Hidden orders

Split-order linking and execution-algo fingerprinting. How we identify parent orders from their child chains and classify institutional execution styles.

Two components that map observed behavior back to its origin:

  • SplitOrderDetector. Link child orders to one parent via temporal + price + actor proximity.
  • ExecutionAlgoFingerprinter. Classify an actor’s per-market trade schedule against VWAP / TWAP / POV / Almgren-Chriss templates.

Neither is manipulation detection. Both produce informational findings (AnomalyCategory.SplitOrder and AnomalyCategory.ExecutionAlgoFingerprint) useful for counterparty mapping: knowing your counterparty is a VWAP algo changes how you should size and time your own order, even when no one is misbehaving.

SplitOrderDetector

Reference. Hautsch, N., Huang, R. (2012). “The market impact of a limit order.” JEDC. Also their 2009 work on order splitting.

Pattern. A large parent order is sliced into many smaller children to minimize market impact. From the tape, children share the same actor, same side, closely-drifting prices, and closely-spaced timestamps.

Heuristic. Per (actor_id, market_id, side):

  • Track OrderFilled events only (not placements. Counting both inflates the chain length for nothing).
  • Maintain a rolling deque capped by max_time_between_children_s (drop events older than this window from the head).
  • When the deque reaches min_children, verify the price cluster:
  • Mean of child prices → mid.
  • Max |price - mid| / mid in basis points ≤ max_price_drift_bps.
  • Emit when both the count and price-cluster criteria are satisfied.

De-duplication. Only emits once the group grows beyond the last emission count. Prevents re-emitting after each new child.

python
from horizon.flow.config import FlowConfig
from horizon.flow.hidden import SplitOrderDetector

det = SplitOrderDetector(FlowConfig())
# Use just like any other detector: it implements the same protocol.

Config. SplitOrderConfig. Defaults max_time_between_children_s=15, max_price_drift_bps=10, min_children=3.

Calibration note. The default min_children=3 is deliberately tight; background-flow actors will occasionally trigger this (a retail trader firing three small orders in a minute produces the same signature as a nanoscale child chain). Consumers treat this as a “might be splitting” signal, not “is splitting.”

ExecutionAlgoFingerprinter

Batch-mode classifier. Call fit with an actor’s full per-market schedule over a day or session; it returns an AlgoFitResult with the best-match template and a fit score in $[0, 1]$.

Templates

  • TWAP. Uniform rate. $\propto \mathbb1$.
  • VWAP. Rate proportional to market volume. Requires an optional market_volume_schedule.
  • POV. Participation of Volume. Similar to VWAP but with a shorter rolling window. V0.1 aliases to VWAP; v0.2 splits them.
  • Almgren-Chriss (2001). Risk-aware schedule. Front-loaded when risk aversion is positive, back-loaded when it’s negative. Implemented as an exponential template with $\alpha = \pm 2.5$ chosen based on observed schedule shape.

Method

Bin the schedule into $N$ time-equal bins, normalize to a distribution summing to 1, compute mean-absolute-error against each template, invert to a fit score. A front_load metric compares first-third vs last-third mass and provides a secondary axis.

python
from horizon.flow.hidden import ExecutionAlgoFingerprinter

fp = ExecutionAlgoFingerprinter()
result = fp.fit(
 schedule=[(ts1, 100.0), (ts2, 120.0), ...], # from a specific actor/market
 market_volume_schedule=[(ts1, 5000.0), ...], # optional for VWAP fit
 bins=20,
)
# AlgoFitResult(template='almgren_chriss', fit_score=0.73, front_load=+0.31, n_trades=180, duration_s=3600)

Emission

A result with fit_score ≥ 0.55 can be lifted into an AnomalyFinding (category ExecutionAlgoFingerprint):

python
finding = fp.to_finding(
 actor_id="0xabc...",
 market_id="AAPL",
 venue_name="alpaca",
 result=result,
 detected_at=datetime.now(timezone.utc),
)

Severity is Low below 0.75, Medium above. The finding is informational. It’s NOT evidence of abuse; it’s evidence of style.

What hidden-order detection is NOT

  • Not an assertion of wrongdoing. Splitting orders is legal and common; VWAP execution is legal and common. The findings flag observed structure, not intent.
  • Not a replacement for true L3 book observation. On venues that expose full L3 (Polymarket CLOB, Hyperliquid), you can often read the parent order structure directly; these detectors are for venues where you only see the tape.
  • Not deterministic execution replay. The fingerprinter decides between overlapping templates and can be fooled by intermediate cases (a 30-minute VWAP looks a lot like a TWAP at low bin counts).

Citations

  • Hautsch, N., Huang, R. (2012). “The market impact of a limit order.” Journal of Economic Dynamics and Control.
  • Almgren, R., Chriss, N. (2001). “Optimal execution of portfolio transactions.” Journal of Risk, 3, 5–39.
  • Berkowitz, S. A., Logue, D. E., Noser, E. A. (1988). VWAP benchmarking.
  • Kissell, R., Glantz, M. (2003). Optimal Trading Strategies.
  • Esser, A., Mönch, B. (2007). “The navigation of an iceberg.” Finance Research Letters, 4, 68–81.