Detecting the Unseen

Can artificial intelligence detect hidden market manipulation without being taught what manipulation looks like?

1. Introduction

Every exchange keeps a limit order book: the list of buy orders (bids) and sell orders (asks) waiting at each price. Traders read it to judge supply and demand, which is what a spoofer exploits. In Urra, Lopez Gonzalez & Sheth v FCA (Upper Tribunal, July 2025) three bond traders placed large orders a tick or two behind the best price, a small genuine order on the other side, and cancelled the large orders within seconds, often just after the small order traded [9].

Supervised machine learning needs many labelled examples of manipulation, which regulators rarely have. Unsupervised anomaly detection avoids labels: it learns normal behaviour and flags departures from it. Earlier work used generative and recurrent models trained on normal data [5, 7] and hidden Markov models with anomaly states [1]; Wang and Wellman built agent-based models in which spoofing is profitable [10, 11]; Fabre and Challet modelled how spoofable a book is [2]. The closest study is Poutré, Chételat and Morales [12], who trained a Transformer autoencoder on normal order-book data from five NASDAQ stocks, inserted synthetic quote stuffing, layering and pump-and-dump, and detected them "without requiring any prior knowledge of manipulation patterns". DeLise [13] found that adding a few labelled frauds to such a detector improves it greatly. Those studies compare manipulation with ordinary trading. This one adds the comparison a regulator most needs: honest orders that look the same. The question is narrower and, I think, more basic: is unusual the right target at all?

2. Research question and hypotheses

Question. Can a detector that is never shown an example of spoofing tell spoofing apart from honest trading?

H1 (stated before the experiments). Label-free detectors trained only on normal trading will catch synthetic spoofs more reliably than a hand-written surveillance rule, especially on variants the rule was not written for.
H2. Detectors that read a sequence of time steps will do better than detectors that read one step at a time.
H3 (added after Part 1). A detector given the definition of the offence, but no examples, will separate spoofs from honest large orders where unusualness-based detectors could not.
H4 (added after Part 2). A spoofer who knows about that detector cannot dodge it without giving up what the spoof was for.
H5 (added before Part 4). A search program that looks for dodges itself will find none that keeps the spoof's benefit.
H6 (added before Part 5). Thresholds that adapt to current market conditions will cut false alarms in a volatile market without losing spoofs, but will not help tell spoofs from honest orders of the same size.
H7 (added before Part 7, after the question changed). A trader that learns only from an execution reward will discover a spoof-like order, as Byrd reports [15], and the detectors will flag it.

Because "catching" is meaningless without false alarms, every detector is also tested on honest large orders, on a volatile but honest market, and in Part 2 on honest traders who cancel quickly or change their mind.

3. Method

3.1 A market where spoofing can work

The simulator (written for this project, src/orderbook.py, src/market.py) is a price-time-priority limit order book with four kinds of normal trader: zero-intelligence traders who trade around a noisy estimate of value; book-reading traders who lean towards buying when bids outweigh asks (after Wang and Wellman's book-reading agents [10]); two market makers who quote both sides and cancel and replace every five steps, so quick cancellations are normal; and an institution that occasionally rests a genuinely large order. A calm and a volatile regime differ in how noisy and jumpy the underlying value is. In total 2,262 sessions of 2,000 steps were simulated for Part 1, each with its own random seed; training, threshold-setting and test sessions never share a seed.

3.2 Spoofing and honest episodes

Spoof: a large wall one or two ticks behind the best price and a small genuine order (3 lots) at the best price on the other side; the wall is cancelled when the small order trades or after 30 steps. Layered spoof: the same total size split over four price levels. Honest twin: the same session and seed with the small order but no wall, to measure what the wall achieves. Honest large order: a genuine order of the same size and placement left on the book for 150–400 steps. Part 2 adds quick withdrawal (an honest large order cancelled after 5–25 steps, nothing traded) and change of mind (the same, followed by a small trade the other way). Wall sizes are 1, 2, 4, 8 and 16 times a typical order.

3.3 Detectors

The market is summarised every five steps (a "bar") by 18 generic features (depth at five price levels, spread, price change, and counts and volumes of orders, cancellations and trades), and optionally six "spoof-informed" features chosen because I knew what spoofing looks like. Detectors: the rule (the largest order cancelled within 50 steps; its alert threshold, set on normal data, is 17 lots); PCA (reconstruction error, a linear autoencoder); Isolation Forest [6], written from scratch; and two sequence models that read eight bars, sequence PCA and an LSTM autoencoder [3, 7]. All are fitted on normal calm sessions only.

3.4 Scoring

Each detector's alert threshold is the 99th percentile of its scores on separate normal sessions (about 1% of normal bars alert), fixed before any spoofing data is seen. An episode is caught if any bar in its eight-bar window alerts. The chance level is how often a random window of normal trading contains an alert anyway (6%). Threshold-free separation is measured with AUC. Intervals are 95% bootstrap intervals over episodes, and detectors are compared on the same episodes with a paired bootstrap.

3.5 Part 2: account-level detectors

Part 2 records which account placed each order, as regulators can: trading venues must keep order records that identify the client [8]. Account numbers come from a separate random stream, so the market is identical event for event (this is tested). For each account and each 40-step window the simulator counts lots added, cancelled and traded on each side. The principle detector turns the legal definition of manipulation (Market Abuse Regulation, Article 12: orders giving false or misleading signals about supply or demand [4]) into three clauses: the account showed interest on one side (submitted more there than on the other), withdrew it rather than trading it (cancelled more on that side), and traded the other way on balance. Its score is the size of that false signal in lots; it is never trained, and its threshold is set so that 1% of normal 40-step windows contain an alert (10 lots). Its control is an untaught Isolation Forest given exactly the same account data. The examples rung is a logistic regression on four order features (size, lifetime, fraction traded, distance from the best price) shown k labelled spoof walls, and in a second version k labelled honest large orders too, tested on held-out sessions.

4. Results

4.1 Spoofing works in this market

An 8× wall raised the chance that the spoofer's genuine order filled by +12 points (+6 to +20) compared with its honest twin, and a 16× wall by +16; layering worked too (+15 points at 8×). Prices moved about +0.11 ticks in the spoofer's favour at 8× (Table 1). Missing these spoofs therefore matters.

4.2 Label-free detectors barely beat chance; the rule catches only its own pattern

The untaught detectors caught few spoofs: the Isolation Forest 12% and the LSTM autoencoder 9% of even the largest, against a chance level of 6%. Adding spoof-informed features let PCA catch 98%, but it also flagged 90% of honest large orders: it had learned "big order", not "manipulation". The rule caught 100% and 100% of single-wall spoofs at 8× and 16×, because its threshold sits between the 4× and 8× sizes; split into four smaller orders, the same spoof fell under it and the rule caught 8% (Table 2). H1 is not supported.

4.3 They cannot tell a spoof from an honest order of the same size

Spoofs are somewhat unusual compared with ordinary trading, but against honest large orders of the same size every untaught detector scored an AUC between 0.14 and 0.44; the LSTM autoencoder scored 0.14 (0.07 to 0.22), meaning it found the honest orders more unusual (Table 3). A shuffle test, which scrambles the order of bars inside each window, left the sequence models' AUCs almost unchanged, so they were not using the order of events. Recomputing features every single step did not help (LSTM AUC 0.52 against normal trading, 0.19 against honest orders). H2 is not supported.

4.4 Legitimate volatility produces false accusations

When the market became volatile but stayed honest, detectors trained on calm trading flagged 11%–51% of normal bars instead of 1%, while the rule stayed at 0.8%. Training on calm and volatile trading brought false alarms back to 1.5%–2.1% (Table 4). An anomaly detector is only as good as its picture of "normal", and an honest market changes.

4.5 Detection delay

Among caught spoofs, the rule's first alert came on average about 7 steps after the wall appeared (Table 5), when the wall was cancelled, so after the spoof had already worked. All detectors here, including Part 2's, are after-the-fact surveillance rather than live prevention; an alert is a reason to look closer, not a trade stopped.

4.6 Order by order, and in other markets

An Isolation Forest trained on every individual order (size, lifetime, fraction traded, distance) found spoof walls unusual against ordinary orders (AUC 0.97) but ranked every honest large order above every spoof (AUC 0.00); without size, spoofs stopped standing out at all (0.56). A spoof is unusual only in its size, and its quick cancellation looks like market-making. Repeating the core experiment in four other markets (Table 9), one claim failed: untaught PCA caught more spoofs in some markets, but it flagged honest orders just as often, so the central finding, that untaught detectors cannot tell the two apart, held in every market.

4.7 Part 2: what kind of teaching works

Shown only labelled spoofs, the classifier learned "large order": it caught every wall, but flagged 100% of honest large orders and caught 0% of layered spoofs. Shown honest large orders as well, it learned "large and short-lived": it stopped flagging honest orders, but caught 30% of layered spoofs at 16× and 0% at 8×, and flagged 100% of honest quick withdrawals, as did the rule (100%). More examples (up to 40) changed nothing.

The principle detector caught 81% and 92% of single-wall spoofs at 8× and 16×, and 85% and 85% of layered spoofs, because splitting a wall does not change what the trader showed, withdrew and traded. On the same layered episodes it beat the rule by +77 points at 16× (p < 0.001). Almost every spoof it missed never paid off (its small order never traded); of the spoofs that did, it caught 98% at 8× and 100% at 16×. It flagged 0% of honest large orders and 0% of honest quick withdrawals, and its false alarms barely moved in a volatile market (0.7% to 0.9% of windows). The untaught Isolation Forest on the same account data caught 0%: it ranked spoofers as stranger than honest large traders (AUC 1.00) but some honest trader was always stranger still (AUC 0.00 against ordinary trading). The success comes from the principle, not the data. H3 is supported, with the limits below.

4.8 The case no detector solved, and attempts to break the principle

An honest trader who changes their mind performs exactly the actions of a spoofer. The principle flagged 92% of these (AUC 0.50 against spoofs: no separation) and the rule 98%. The principle held in all four alternative markets (80%–96% of spoofs and 85%–90% of layered spoofs at 16×) and however many traders shared an account. Its weaknesses are accounts: inside a broker account carrying 20% of all orders it caught 42% at 8× and 66% at 16×, and a spoofer who shows the wall from one account and trades from another escaped completely (0%) unless the accounts were linked to their owner (80%). Checking every pair of accounts without links caught 100%, but also flagged 100% of honest quick withdrawals (Table 8).

4.9 Part 3: the price of evasion

A detector is only useful if a spoofer cannot simply step around it, so the spoofer was given the obvious dodges. Patience, leaving the wall up after the genuine order traded, beat the 40-step windows of Part 2 at almost no cost (16× catch rate 92% → 29% with a 40-step wait), and longer windows only help until the spoofer waits longer still (51% with 160-step windows against a 160-step wait). Judging every withdrawn order over its own life instead, from the step it was placed to the step it was withdrawn, closed the gap: 78% of the most patient spoofers were caught (against 85% with no dodge). On honest trading this version kept false alarms at 0.7% of windows (1.3% when volatile) and flagged 0% of honest large orders, 0% of honest quick withdrawals and, as expected, 92% of honest changes of mind. Buying back what was sold made no difference until the spoofer bought back all of it (86% caught after buying back one lot); buying back everything escaped (20% caught) but left the spoofer 2.0 lots worse off than its honest twin, having paid about 0.8 ticks per lot. Combined with Part 1 (walls below 8× do not help the spoofer) and Part 2 (two accounts escape unless linked to their owner), every dodge tried either throws away the benefit or depends on accounts the regulator cannot link. H4 is supported for the dodges tested, which are not every possible strategy.

4.10 Part 4: an AI challenger

Part 3 tested dodges I thought of. To test dodges I had not, I wrote a challenger: a genetic search over seven settings a trader controls (wall size, distance from the best price, number of layers, how long the wall stays up after the trade, how much is bought back, and the size and distance of a decoy order on the other side). It starts from 32 random strategies, keeps the best 8, mutates and mixes them, and repeats for 15 rounds, learning only from one detector's alerts at a time. Its score is what a spoofer wants: lots of its genuine order that traded, minus anything bought back or any of its wall that traded, beyond an honest twin with only the genuine order; a caught spoof has its profit confiscated. Four searches (no surveillance, the rule, and two versions of the legal definition) used 12 practice sessions; every strategy ever tried was then scored against every detector and the five best re-tested on 40 unseen sessions.

The challenger gamed the scoring before the detector. When every lot the account sold counted, it added a real order near the price and simply sold more. When the twin ran the same strategy without the wall, it added a decoy that hurt the twin, so the wall only undid self-inflicted harm. Each version found a hole in how success was measured, not in the detector; the score above is the third.

Then it found a real loophole. The legal definition as written in Part 2 counts interest on balance, which is what lets it ignore market makers. A large decoy on the other side, far from the price, cancels the wall out of those sums, while book-reading traders, who look only at the five nearest price levels, never see the decoy. Against the order-life detector the challenger's best strategy (12x wall, 3 ticks back, kept 1 step after the trade, decoy 70% of the wall, 12 ticks back on the other side) kept +0.28 lots per spoof, as much as anything found with no surveillance at all (+0.28, +0.11 to +0.46), and was never caught. The fix follows the law's own wording: manipulation is a false or misleading signal, and a signal nobody can see is not one. The refined detector weighs every order by how often traders can see a price that far from the best, measured on normal trading (always up to four ticks, 15% at five, almost never beyond), at the closest the order came while alive, and leaves out orders placed at the best price, which are the next to trade. It caught 90% of that strategy.

The same change fixed a false accusation. An honest market maker working off a position quotes more on one side at the best price and cancels and requotes every few steps, sometimes while still trading the other way: the order-life detector flagged 98% of them, the refined one 0%. It kept the rest of the earlier results: 85% of 16× spoofs and 85% of layered spoofs caught, no honest large orders or quick cancels flagged, and false alarms of 0.6% (1.2% when volatile) (Table 13).

Against the refined detector the best strategy found was 5x wall, 3 ticks back, in 4 layers, decoy 10% of the wall, 7 ticks back on the other side: it kept +0.12 lots per spoof (+0.03 to +0.26), 45% of the unwatched best, by staying small enough to sit under the alert threshold (8% caught). The windowed version of the definition caught 85% of it, and the refined version caught 90% of the dodge that beat the windowed one, so I added a fifth detector that alerts when either version does, and ran a fifth search against it. It did not help. The challenger kept the same small wall and added a decoy to slip past the windowed half too (5x wall, 3 ticks back, in 4 layers, decoy 50% of the wall, 7 ticks back on the other side): it still kept 45% of the unwatched best (+0.12 lots per spoof, +0.03 to +0.26; 8% caught). Meanwhile combining quadrupled the false alarms (2.5% of calm 40-step blocks, 3.3% when volatile) and flagged 100% of the honest market makers. What is left is a matter of size, not of rules: a spoof small enough to sit under the alert threshold escapes, and catching it means accepting more false alarms. H5 is not supported as stated: a search found a dodge that kept the whole benefit against the original definition. Fixing it from the law left a spoofer able to keep less than half, and only by spoofing small.

4.11 Part 5: thresholds that follow the market, and the alert budget

Every detector so far had one fixed threshold, set on calm trading. A threshold that adapts to current conditions, rising in proportion to how busy the detector's own recent scores are (never falling below the calm level), cut the untaught detectors' false alarms in a volatile market from 11%–51% of bars to 6%–17%: better, but still far above the 1% target (Table 14). The volatile-market spoofs they had seemed to catch (61%–91%) fell to 29%–44%, because most of those catches were false alarms that happened to land on a spoof, and honest large orders were flagged as often as before (23%–50% fixed, 23%–50% adaptive). H6 is supported: an adaptive threshold helps with volatility and does nothing for the deeper problem.

A surveillance desk sees alerts, not percentages of bars, and each one has to be investigated. Counting alerts in normal trading (alerts close together count once) turns into precision, the share of a desk's alerts that are real spoofs, which depends on how common spoofing is (Table 15). The refined legal definition raised 0.25 false alerts per session: if one large spoof happened in every session, 77% of its alerts would be real; one in ten sessions, 25%; one in a hundred, 3%. The untaught detectors raised 0.5–2.2 false alerts per session and, at one spoof in ten sessions, only 1% of their alerts would be real. This is the base-rate problem of every rare-event test: when the offence is rare, even a good detector's alerts are mostly false, which is one more reason an alert can only start an investigation.

4.12 Part 6: the price of a false alarm

Parts 4 and 5 point to one trade-off: a spoof small enough to sit under the alert threshold escapes, and lowering the threshold means more false alarms. So the question a regulator actually faces is how much manipulation it must tolerate for each false alarm it is willing to investigate. To draw that curve, 61 strategies (the challenger's best against every detector, plus the most profitable with no surveillance and an ordinary spoof) were played again recording each spoof's raw score under every detector. For every threshold, the spoofer picked its best strategy on the 12 practice sessions (or chose not to spoof) and its payoff was measured on the 40 unseen ones.

The curves differ in kind (Figure 8). Against the original legal definition, windowed or by order life, the decoy kept the full benefit (+0.28 and +0.28 lots per spoof, the same as with no surveillance, +0.28) at every false-alarm rate up to 10%: no threshold catches a signal the detector cannot see. Against the rule, splitting the wall kept +0.10 at every rate. Against the refined definition the curve falls: to +0.11 once 0.4% of normal 40-step blocks may alert, and from 1.1% the best strategy the spoofer could choose lost lots on unseen sessions (-0.10), so not spoofing was better. Measuring the signal as the market sees it turned a loophole no threshold could close into a trade-off a regulator can set. These numbers come from one simulated market and a pool of strategies the challenger found; a cleverer spoofer could do better.

4.13 Part 7: does an AI trader learn to manipulate on its own?

The last part reverses the question. Instead of asking whether a detector recognises manipulation it was never shown, it asks whether a trader that is never told about manipulation discovers it. The trader has an ordinary job: buy or sell three lots for a client within 30 steps, scored by the price it achieves against the mid price when the order arrived, with every fill and the final square-up at market counted. Each time it picks five settings: how aggressively to price its own order, and whether to add an extra order (side, size, distance, and when to cancel it). One of the 843 combinations is the textbook spoof. It learns with REINFORCE, a policy-gradient method, over 19,200 training episodes: three independent learners on the execution reward alone, and three that also pay a fine of two ticks per lot whenever the refined legal definition flags them. The design, the success criteria and the controls were written down before the run (research/emergence-protocol.md), and each learner's final choice was tested on 128 held-out sessions in a calm market, a volatile market, and one in which no trader reacts to the order book.

All 6 learners settled on ordinary execution: 5 wait at the best price and the other steps one tick in front, and none chose the spoof's signature (Table 16). Waiting beat the benchmark chosen on separate validation sessions in the calm market (+0.14 ticks per lot, +0.03 to +0.25) but not in the volatile one (-0.51). The hand-designed spoof, included only as a control, was not reliably profitable even in the calm market (+0.21, -0.39 to +0.65), and lost heavily when the market was volatile (-32.36) or did not react to the book (-3.11), because its large order sometimes really trades. The refined detector flagged 100% of it. H7 is not supported in this market. Byrd [15] reports a learning trader that did discover spoofing, and Martínez-Miranda and colleagues [16] study manipulation learned by reinforcement learning; whether a learner discovers manipulation depends on whether the market rewards it once its risks are counted. This learner chose its settings once per order rather than reacting step by step, from a menu that people designed, so it is a restricted replication, not a test of every kind of AI trader.

5. Discussion

The untaught detectors did what they were built to do: they found what was unusual. The trouble is that a working spoof is designed to be unusual in only one way, its size, and honest large orders are just as big. Unusualness and manipulation are different targets. Detectors taught by examples or by a rule did better, but they learned the look of the spoofs they were given, so a spoofer who changes the look, here by splitting the wall, escapes. The legal definition describes the purpose instead: a signal shown, then withdrawn, to help a trade on the other side. That survives a change of look, but it needs to know who placed each order, and it reaches a hard limit: behaviour can show that a signal was false, but not why it was sent. That is why the law asks for intent to be proved, and why an alert should start an investigation rather than end one. Parts 4 and 5 added two lessons. A detector written from a principle can still have holes, but they are found and fixed by reading the principle more carefully, not by adding examples: the decoy loophole was closed by taking "signal" literally. And when the offence is rare, even a good detector's alerts are mostly false, so precision, not only catch rate, decides whether it is useful. Part 6 joins the two: the right way to compare surveillance methods is not a catch rate at one threshold but the curve of what a determined spoofer keeps against the false alarms a regulator accepts. Part 7 adds a caution from the other side: whether an AI trader discovers manipulation depends less on the AI than on whether the market makes manipulation pay after its risks, so a learner's good behaviour in one market is no guarantee in another.

6. Limitations

The results describe a simulation I designed, not real markets; real traders, latency and accounts are richer and messier. The rule's success is partly circular because it was written knowing the pattern, which is why the layering test exists. The principle detector was designed after Part 1 by someone who knew how the spoofer worked; it encodes the law rather than the spoofer's settings and was tested on cases it was not tuned for, but it remains one reading of the law. Samples are about 60–80 spoof episodes per size, so intervals are wide. The background traders do not learn; the challenger does, but it is a simple search over seven settings, not every strategy a human could invent, and the refined detector was designed after seeing its first loophole. Visibility weights come from this simulator's book. The learning trader of Part 7 chooses settings once per order from a menu people designed, has no view of the market as it changes, and was trained in one simulated market; two earlier runs stopped (one when the computer slept, one on a bug in the final square-up, since fixed), and only the complete run is reported. No result here is evidence about any real trader.

7. Conclusion and further work

A detector cannot find this manipulation by looking for the unusual. It can find it by looking for the purpose, given who placed each order, and nothing found here separates manipulation from an honest change of mind. An AI trader that learned only to fill orders well did not discover spoofing here, because in this market spoofing did not reliably pay. Next steps, for Sixth Form: give the learner a view of the market and step-by-step actions (submit, cancel, wait) instead of a menu; train it across several market designs, with fees and latency; test it against real order-book data (LOBSTER, through an academic account); and study how regulators could link accounts to their owners.

Reproducibility and use of AI tools

All code, data-generation seeds and results are public at github.com/trader213132/detecting-the-unseen. python run_experiments.py, run_extensions.py, run_teaching.py, run_evasion_cost.py, run_challenger.py, run_thresholds.py, run_frontier.py and run_emergence.py reproduce every number; python -m pytest runs the tests; this report is written by python build_report.py from the results files. AI assistants (Claude and ChatGPT) were used to help write code and draft text; the experiments, checks and conclusions are my responsibility. All spoofing happens inside an offline simulation.

References

1. Cao, Y., Li, Y., Coleman, S., Belatreche, A. & McGinnity, T. M. (2015). Adaptive hidden Markov model with anomaly states for price manipulation detection. IEEE Transactions on Neural Networks and Learning Systems, 26(2), 318–330.
2. Fabre, T. & Challet, D. (2025). Learning the spoofability of limit order books with interpretable probabilistic neural networks. arXiv:2504.15908.
3. Hochreiter, S. & Schmidhuber, J. (1997). Long short-term memory. Neural Computation, 9(8), 1735–1780.
4. Regulation (EU) No 596/2014 on market abuse (Market Abuse Regulation), Article 12 and Annex I, as retained in UK law.
5. Leangarun, T., Tangamchit, P. & Thajchayapong, S. (2018). Stock price manipulation detection using generative adversarial networks. IEEE Symposium Series on Computational Intelligence.
6. Liu, F. T., Ting, K. M. & Zhou, Z.-H. (2008). Isolation Forest. IEEE International Conference on Data Mining.
7. Malhotra, P., Ramakrishnan, A., Anand, G., Vig, L., Agarwal, P. & Shroff, G. (2016). LSTM-based encoder-decoder for multi-sensor anomaly detection. arXiv:1607.00148.
8. Commission Delegated Regulation (EU) 2017/580 (RTS 24) on the maintenance of relevant data relating to orders in financial instruments, as retained in UK law.
9. Urra, Lopez Gonzalez & Sheth v Financial Conduct Authority (2025). Upper Tribunal (Tax and Chancery Chamber), decision of 1 July 2025.
10. Wang, X. & Wellman, M. P. (2017). Spoofing the limit order book: an agent-based model. Proceedings of AAMAS 2017.
11. Wang, X., Hoang, C., Vorobeychik, Y. & Wellman, M. P. (2021). Spoofing the limit order book: a strategic agent-based analysis. Games, 12(2), 46.
12. Poutré, C., Chételat, D. & Morales, M. (2024). Deep unsupervised anomaly detection in high-frequency markets. The Journal of Finance and Data Science, 10, 100129. doi:10.1016/j.jfds.2024.100129.
13. DeLise, T. (2023). Deep semi-supervised anomaly detection for finding fraud in the futures market. arXiv:2309.00088.
14. Financial Conduct Authority (2024). Market Abuse Surveillance TechSprint. fca.org.uk.
15. Byrd, D. (2022). Learning not to spoof. Proceedings of the 3rd ACM International Conference on AI in Finance (ICAIF '22). doi:10.1145/3533271.3561767; arXiv:2306.06087.
16. Martínez-Miranda, E., McBurney, P. & Howard, M. J. (2015). Learning unfair trading: a market manipulation analysis from the reinforcement learning perspective. arXiv:1511.00740.