Learned Flow Toxicity Scores

Not every trade with a bad outcome is equally toxic, and treating "adverse selection" as a single yes-or-no label throws away useful information. A trade that ends up costing a market maker 2 basis points and one that costs 20 basis points are both technically "adverse," but they call for very different responses — the first barely matters, the second is exactly the kind of flow the maker should be actively defending against. A toxicity score replaces the binary classifier with a continuous number, giving a graded read on how dangerous a piece of incoming flow is likely to be, so the response can scale smoothly with the actual risk.

From classification to regression

Where an adverse-selection classifier predicts a probability of crossing a fixed markout threshold, a toxicity score is typically trained as a regression directly against the realized markout itself — predicting the expected signed cost, in basis points, rather than a binary flag. This preserves the magnitude information a threshold discards: a flow pattern historically associated with an average markout of $-3$bp and one associated with $-25$bp both count as "adverse" under a classifier, but a regression-based score correctly ranks the second as far more dangerous, letting the maker's response (quote width, size reduction, outright refusal) scale continuously with the predicted magnitude rather than jumping discretely at one cutoff.

Aggregating scores over time and counterparty

A single fill's toxicity score is noisy — any one trade's realized markout is dominated by short-term randomness even when the underlying flow is genuinely informed. Toxicity is more reliably estimated by aggregating scores over a rolling window per counterparty, venue, or flow segment, similar in spirit to how the VPIN metric aggregates trade-flow imbalance into a running toxicity estimate rather than judging any single trade in isolation. A counterparty whose fills average a $-15$bp score over the last 500 trades is a persistently different risk than one averaging $-2$bp, even if any individual fill from either could look similar.

Worked example: scoring and responding to two flow segments

A liquidity provider tracks rolling average toxicity scores by counterparty tier. Tier 1 (a set of long-standing counterparties) shows an average predicted markout of $-2$bp over the trailing 1,000 fills; tier 2 (a newer counterparty routing through an aggregator) shows $-18$bp over a comparable sample. Rather than blocking tier 2 entirely — which would forfeit all the benign flow mixed in with the toxic — the provider widens quotes specifically for tier 2 by an amount roughly proportional to its measured toxicity, enough to offset the expected adverse cost while still capturing the profitable share of that flow. If tier 2's rolling score later drifts back toward $-4$bp, the quote widening eases automatically as the score updates, without anyone needing to manually revisit the decision.

What this means in practice

A continuous toxicity score gives a liquidity provider a lever to pull rather than a switch to flip: quote width, size limits, or hedge speed can all scale directly with the score, capturing as much benign flow as possible while pricing in the actual expected cost of the toxic share. Because scores need aggregation over a rolling window to be reliable, there's an inherent lag — a counterparty's behavior can shift for several hundred trades before the rolling score fully reflects the new pattern, so toxicity scores work best as one input among several, not the sole trigger for a major change in how flow is handled.