# Protecting Retail Investors from Order Book Spoofing using a GRU-based Detection Model

arXiv: https://arxiv.org/abs/2110.03687 · HTML: https://mlsanity.com/paper/2110.03687/

## Key facts

- Cited by 2 papers in the map (data through 14 Oct 2026).
- Builds on 4 of its 10 references that are in the map.
- First posted on arXiv 8 Oct 2021.

## Builds on (most cited first, 4 of 4)

- [Adam: A Method for Stochastic Optimization](https://mlsanity.com/paper/1412.6980/) (2014)
- [Learning Phrase Representations using RNN Encoder-Decoder for Statistical Machine Translation](https://mlsanity.com/paper/1406.1078/) (2014)
- [Empirical Evaluation of Gated Recurrent Neural Networks on Sequence Modeling](https://mlsanity.com/paper/1412.3555/) (2014)
- [Deep Gated Recurrent and Convolutional Network Hybrid Model for Univariate Time Series Classification](https://mlsanity.com/paper/1812.07683/) (2018)

## Built on by (most cited first, 2 of 2)

- [Generative Dynamic Graph Representation Learning for Conspiracy Spoofing Detection](https://mlsanity.com/paper/2510.05562/) (2025)
- [ReguSim: Evaluating LLM Agent Rule Grounding in Financial Compliance](https://mlsanity.com/paper/2608.19974/) (2026)

## Abstract (arXiv)

Market manipulation is tackled through regulation in traditional markets because of its detrimental effect on market efficiency and many participating financial actors. The recent increase of private retail investors due to new low-fee platforms and new asset classes such as decentralised digital currencies has increased the number of vulnerable actors due to lack of institutional sophistication and strong regulation. This paper proposes a method to detect illicit activity and inform investors on spoofing attempts, a well-known market manipulation technique. Our framework is based on a highly extendable Gated Recurrent Unit (GRU) model and allows the inclusion of market variables that can explain spoofing and potentially other illicit activities. The model is tested on granular order book data, in one of the most unregulated markets prone to spoofing with a large number of non-institutional traders. The results show that the model is performing well in an early detection context, allowing the identification of spoofing attempts soon enough to allow investors to react. This is the first step to a fully comprehensive model that will protect investors in various unregulated trading environments and regulators to identify illicit activity.