
Algorithmic spoofing, defined as rapid order placement and cancellation, poses a significant threat to market integrity and remains a primary regulatory focus under MiFID II (Markets in Financial Instruments Directive II). This paper introduces a Transformer-Encoder Network (TEN) architecture designed for the real-time, microsecond-level detection of spoofing within highfrequency Limit Order Book (LOB) data. Unlike traditional RNN (Recurrent Neural Network) and LSTM (Long Short-Term Memory) approaches, TEN leverages self-attention to capture the non-local temporal and cross-sectional dependencies critical for identifying manipulative intent. To address coordinated, multi-asset "conspiracy spoofing," we propose a novel TEN-GNN hybrid model. This architecture incorporates a Graph Neural Network (GNN) driven by a Hawkes Processbased directional causality metric. By replacing standard symmetric correlations with this lead-lag branching ratio, the model moderately improves the detection of inter-asset manipulation. When benchmarked against state-of-the-art 2025/2026 architectures, such as Mamba-2 (SSMs: State Space Models) and RetNet, the proposed framework achieves a superior F1-score of 0.952 in multi-asset scenarios. Validation on historical prosecuted cases, including the 2010 Flash Crash, confirms its efficacy on real-world intent. Furthermore, we integrate SHAP (SHapley Additive exPlanations) and Integrated Gradients for regulatory explainability and employ a decoupled optimization strategy to achieve sub-millisecond latency (600 µs critical-path on FPGA (Field-Programmable Gate Array)+GPU (Graphics Processing Unit) infrastructure with decoupled graph computation; see Table 10 for hardware specifications). This end-to-end framework provides a robust and compliant solution for live high-frequency market surveillance pipelines.
| selected citations These citations are derived from selected sources. This is an alternative to the "Influence" indicator, which also reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | 0 | |
| popularity This indicator reflects the "current" impact/attention (the "hype") of an article in the research community at large, based on the underlying citation network. | Average | |
| influence This indicator reflects the overall/total impact of an article in the research community at large, based on the underlying citation network (diachronically). | Average | |
| impulse This indicator reflects the initial momentum of an article directly after its publication, based on the underlying citation network. | Average |
