The learning experimentWhat an AI trader learns, with held-out controls.
The detector foundationA market where spoofing works, and seven detectors.
ResultsSpoofs against honest look-alikes and volatile markets.
What kind of teaching works?Examples, a rule, or the law. And how to dodge it.
An AI challengerA search program hunts for spoofs the law-based detector misses.
What it meansThe answer, its limits and the sources.
Research LabPick a market situation and see how every detector reacts.
Watch one spoofThe wall goes up, the order fills, the wall vanishes.
Will AI traders learn to manipulate a market on their own? And will our detectors recognise what they learn?
Ebrahim · Habs Research Scholarship project
The project now asks what a learning trader does when rewarded for execution quality, and whether existing detectors recognise the resulting behaviour. The new pilot uses independent learners, unseen test sessions, complete trade accounting and matched controls. Read the measured result and replay the learning.
This is a restricted replication and detector-transfer study. Earlier research already demonstrated learned spoofing. The new chapter explains what this experiment adds, what it cannot establish, and why an alert alone is not a discovery.
The results below test human-designed spoofing and detector evasion. They explain the surveillance systems used in the new study; they are not evidence that the new learner discovered those strategies.
Inspect the new resultsSpoofing means placing large orders you never intend to trade, so that other traders misread supply and demand. Real examples are rare and hard to label, which makes one idea attractive: train a detector only on normal trading and let it flag whatever looks unusual. This project tests that idea in a simulated market where spoofing measurably works, with seven detectors ranging from a hand-written rule to an LSTM neural network. The detectors that were never told what spoofing looks like could not tell a spoof from an honest large order, in five different markets and even when they examined individual orders. They found the honest orders more unusual, because a spoof is unusual only in its size, while its quick cancellation looks like ordinary market-making. The one signal that separated them, a large order cancelled quickly, came from what the detectors were told, and it stopped working as soon as the same spoof was split into smaller pieces. A second experiment asked what kind of teaching does work. Examples and patterns teach what spoofing looks like, and fail the same way. A detector built only from the legal definition, which asks whether a trader showed interest it then withdrew while trading the other way, caught both kinds of spoof without a single example and flagged no honest large orders. What it cannot do is tell a spoof from an honest change of mind: that takes intent, which no data shows.
A real episode from the simulation, rebuilt order by order. Scroll, and the replay follows.
Bids wait on the left and asks on the right. Each bar is the number of lots waiting at that price. Some traders read this book to judge supply and demand.
The spoofer adds a large buy order just below the best bid, and a small genuine sell order at the best ask. The large order is not meant to trade.
The bid side now looks heavy, so book-reading traders lean towards buying. That is the whole trick.
The genuine sell order fills. In the same step the wall is cancelled, having never traded.
Only the hand-written rule, because it was told that a large order cancelled quickly is suspicious. Now switch to Layered: the same lots in four smaller orders.
Figure 1 One spoof, replayed
A working spoof is built to look ordinary in every way but one. A detector that hunts for the unusual finds honest traders first. A detector that knows what the offence is for finds the spoofer, and still cannot read a mind.
Part 1
Seven detectors that only learned normal trading could not tell a spoof from an honest order of the same size. The LSTM scored an AUC of , where 0.5 is a coin toss.
Part 1 and 2
The hand-written rule caught of large spoofs and once the same spoof was split into four. A classifier shown examples failed the same way.
Part 2 and 3
A detector built only from the legal definition caught of split spoofs with no examples and flagged of honest large orders. Dodging it costs the spoofer its gain.
The limit
A trader who changes their mind does what a spoofer does. Spoofs against changes of mind scored an AUC of : the data shows a false signal, never the reason for it.
Over a thousand simulated trading sessions, seven detectors and a dozen honest and dishonest situations. Every figure on this site is drawn from the experiments' own results files, and every one can be rebuilt from the code.