Velocity- and Regime-Aware Detection of Intraday Options Market Manipulation, with Explainable Attribution

This paper tackles the challenge of detecting intraday market manipulation, which is difficult because its footprint is brief, buried in millions of quotes, and statistically similar to ordinary volatility. Existing detectors achieve high recall only by flagging many false positives, producing alerts regulators cannot act on. The authors show that manipulation leaves a distinctive dynamic signature: a pump-and-crash pattern visible in the velocity of market state rather than its level.

They build a minute-level detection pipeline, strictly partitioned in time, based on smoothed state velocity: option-Delta velocity for index options and price velocity for equities. Every alert is explained with SHAP attribution. The test period is held strictly out-of-sample, with all thresholds fixed before evaluation. On a locked Indian BANKNIFTY index-options test set, the plain autoencoder recovers 10 of 10 regulator-identified manipulation days.

Conditioning detection on market regimes inferred by a hidden Markov model yields an instructive negative result: regimes are descriptively distinct but using them trades recall for precision. Under the closed-world assumption that unlabeled days are normal, precision remains near 25%. The same dynamic signature appears in thinly traded U.S. equities (SEC v. Patel); the shape of the signature survives the transfer, but its velocity magnitude does not. A pump-reversal shape score ranks the complaint's alleged manipulation days with AUC 0.91 (ARQQ) and 0.81 (ACY), and on the ARQQ worked example, the score peaks inside the complaint's documented minute window.

Finally, exact SHAP attribution over every alert shows that unconfirmed alerts share the regulator-identified days' attribution profile (cosine similarity 0.99), suggesting the precision ceiling is consistent with incomplete enforcement labels rather than detector failure. What transfers across markets and instrument types is the dynamic signature itself.