Adversarial Machine Learning for Medicare Risk Adjustment: Training Payment Formulas Against a Strategic Health Plan

Abstract

Background. Risk-adjustment formulas are fitted to data that health plans have not yet responded to, and plans respond. The Medicare Payment Advisory Commission estimates that Medicare Advantage is paid about 20% more than fee-for-service Medicare would spend on the same people, through two channels: coding intensity and favorable selection. We ask whether machine-learning methods built for adversarial settings can produce a payment formula that holds up once a plan has done what the formula rewards.
Methods. On the public Medical Expenditure Panel Survey benchmark of Ologunbaba et al. (2025), 43,963 persons in panels 23 to 27 with year-1 predictors and year-2 spending, we simulate a strategic plan with more information than the regulator. It adds diagnosis codes where the payment rise exceeds a cost that grows with how often it has used the code, among codes plausible for the person and within a limited chart-review reach, and it tilts enrollment toward people its own cross-fitted cost model, which also sees health-risk-assessment information, expects to be overpaid. Both channels are calibrated jointly, on training data, to MedPAC’s published magnitudes. We compare a payment formula in the form used by CMS with a coding penalty, caps at each code’s incremental cost, a distributionally robust penalty on the worst-priced subgroup and gradient boosting; with each formula retrained against the plan by repeated risk minimization; and with a coding penalty whose weight is chosen against the plan’s best response (a Stackelberg choice). The plan always responds out of sample and every formula pays the same budget. All quantities are out of sample, with a PSU bootstrap paired across formulas.
Results. The calibrated plan extracts $1,337,599 per 1,000 enrollees a year from the CMS-form formula, 17.1% of base payment: $566,291 from coding and $771,309 from selection. A penalty on the codes a plan can add removes 88% of the coding channel at an R² cost of 0.002 and spreads what coding remains across all 124 codes, cutting extraction to $743,433; choosing its weight against the plan’s response cuts it slightly further, to $731,169. Caps at incremental cost change nothing, because the formula already pays codes less than the estimated costs. No linear formula closes the selection channel. Retraining against the plan lowers extraction from the CMS form by 16% without ever converging, adds nothing to the penalized formula, and lowers it from boosting to $675,774, the least of any formula but unstable across folds. Every formula that resists coding underpays people needing help with daily activities by more than the CMS form does, and the plan enrolls fewer of them.
Conclusions. Coding is cheap to defend against with a penalty on codable increments, and tuning that penalty against the plan’s response adds a little more; retraining against the plan helps formulas that are not already protected but does not settle; selection is an information problem that a diagnosis-based formula cannot solve. Robustness to gaming and fair payment for the frail pull in opposite directions and have to be set together.