Research LabPick a market situation and see how every detector reacts.The question
Most uses of AI in finance try to predict prices. This project looks at the other side: how an exchange or a regulator could recognise manipulation nobody has seen before. It asks whether a detector trained only on normal trading can pick out spoofing it has never been shown, and how much of any success really comes from knowledge we quietly build into it.
Every exchange keeps a limit order book,1Limit order book. The list of every buy order (a bid) and sell order (an ask) waiting at each price. A trade happens when a new order reaches the best price on the other side. a live list of the orders waiting to be filled. Traders read it to judge supply and demand. Spoofing abuses that: place a large order you do not intend to trade, wait for others to react, trade a small genuine order on the other side, then cancel the large one.
This is not hypothetical. In July 2025 the UK Upper Tribunal upheld the FCA's case against three bond traders.2Urra, Lopez Gonzalez & Sheth v FCA, Upper Tribunal, decision of 1 July 2025. All three were banned from the industry and fined. Their large orders sat a tick or two behind the best price, visible but unlikely to trade, and were usually cancelled within seconds, often just after a small order on the other side had filled. That is the pattern the simulation reproduces in Figure 1.
Detection is hard for two reasons. There are almost no labelled examples: proven cases are rare and contested, and a new strategy has none at all, which makes "learn normal, flag the unusual" appealing. And unusual is not the same as manipulative. Big orders and quick cancellations happen all the time for honest reasons, and a detector that cries wolf is useless.
The experiment
Real data cannot answer this question, because nobody knows for certain which real orders were spoofs. A simulation can: it records exactly when every spoof happened, while the detectors are never told.
A market where spoofing can work
The simulator is an order book written for this project, with four kinds of normal trader. Some ignore the book and trade around a noisy idea of the asset's value. Some read the book and lean towards buying when the bids look heavy, which is exactly what a spoofer exploits.3Book-reading traders are a simplified version of those in Wang & Wellman's agent-based spoofing model (2017). Market makers quote both sides and cancel constantly, so quick cancellations are normal. Now and then an institution rests a genuinely large order behind the best price. There are two market regimes, calm and volatile.
The spoof, and its controls
The spoofer copies the Tribunal pattern: a large wall one or two ticks behind the best price, a small genuine order on the other side, and the wall pulled the moment the small order fills. Wall sizes run from 1× to 16× a typical order. A layered version splits the same total into four smaller orders on neighbouring prices. Every spoofed session has an honest twin,4Honest twin. The same random seed and timing, but no wall. The difference between the two is what the wall itself achieved. and every size has a matching genuine large order that simply stays on the book. If a detector flags those just as often, it is detecting size, not deceit.
Two ways to describe the book
If you hand a detector features like "a large order was cancelled quickly", you have already taught it what spoofing looks like. So the learned detectors are tested with each of two descriptions.
| Feature set | What it measures | Taught about spoofing? |
|---|---|---|
| Generic (18) | Depth at the top five prices on each side, spread, price change, and counts and volumes of new orders, cancellations and trades. The standard description in order-book research. | No |
| + Spoof-informed (6) | Largest single order, largest order cancelled within 50 steps, how far the biggest order sat from the best price, book imbalance and its change, signed trade flow. | Yes |
Seven detectors, none shown a spoof
The rule is ordinary surveillance logic. PCA5PCA (principal component analysis) acts as a simple linear autoencoder: whatever cannot be rebuilt from the main patterns of normal data scores high. and Isolation Forest6Isolation Forest (Liu, Ting & Zhou, 2008), implemented from the original paper. Unusual points end up alone after only a few random cuts. look at one 5-step bar at a time. Two sequence detectors read a window of the last 8 bars, so they can in principle see the order of events: a sequence PCA, and an LSTM autoencoder,7LSTM autoencoder. A recurrent neural network (Hochreiter & Schmidhuber, 1997) squeezes each window into 8 numbers and tries to rebuild it, a standard design for anomaly detection in time series (Malhotra et al., 2016). Built in PyTorch. a neural network that compresses each window and tries to rebuild it.
| Detector | What it sees | How it scores | Knows the pattern? |
|---|---|---|---|
| Rule | One bar | Size of the largest order cancelled within 50 steps | Yes, by hand |
| PCA | One bar | How badly the bar is rebuilt from normal patterns | Only with spoof-informed features |
| Isolation Forest | One bar | How few random splits isolate the bar | Only with spoof-informed features |
| Sequence PCA | 8 bars | How badly the window is rebuilt | No |
| LSTM autoencoder | 8 bars | How badly the neural network rebuilds the window | No |
Keeping it fair
Each detector's alert threshold is fixed on separate normal sessions so that about 1% of normal bars alert, and it is never tuned on test data. An episode counts as caught if any bar in its 8-bar window alerts, so even random alerts would catch about of episodes; every catch rate is shown against that chance line. Because a threshold can flatter or hide a detector, the results also use AUC,8AUC (area under the ROC curve): the chance that a randomly chosen spoof scores higher than a randomly chosen comparison case. 0.5 is a coin flip, 1.0 is perfect separation. which needs no threshold at all, and paired significance tests that compare detectors on exactly the same episodes. Training, threshold and test data come from different simulated sessions, in all.