The leakage I worry about most is not a stolen label. It is a curve.
Everyone on a modern desk knows not to train on the answer. So the obvious cheats get caught: the future return column, the settlement price on the trade date, the outcome flag joined in by accident. What survives review is subtler and structurally worse. A yield curve arrives as a table of tenors and rates, gets a date stamp, and gets treated as reference data. Reference data feels like a constant. Nobody audits a constant. And inside that table, one pillar came from a print that did not exist at the decision clock.
The curve is not reference data. It is a filtration, the set of things you were legally allowed to know at a moment, wearing a spreadsheet costume.
What the bootstrap does to a small lie
The reason a leaked pillar is worse than a leaked feature is that the curve is not consumed raw. It is bootstrapped, and bootstrapping is a recursion that amplifies.
Start honest. A one-year strip gives a spot of 5.00 percent. A two-year coupon bond, with the first coupon stripped at the known one-year spot, solves to a two-year spot of 5.50 percent. The no-arbitrage relation then pins the one-into-two forward: 1.05 times one plus f equals 1.055 squared, so f is 6.00 percent. That forward is not a forecast. It is the only rate at which the two paths cannot be arbitraged against each other.
Now leak fifteen basis points into the two-year spot, say tomorrow's print, because the vendor file was refreshed overnight and the loader takes the latest row. The forward moves to 6.30 percent. Fifteen basis points of input, thirty of output. The recursion doubled it.
At the long end it is far worse, because the amplification runs roughly with tenor. Take a nine-year spot of 5.40 and a ten-year of 5.50: the nine-into-ten forward is 6.40 percent. Move the ten-year spot by five basis points, a rounding difference, the kind of thing nobody would call leakage, and that forward becomes 6.91. Fifty basis points of movement out of five basis points of contamination. Fifteen basis points of contamination moves it by a full 1.52 percent.
So the honest framing is not "a little future information slipped in." It is: the bootstrap is a gain stage, and you put a signal into it that only exists tomorrow.
Why it feels like clean engineering
Because every step in the chain is good practice taken one clock too far.
Vendors publish corrections, so loaders take the latest available row, correct for reporting, catastrophic for a decision table. Curves have gaps, so interpolation fills them, correct for smoothness, and it happily interpolates through an illegal pillar and launders it across neighbouring tenors. Research wants stable inputs, so someone builds a "clean curve" table with one row per date, and the cleaning job ran last month, with last month's information, over dates that are all in that job's past.
That last one is the trap I see most. A batch job is a time machine. Every rebuild of a historical table quietly grants the past access to the future, and the artefact it produces looks more trustworthy than the messy live feed, because it is complete and gap-free. Completeness is the tell. Live information is never that tidy.
Then the backtest works. Of course it works. A model reading a forward that contains tomorrow's print will find that the forward predicts tomorrow. Leakage does not present as an error; it presents as skill, and skill gets funded.
How this shows up in production
- The refreshed pillar. One tenor in the present table carries a print stamped after the as-of clock. Nothing in the schema distinguishes observation time from effective date, so the illegal row is indistinguishable from the legal ones. The bootstrap multiplies it and the whole long end inherits it.
- Soft leakage through aggregates. No individual print is illegal, but a monthly average stamped to month-end was published on the third of the next month. A "latest value" column carries whatever was current at build time. A rolling z-score uses a window centred on the observation. Each of these leaks less than a stolen price and is much harder to see, because the leaking field is a summary and summaries feel like descriptions rather than observations.
- Agent memory as a side channel. The retrieval store holds yesterday's analysis, which discussed a print that is illegal for today's replay. The prompt is clean. The context is not. Filtration discipline that stops at the feature table does not cover a system that remembers.
- Missing pillars papered over. Three of the tenors you need did not trade. Interpolation invents them, the curve looks complete, and a single confident mark ships. The honest answer was a band, or an inconclusive, because part of the curve was not observable at that clock.
- Split clocks across asset classes. Equity marks stamped 14:00, curve pulled from the 17:30 close, both labelled with the same trading date. In calm weeks nobody notices. In a co-break week, when rates and equity move together and the joint move is the whole risk, the three-and-a-half-hour offset is precisely the interval that decides whether the model looked prescient or blind.
A walkthrough on CEH-001
The never-traded family again, marks near 1.50 under the spread frame and near 2.10 under the curve frame. The curve-frame mark is the one exposed here, because it is built off the bootstrapped zero curve, and the bootstrap has an amplifier in it.
Rebuild the historical table and the ten-year pillar for several dates carries an overnight refresh. The long forwards move by half a point in the direction the market subsequently went, because that is what the leaked print encodes. The curve-frame mark tightens toward the eventual outcome, so its backtest error falls. The spread-frame mark, which does not touch the long forwards, does not improve. Someone reads the comparison and concludes the curve frame is the better methodology.
That conclusion is now driving a rights change. It is an artefact of a loader.
Worse, the leaked curve makes an arbitrage look available. When the forward implied by legal information is 6.00 and the leaked table implies 6.30, the backtest sees a thirty-basis-point discrepancy between two funding paths, about 0.32 per hundred of notional, and books it as a riskless gain. Arbitrage is positive gain on zero net investment, and real markets equalise it in minutes. A backtest with a clock bug can harvest it every day for a year.
Then the co-break week arrives, the split clock stops being harmless, and 1.50 versus 2.10 reopens as wide as it ever was. The organisation now has a tired argument and a favourite methodology chosen for the wrong reason. Somebody proposes 1.80, and it lands with more support than usual, because both frames have just been publicly wrong. That is how leakage ends up defending an invented mark.
What stacks quietly assume
They assume reference data has no clock. They assume a date column is an as-of. They assume the newest value of a field is the best value of that field. They assume interpolation is neutral, when interpolation is the mechanism that spreads one illegal print across the tenors around it. They assume a completed curve is better than a curve with holes, when the holes were the honest part. And they assume leakage announces itself as an error, when it announces itself as performance.
What a solution must do
If the curve is a filtration, a real fix cannot be a code-review habit. It has to make the clock structural: observation time and effective date as separate fields, an explicit legal-information set at each as-of, and the bootstrap recipe itself, which instruments, in which order, with which interpolation, hashed alongside the output, so a curve is reproducible from declared inputs rather than trusted as a table. Any print stamped after the clock is refuse, with no midpoint and no soft yellow. Missing pillars produce a band or an inconclusive rather than an interpolated single number. Aggregates, memory stores and label windows get audited under the same rule as prices, because soft leakage is the same crime with better manners. And the clock is shared across asset classes, so an equity mark and a curve mark cannot cite the same date while standing hours apart.
Curious how others enforce a single as-of across rates and equity without freezing their whole pipeline on the slowest feed, and where soft leakage through aggregates or agent memory first showed up as suspiciously good performance.