by \(profile, recipe\) and assign them totrain\(used only to finalize prompts and guardrail solver settings\),dev\(a one\-time check that the tuned pipeline behaves similarly on unseen scenarios\), andtest\(the final reported results\)\.

### B\.6Scenario JSONL template

- \{
- "scenario\_id": "AF\-001",
- "as\_of": "2025\-09\-30",
- "profile": "Conservative\|Moderate\|Aggressive",
- "caps": \{"sigma\_cap":\.\.\., "fee\_cap":\.\.\., "hhi\_cap":\.\.\., "max\_asset":\.\.\., "max\_sector":\.\.\.\},
- "asset\_universe": \["SPY","VEA","VWO","VGT","XLE","XLF","XLV",
- "XLY","XLP","XLI","XLRE","IWM","AGG","LQD","IEF","GLD"\],
- "biasmix": "<bias recipe text\>",
- "seeds": \[1\],
- "split": "train\|dev\|test"
- \}

## Appendix CAdditional Results

### C\.1Test first\-pass violation rates \(Table[4](https://arxiv.org/html/2608.28646#A3.T4)\)

Table 4:Test first\-pass violation rate \(Wilson 95% CI\)\.Violations are measured on the model’s raw proposalw0w\_\{0\}before projection; lower values indicate better prompt\-level compliance, not guardrail effectiveness\.
### C\.2Test robustness and success rates \(Table[5](https://arxiv.org/html/2608.28646#A3.T5)\)

Table 5:Test robustness and success rates \(Wilson 95% CI\)\.Parse\-fail counts a scenario only if allR=3R\{=\}3retries fail strict JSON parsing\. Final feasibility is the post\-projection pass rate \(w∗∈𝒞w^\{\*\}\\in\\mathcal\{C\}\)\. End\-to\-end success requires both parsing and final feasibility\.
### C\.3Qualitative bias prompt effectiveness \(LLM output examples\)

Table[6](https://arxiv.org/html/2608.28646#A3.T6)provides one concrete held\-out test example per BiasMix recipe, showing that the first\-pass draft allocations and the model’s explanation reflect the intended bias \(e\.g\., VGT/XLE/GLD/IWM tilts\)\. We show direct prompting for brevity; critique/SC exhibit similar thematic emphasis but are omitted due to space\.

Table 6:Bias prompt effectiveness on held\-out test:representative first\-pass LLM draft allocations and short explanation excerpts for each BiasMix recipe \(direct prompting shown for compactness\)\.
### C\.4Correction Distances Visualization \-[3](https://arxiv.org/html/2608.28646#A3.F3)

Figure 3:Held\-out test: correction distanceD=‖w∗−w0‖2D=\\\|w^\{\*\}\-w\_\{0\}\\\|\_\{2\}\(profile\-pooled\) with conservative CI bands\.
### C\.5Bias analysis on held\-out test \(violation heatmaps\)

To inspect bias\-specific failure modes, we compute first\-pass violation rates on thetest splitfor each \(profile, bias type\) cell, shown separately by model and prompting mode in Figs\.[4](https://arxiv.org/html/2608.28646#A3.F4)–[6](https://arxiv.org/html/2608.28646#A3.F6)\. Cells with no test scenarios for a given \(profile, bias\) combination are left blank\.

![Refer to caption](https://arxiv.org/html/2608.28646v1/fig_bias_heatmap_test_direct.png)Figure 4:Test\-split bias heatmap \(Direct\):first\-pass violation rate by profile \(rows\) and bias type \(columns\), shown per model \(panels\)\.![Refer to caption](https://arxiv.org/html/2608.28646v1/fig_bias_heatmap_test_critique.png)Figure 5:Test\-split bias heatmap \(Critique\):first\-pass violation rate by profile and bias type, shown per model\.![Refer to caption](https://arxiv.org/html/2608.28646v1/fig_bias_heatmap_test_sc.png)Figure 6:Test\-split bias heatmap \(Self\-consistency\):first\-pass violation rate by profile and bias type, shown per model\.
### C\.6Sector\-level intent preservation \(before/after\)

To assess intent preservation beyond the L2 correction distance, we compare*sector\-sum*allocations before and after projection on the held\-out test split\. Each point in Figs\.[7](https://arxiv.org/html/2608.28646#A3.F7)–[9](https://arxiv.org/html/2608.28646#A3.F9)corresponds to a \(scenario, sector\) pair, plotting the draft sector weight \(x\-axis\) against the post\-projection sector weight \(y\-axis\)\. Points close to they=xy=xline indicate that the projection repair preserves the model’s sector\-level intent while enforcing hard caps\.

Figure 7:Sector before/after \(Direct, test split\):draft vs\. projected sector allocations, shown per model \(panels\)\.Figure 8:Sector before/after \(Critique, test split\):draft vs\. projected sector allocations, shown per model\.Figure 9:Sector before/after \(Self\-consistency, test split\):draft vs\. projected sector allocations, shown per model\.
### C\.7Paired model comparisons \(Wilcoxon on correction distanceDD\)

Table[7](https://arxiv.org/html/2608.28646#A3.T7)reports paired Wilcoxon signed\-rank tests comparing models on the correction distanceDD\(only scenarios where both models produced a valid run are paired\)\. We report the Wilcoxon statisticWW, the unadjustedpp\-value, the effect sizerr, and the Benjamini–Hochberg FDR\-adjustedpp\-value \(pFDRp\_\{\\mathrm\{FDR\}\}\)\. “Reject” indicates rejection at FDRα=0\.10\\alpha=0\.10\.

Table 7:Paired Wilcoxon tests onDDfor all model pairs, reported by split and reasoning mode\.InterpretationAcross splits, paired Wilcoxon tests on correction distanceDDshow that*direct*and*critique*modes often yield statistically distinguishableDDdistributions between certain model pairs after BH\-FDR correction \(notably comparisons involvingmeta\-llama/Llama\-3\.3\-70B\-Instruct\-Turbo\)\. In contrast,*sc*mode exhibits fewer significant differences across model pairs \(mostpFDR≥0\.10p\_\{\\mathrm\{FDR\}\}\\geq 0\.10\), suggesting that the self\-consistency selection tends to reduce cross\-model variability in the magnitude of post\-generation corrections\. We report these as empirical outcomes rather than enforcing an a priori ordering between modes\.

## Appendix DSolver Projection Implementation

### D\.1Solver Settings

ConvexityBecauseΣ⪰0\\Sigma\\succeq 0and the constraints in𝒞⁡\(θ\)\\mathcal\{C\}\(\\theta\)are convex \(simplex, box, linear sector sums, and convex quadratic bounds on volatility and HHI\), Eq\. equation[2](https://arxiv.org/html/2608.28646#S4.E2)is a convex QCQP\. We implement it in CVXPY with a PSD “jitter”Σ←Σ\+10−10​I\\Sigma\\leftarrow\\Sigma\+10^\{\-10\}Ifor numerical stability\. In practice, the quadratic volatility/HHI caps induce a conic form, so we solve the QCQP with SCS\[[23](https://arxiv.org/html/2608.28646#bib.bib33)\]\(eps=1e\-5,max\_iters=30000\)\. For robustness, we optionally attempt OSQP when CVXPY canonicalizes a given instance to a pure QP \(no quadratic caps\), usingeps\_abs=eps\_rel=1e\-7,max\_iter=200000, andpolish=True; otherwise \(or if a solver returns a non\-optimal status\) we fall back to SCS\. This retry logic improves robustness across models and scenarios\.

Robustness to solver settingsAppendix[D\.2](https://arxiv.org/html/2608.28646#A4.SS2)reports a small sensitivity study over solver tolerances and iteration limits; feasibility and correction distance remain stable\.

Interior margins and “polish”To reduce borderline numerical violations, we solve with small interior margins \(e\.g\.,τ=2×10−3\\tau=2\\times 10^\{\-3\}for asset/sector caps, andh​h​i​\_​e​p​s=3×10−4hhi\\\_eps=3\\times 10^\{\-4\}for HHI\)\. If the resulting solution is still slightly above the HHI cap due to rounding, we re\-solve once with a tighter HHI bound and warm\-start from the previous solution\. As a final deterministic safeguard, we apply a tiny weight transfer \(from the largest weight to a low\-fee diversifier\) if HHI remains marginally above the cap\.

### D\.2Solver parameter ablation and robustness

Table[8](https://arxiv.org/html/2608.28646#A4.T8)varies numerical tolerances, iteration budgets\. We report \(i\) solver success rate, \(ii\) final feasibility after projection, \(iii\) median correction distanceD=‖w∗−w0‖2D=\\\|w^\{\*\}\-w\_\{0\}\\\|\_\{2\}, and \(iv\) mean runtime\. Across settings, the QCQP projection remains robust: SCS\[[23](https://arxiv.org/html/2608.28646#bib.bib33)\]reliably solves the conic form induced by quadratic caps, while OSQP\[[27](https://arxiv.org/html/2608.28646#bib.bib13)\]primarily serves as an optional fast\-path when an instance reduces to a pure QP\.

Table 8:Solver robustness ablation across different settings\.

## Appendix EReproducibility \+ Parsing/Decoding

### E\.1Implementation notes

We log model name, mode, prompt hash, seed, parse failures, and before/after metrics for reproducibility\. We also run covariance and cap sanity checks \(e\.g\., feasibility probes and eigenvalue diagnostics\) during dataset creation; details are included in the appendix\.

### E\.2Decoding parameters

We use a strict JSON\-only output contract for all modes\. Temperatures are mode\-specific but shared across models: directT=0\.10T\{=\}0\.10, critiqueT=0\.20T\{=\}0\.20, and self\-consistencyT=0\.28T\{=\}0\.28\. When supported, we settop\_p=0\.75\\texttt\{top\\\_p\}\{=\}0\.75andmax\_tokens=1000\\texttt\{max\\\_tokens\}\{=\}1000\. For GPT\-5 nano, temperature/top\-ppare not exposed in the API used; we keep default sampling settings and setreasoning\_effort=low\\texttt\{reasoning\\\_effort\}\{=\}\\texttt\{low\}\.

### E\.3Retry \+ parsing logic

Each query is attempted up toR=3R\{=\}3times if strict JSON parsing fails\. A run is counted as a*parse failure*only if allRRattempts fail\. Parsing enforces a top\-level object with exactly two keys:weights\(a ticker\-to\-weight map\) andexplanation\(a short string\)\. Weights are coerced to nonnegative reals and renormalized to sum to 1\. If the model returns a singleton list containing the object, we unwrap it\.

## Appendix FStatistical and Experimental Protocol Details

### F\.1Primary endpoints

We pre\-register two primary endpoints: \(1\)First\-pass violation rate\.For each cap \(and the any\-cap aggregate\), we mark a violation onw0w\_\{0\}if the corresponding constraint in𝒞\\mathcal\{C\}is not satisfied \(e\.g\.,σ⁡\(w0\)\>σcap\\sigma\(w\_\{0\}\)\>\\sigma\_\{\\mathrm\{cap\}\}\)\.; and \(2\)correction distanceD=‖w∗−w0‖2D=\\\|w^\{\*\}\-w\_\{0\}\\\|\_\{2\}\(Euclidean distance\) measuring how much the guardrail must change the model output to satisfy hard caps\.

### F\.2Secondary endpoints

We report before/after deltas in volatilityσ\\sigma, fee burden \(WAER\), and concentration \(HHI\), as well as parse\-failure rate and end\-to\-end success \(valid JSON \+ post\-generation feasibility\)\.\(i\) Parse failure rate\.A scenario is a parse failure if allR=3R\{=\}3retries fail strict JSON parsing\.\(iii\) Final feasibility rate\.A scenario is finally feasible ifw∗∈𝒞w^\{\*\}\\in\\mathcal\{C\}\(all caps satisfied after projection\)\.\(iv\) End\-to\-end success\.A scenario is end\-to\-end successful if it parses*and*is finally feasible\.

### F\.3Confidence intervals

For violation rates \(proportions\), we compute Wilson 95% confidence intervals\[[32](https://arxiv.org/html/2608.28646#bib.bib16)\]\. ForDDand metric deltas, we compute bootstrap 95% confidence intervals by resampling scenarios with replacement \(10,000 resamples\)\[[11](https://arxiv.org/html/2608.28646#bib.bib5)\]\.

### F\.4Model comparisons and multiple testing

To compare models onDDunder the same scenarios, we use paired Wilcoxon signed\-rank tests on per\-scenario differences\[[30](https://arxiv.org/html/2608.28646#bib.bib19),[7](https://arxiv.org/html/2608.28646#bib.bib22),[9](https://arxiv.org/html/2608.28646#bib.bib21)\]\. With three models, there are three model pairs per mode\. Across three modes and three splits, this yields3×3×3=273\\times 3\\times 3=27pairwise tests \(and 36 including an “all\-splits” aggregate view\)\. We control false discovery using Benjamini–Hochberg FDR atq=0\.10q=0\.10\[[4](https://arxiv.org/html/2608.28646#bib.bib2)\]over the family of pairwise tests and reportpFDRp\_\{\\mathrm\{FDR\}\}\.

### F\.5Split\-wise reporting

Train is used only to finalize prompts and solver settings\. Dev is reassure settings\. We do not re\-tune based on test outcomes, instead we report test metrics \(with confidence intervals\) as our main evidence of generalization across unseen scenarios and paired comparisons as the main empirical results\.

## Appendix GAdditional discussion: universe design and generalization

Universe design\.We adopt a fixed 16\-ETF universe as an*intentional design choice*for controlled diagnosis\. It is large enough to express meaningful diversification patterns \(U\.S\., ex\-U\.S\., EM, sectors, bonds, gold\) while remaining small enough to \(i\) make parsing failures and constraint\-violation patterns interpretable, \(ii\) keep covariance and sector mappings stable and auditable, and \(iii\) enable systematic variation across bias prompts and risk profiles without confounding effects from universe size\.

Generalization\.The projection\-based guardrail is not tied to 16 assets; it extends to larger universes given fees, sector mappings, and a covariance estimate\. Generalization to hundreds of ETFs and time\-varying risk models is left to future work, where scaling behavior, universe\-dependent concentration effects, and covariance estimation error become central\.

## Appendix HExtended related work \(moved from main\)

#### Guardrails, auditing, and post\-hoc verification\.

Safety and controllability toolkits \(e\.g\., NeMo Guardrails\[[25](https://arxiv.org/html/2608.28646#bib.bib12)\]\), safety classifiers \(e\.g\., Llama Guard\[[18](https://arxiv.org/html/2608.28646#bib.bib10)\]\), and instruction/alignment methods such as RLHF and Constitutional AI\[[22](https://arxiv.org/html/2608.28646#bib.bib11),[1](https://arxiv.org/html/2608.28646#bib.bib1)\]primarily aim to filter unsafe content or enforce conversational policies\. A complementary line of work emphasizes*auditing*and*verification*of LLM outputs, especially in high\-stakes settings: rather than trusting a single generation, systems instrument the generation process with structured outputs, validation checks, and feedback loops\[[24](https://arxiv.org/html/2608.28646#bib.bib30),[26](https://arxiv.org/html/2608.28646#bib.bib20)\]\. Constrained generation methods provide decoding\-time guarantees by enforcing lexical or structural constraints during generation\[[17](https://arxiv.org/html/2608.28646#bib.bib23)\]\. In contrast to content safety, our setting requires satisfying quantitative constraints that are naturally expressed as convex restrictions over portfolio weights; this motivates optimization\-based post\-processing as an auditable repair layer rather than purely text\-level controls\[[6](https://arxiv.org/html/2608.28646#bib.bib3)\]\.

#### Structured generation and constrained outputs\.

A practical prerequisite for auditing is that model outputs are machine\-checkable\. Prior work on structured outputs and constrained/guided generation\[[17](https://arxiv.org/html/2608.28646#bib.bib23),[31](https://arxiv.org/html/2608.28646#bib.bib35)\]motivates enforcing schemas so downstream validators can reliably parse and evaluate outputs\. Our pipeline adopts this principle by requiring a strict JSON schema for allocations, enabling deterministic constraint checking and repair\.

#### Constrained portfolio optimization\.

Classical mean–variance optimization\[[21](https://arxiv.org/html/2608.28646#bib.bib9)\]and later robust/regularized variants\[[19](https://arxiv.org/html/2608.28646#bib.bib8)\]motivate using covariance structure and explicit constraints in portfolio construction\. Our work uses these tools as a*repair operator*applied to an LLM draft, aligning with the broader view that LLM outputs may require deterministic verification in high\-stakes domains\. Unlike traditional optimization, we do not assume the portfolio is being constructed from first principles to maximize an objective; instead, we minimize deviation from the model’s proposal while enforcing KYC\-style caps\.

#### Reasoning modes and sampling\.

Prompting strategies such as chain\-of\-thought\[[29](https://arxiv.org/html/2608.28646#bib.bib15)\], self\-consistency\[[28](https://arxiv.org/html/2608.28646#bib.bib14)\], and self\-refinement/critique\[[20](https://arxiv.org/html/2608.28646#bib.bib34)\]can improve reasoning reliability but remain stochastic\. We therefore treat mode comparisons as empirical outcomes and quantify uncertainty with confidence intervals and paired tests, and we position deterministic post\-generation verification/repair as the mechanism that guarantees compliance regardless of prompting mode\.