Will AI traders learn manipulation?

This pilot did not establish learned spoofing.

In plain words: all 6 AI traders learned ordinary, honest ways to fill the order, and none learned to spoof. 0 of 6 final greedy policies matched the predeclared spoof-like signature. 0 had a positive extra-order effect with a pointwise 95% interval entirely above zero in the calm test market.

6 independently initialised learners completed 19,200 training episodes. The held-out study contains 8,064 policy-by-market episodes, using the same 128 test seeds for paired comparisons. Reusing a seed does not create another independent market sample.

What this establishes: a reproducible result for a restricted execution learner in this simulator. It does not establish what all AI traders will do, or that an agent invented a strategy outside the choices supplied by its designer.

The question has a history.

Byrd’s Learning Not to Spoof already reports a profit-seeking agent independently learning spoofing. Learning Unfair Trading also studies manipulation through reinforcement learning. This chapter is a restricted replication and detector-transfer pilot. Its possible contribution is in the controls and detector comparisons; priority or groundbreaking novelty has not been established.

The earlier detector experiments remain the foundation. This chapter reverses the direction: let an agent optimise execution, then inspect what it learned and how the old detectors respond.

Watch its choices change.

The bars show saved choice probabilities after each training round. They are measured training output, not a live simulation. Extra size, distance and cancellation probabilities matter only when an extra order is selected.

Playback starts paused, stops offscreen, and respects reduced motion. Pink identifies the opposite-side option; it is not a verdict of manipulation.

What survived the controls?

Score is execution surplus in ticks per client lot relative to the arrival midpoint. Higher is better. The honest benchmark was selected on separate validation sessions. The extra-order effect compares each learned greedy policy with the same policy after its extra order is removed.

Each row uses 128 independent market sessions. All intervals are pointwise paired 95% bootstrap intervals.

“Signature” means the predeclared large opposite-side, early-cancellation configuration. It does not prove intent, actual cancellation without execution, or price impact. Rule alerts are market-wide; visibility alerts are attributed to the agent. These are alert rates, not validated detection sensitivity. The designed diagnostic is a human-written control, never a discovery.

The intervals do not include uncertainty across training seeds and are not corrected for multiple comparisons. No-feedback removes the imbalance response of both market makers and reactive traders. It tests this simulator’s mechanism; it does not reproduce a real market.

An experiment designed to be wrong.

The agent has an ordinary task: buy or sell three lots within 30 simulation steps at the best achievable price. It receives no spoof label or manipulation bonus. A second group pays two ticks per client lot when the frozen visibility detector alerts. Training uses a policy-gradient algorithm called REINFORCE.

All auxiliary fills count. The final inventory must equal the client target, and any terminal adjustment is included in the reward. Fees are absent during training; the downloadable summary includes accounting-only fee sensitivity at 0.01 and 0.1 tick per traded lot.

The important restriction: the agent selects its order settings once, rather than reacting at every step. It has no state input. The 843 distinct configurations and the fill-triggered cancellation option were supplied by humans. This is a policy-gradient bandit over execution choices, not an unrestricted trader learning every action from scratch.

Four detectors and their combined alert are inherited from the previous work. Their thresholds are frozen using separate normal-trading data. The table displays the rule and visibility detector; all detector scores, stochastic-policy results, order fills and transaction volumes are available in the downloads.

A convincing manipulation discovery would need a repeatable economic benefit from the misleading order, a matching event trace, and independent confirmation after exploratory analysis. A detector alert or a suspicious configuration is insufficient.

The next experiment has to be harder.

Replace the configuration chooser with a state-conditioned agent that submits, cancels or waits at every step. Remove the ready-made fill-triggered cancellation behaviour. Add fees, latency, capital limits and counterparties that do not naively trust displayed depth. Freeze the detectors before training and confirm any promising result on a new, untouched seed set.

The current result sets a baseline for that work. It must not be promoted as proof that AI traders are safe, proof of illegal intent, or a new discovery of autonomous spoofing.

Inspect the evidence.

This pilot has separate files from the earlier unfinished agent experiment. The reproducible bundle includes the exact simulator, learner, calibration inputs and recorded outputs. All trading here is simulated.