High-Frequency Market Microstructure Analysis using Transformer-Encoder Networks (TEN) and Graph Neural Networks (GNN) for Detecting Algorithmic Spoofing

Algorithmic spoofing poses a significant threat to market integrity and remains a primary regulatory focus under MiFID II. This paper introduces a Transformer-Encoder Network (TEN) architecture for real-time, microsecond-level detection of spoofing within high-frequency Limit Order Book (LOB) data, leveraging self-attention to capture non-local temporal and cross-sectional dependencies that traditional RNN and LSTM approaches fail to model. To address coordinated multi-asset conspiracy spoofing, a novel TEN-GNN hybrid incorporates a Graph Neural Network driven by a Hawkes Process-based directional causality metric, achieving an F1-score of 0.952 against state-of-the-art Mamba-2 and RetNet benchmarks. Training combines 327 real prosecuted cases, 3,040 human-annotated surveillance examples, and 6,000 adversarially injected synthetic patterns, with out-of-distribution validation across Nasdaq, Eurex, and Binance markets confirming graceful generalization. The framework successfully identified the 2010 Flash Crash layering pattern 42ms before the primary liquidity event, with ablation studies confirming the GNN and adaptive temporal encoding each contribute meaningfully to overall performance. SHAP and Integrated Gradients provide regulatory-grade explainability, enabling compliance officers to construct evidence chains for regulatory submissions. A decoupled optimization strategy achieves 600µs critical-path latency on FPGA+GPU infrastructure, with scalable deployment tiers accommodating institutions of varying resource constraints for live high-frequency market surveillance pipelines.