This paper presents a quantitative microstructural analysis of spoofing in high-frequency trading, focusing on the manipulation of volume imbalance to influence price movements. The authors develop a static model of the limit order book where a trader can post a spoof limit order at a certain depth to artificially increase supply, thereby reducing the imbalance and shifting the price distribution downward. The trader then benefits from buying at a lower price after canceling the spoof order. The model derives conditions for spoofing to be profitable over immediate or delayed market orders, showing that spoofing is more attractive when the probability of the spoof order being executed is low, the sensitivity of imbalance to depth is high, the trade size is large relative to market depth, and the initial imbalance is near 0.5 (balanced market). The optimal spoofing strategy is characterized, and its impact on imbalance is quantified.

Based on the theoretical insights, the authors propose a detection method that monitors the imbalance before and after market orders. Under normal conditions, the imbalance before a market order follows a steady-state distribution, but under spoofing, it is artificially lowered. The method uses the Wasserstein distance to compare the conditional distribution of pre-market-order imbalance given post-market-order imbalance to two benchmarks: the legitimate steady-state distribution and the theoretical spoofed distribution. A larger distance to the legitimate benchmark relative to the spoofed benchmark indicates potential spoofing. The model is calibrated to real Level 2 data from TMX, and the detection procedure is illustrated on several stocks. The paper contributes a theoretical foundation for understanding spoofing mechanics and a practical tool for regulators to monitor suspicious trading activity in real time.