R&D desk · red team
The adversary
One Adversary invents new evasions, gated by two deterministic oracles before any tactic is trusted.
- Adversaryinvents evasions
ALPHA & OVERSIGHT · HOW IT WORKS
The adversary invents. The system learns.
The adversary invents.The system learns.
Adversarial trade-surveillance, refereed by a Band of agents - where a model invents new market manipulation and deterministic code, not an LLM, renders every verdict.
- 8 agents + 1 rule engine
- 2 desks · 1 wall
- 4 → 5 rules
- 100% deterministic verdicts
§3.1 · The problem
Why this exists
Why this exists- the rules stand still, the tactics move.
Markets can be rigged. A trader can post orders they never plan to fill to fake demand (spoofing), stack fake depth across price levels (layering), trade with themselves to invent volume (wash trading), or push the closing price to mark their own book. Regulators write rules against each of these, but the rules are fixed while the tactics keep moving - a small change to a known trick can slip a rule written for last year's version of it.
Two obvious fixes both fall short. Writing new rules by hand is slow and always a step behind. Letting an AI model decide the verdict is worse: the decision becomes a black box a regulator can't audit and an opponent can try to talk its way past. Alpha & Oversight keeps the verdict deterministic and auditable, and lets the system write its own new rules the moment an old one is beaten.
The four tactics it watches
spoofinglayeringwash tradingmarking the close
Overview
The whole picture
The whole picture- two desks, one wall.
The system is built from two desks that never share a model or a memory. They talk only through Band, a message bus that carries every handoff. The R&D desk is the red team: one Adversary that invents new evasions. The Surveillance desk is the blue team: seven agents that investigate a case, plus one rule engine that is not an agent at all. The rule engine is plain code, and it is the only thing that decides PASS or FLAG.
Order flow crosses a one-way wall: only the bare orders move from R&D to Surveillance, with the adversary's reasoning and model identity stripped off first. Every message is sealed into a hash-chained ledger, so the whole decision can be replayed and checked.
0 agent
⟂ Chinese wall
SanitizedBridge
Only the bare order events cross R&D → Surveillance. The adversary's reasoning and model identity are stripped off first; the rulebook flows back read-only.
events only · on Band
Surveillance desk · blue team
The investigators
Seven agents investigate a case and shape the contested inputs - plus one rule engine that is not an agent, the sole PASS / FLAG authority.
- Anomaly Detector
- Investigator
- Specialist
- Prosecution
- Defense
- Adjudicator
- Escalation Manager
Rule enginenot an agent · code decides
Methodology · five sub-flows
How a case actually moves - invent, investigate, decide, learn.
(a) following one case, end to end
A line of agents, no one calling the next.
A line of agents,no one calling the next.
A case moves down a line of agents that never call each other directly - each drops its work on Band and the next picks it up. The Anomaly Detector computes hard features (cancel-to-fill, book depth, self-match) and decides if the flow looks suspicious. The Investigator recruits the right Specialist by those features, not by a guess. The Specialist proposes the contested inputs the engine can't derive - the time window, the bona-fide orders, the intent. Prosecution and Defense then argue the case locally, off Band, and the Adjudicator settles their numbers.
(b) inventing a new evasion
Two referees, before anything crosses.
Two referees,before anything crosses.
A new tactic is never used until it proves itself twice. The Adversary proposes an order sequence, and two deterministic referees gate it: the real rule engine must miss it (it evades), and a backtest must show it makes money and moves the price (it's real). Only a sequence that evades and profits crosses the wall.
(c) who decides the verdict
The verdict is never an opinion.
The verdict is neveran opinion.
The verdict is never an opinion. The engine takes the order events, the inputs the debate resolved, and the active rules, then runs each rule's math. The first rule that trips returns a FLAG with the rule id and the exact metric that crossed the line; if none trip, the case passes. The agents only shape the contested inputs. The engine alone turns them into PASS or FLAG, the same way every time.
spoofing
FINRA 5210
cancel_ratio ≥ 0.8
layering
FINRA 5210
depth_levels ≥ 3
wash
SEC 10b-5
self_match_ratio > 0.5
marking
SEC 10b-5
eod_print_move_bps ≥ 100
(d) closing the loop
From four rules to five, in one click.
From four rulesto five, in one click.
Here is the part that makes it self-improving. When the Adversary's novel evasion reaches the engine, the seed rules miss it and the case passes - but because the flow still looked suspicious, it escalates to a human instead of closing. A compliance officer confirms it really is manipulation, and that one click does the rest: a new rule is derived from the case, replayed through a regression gate to prove it now flags, and codified. Active rules go from four to five, and the case flips from PASS to FLAGGED. The Adversary has to invent something new.
The EvasionSTEP 1 / 6
- 01Clean flow
- 02The adversary's move
- 03Across the Band
- 04The debate
- 05The verdict
- 06Codify
Anomaly Detector · open model
Surveillance watches every order. Most flow is benign.
The Anomaly Detector takes the first glance - computing the hard features (cancel-to-fill, book depth, self-match). At 0.08 nothing trips the rulebook, so the case closes clean.
R&D Adversary · open model
ADVERSARY · 400ms layering-evasion · Market #0
The R&D red team plants the evasion. A 400ms cancel cluster forms.
Orders placed only to be pulled - layering the book to mislead. Cancel-to-fill spikes to 0.94, and two deterministic referees confirm it both evades the rulebook and profits before it may cross the wall.
SanitizedBridge → Investigator
▓ waiting on Band ▓
The case crosses the Chinese wall. Only sanitized events pass.
The SanitizedBridge strips the adversary's reasoning and even its model - only raw order events cross. Surveillance picks them up; the Investigator turns blue, waiting on Band as it recruits a specialist.
Specialist → Prosecution ⚔ Defense
frontier ⚔ open · contesting the window
Prosecution ⚔ Defense. They contest the window.
The Specialist proposes the contested inputs; a frontier Prosecution argues a wide window, an open-weight Defense argues tight. The bracket quivers until the Adjudicator settles one conservative set of numbers.
Rule Engine · deterministic
PASS (rules missed) → ESCALATE
The deterministic rule draws 100ms. The cluster sits outside.
The seed rule FINRA-5210-layering scores PASS - the 400ms evasion slips its 100ms window. No LLM can overrule the engine, so the case ESCALATES to a human.
Human confirm → RULE_CODIFIED
FLAG ✓ · regression gate PASS · rules 4 ▸ 5
The system learns. That evasion can never evade again.
The human confirms. A new rule is derived and regression-gated - replayed against the original evasion until it FLAGs - then codified. The rulebook grows 4 ▸ 5 and a RULE_CODIFIED message goes out on Band.
live · market #0cancel_rate0.08depth1window100msverdict-rules4
(e) why you can trust it
A wall you can’t coach, a ledger you can’t edit.
A wall you can’t coach,a ledger you can’t edit.
Two things carry the trust. The wall (the SanitizedBridge) strips the adversary's reasoning and model identity before any order crosses, so the blue team can't be coached. The ledger seals every Band message into a hash chain - each entry's hash is built from the previous hash plus the message body, and binds the real Band message id. Change one byte and the chain breaks, so verify_chain() returns false. The decision isn't just recorded; it's tamper-evident.
§3.4 · Project structure
How the code is organized
How the codeis organized.
The backend keeps the deterministic core apart from the agents that feed it.
moduleresponsibility
rules/the rule engine, the per-family math, and the rule registry.
agents/the agents and their specialist registry.
band/Band transport and the SanitizedBridge wall.
audit/the hash-chained ledger.
state/the case state machine.
server/the FastAPI server (SSE stream, case endpoints, demo triggers).
Every flag can be traced from a Band message all the way to a cited rule.
The differentiator
What's actually new
What'sactually new.
Plenty of systems put a model in the loop. The point here is the opposite: every load-bearing decision is structural or deterministic, and the models only ever shape contested inputs.
00
The code decides, not a model.
The rule engine is the only authority for PASS or FLAG.
00
The rulebook co-evolves.
A confirmed miss becomes a regression-tested rule in one step.
00
The wall is structural.
Two separate Band identities; the crossing strips reasoning and model identity. Isolation by construction, not policy.
00
The audit binds real messages.
The hash chain ties each step to a real Band message id.
00
Different model families guard each other.
The four seats on an adversarial boundary run four different model families, so a blind spot in one can't quietly pass to the next.
00
Both gates are deterministic.
A new evasion must beat the real engine and profit in a backtest. Neither test is an LLM.
Model-family diversity
Four seats, four families, one adversarial boundary.
The four seats that sit on an adversarial boundary - adversary, prosecution, defense, adjudicator - run four different model families. A manipulation the Anthropic adversary hides should be caught by a Moonshot prosecutor, weighed against a DeepSeek defender, and adjudicated by a Zhipu model - none of which share the adversary's blind spots.
| Seat | Model | Family |
|---|---|---|
| Adversary (R&D) | claude-opus-4-8 | Anthropicfrontier |
| Prosecution | Kimi-K2.7 | Moonshot |
| Defense | DeepSeek-V4-Pro | DeepSeek |
| Adjudicator | GLM-5.2 | Zhipu |
| Escalation Manager | Qwen3.5-397B | Qwen |
| Anomaly · Investigator · Specialist | Qwen3-Next-80B | Qwen |
| Rule engine | - deterministic | - |
adversarial-boundary seat
Alpha & Oversight · The live desk
See it live
See it live.Watch the adversary lose.
Open the desk to watch a case move across Band in real time - the handoff, the local debate, and the deterministic verdict - or read the full report for the architecture end to end.
- 8 agents + 1 rule engine
- 2 desks · 1 wall
- 4 → 5 rules
- 100% deterministic verdicts