LOB-Impact Benchmark: Emergent Market Impact in Generative Limit Order Book Models

CCS Concepts

• Computing methodologies → Simulation evaluation; • Applied computing → Economics.

Keywords

limit order book, generative AI, market impact, square-root law, evaluation benchmark, state-space models, reinforcement learning

This work is licensed under a Creative Commons Attribution 4.0 International License.

ICAIF ’26, Milan, Italy

© 2026 Copyright held by the owner/author(s).

ACM ISBN 979-8-4007-3087-0/2026/11

https://doi.org/10.1145/3858063.3858909

ACM Reference Format:

George Nigmatulin, Valentin Mohl, Sascha Frey, Kang Li, Aramis Marti-Shahandeh, Mihai Cucuringu, Anisoara Calinescu, Jakob Foerster, and Stefan Zohren. 2026. LOB-Impact Benchmark: Emergent Market Impact in Generative Limit Order Book Models. In 7th ACM International Conference on AI in Finance (ICAIF ’26), November 14–17, 2026, Milan, Italy. ACM, New York, NY, USA, 9 pages. https://doi.org/10.1145/3858063.3858909

Introduction

Generative LOB models (GANs [10], recurrent and state-space message generators [14, 26, 31, 33], transformers and diffusion [2, 18]) are judged today by how closely their message streams resemble historical ones. Distributional benchmarks such as LOB-Bench [25] make this comparison precise by scoring spread, volume, interarrival, and imbalance distributions against real data. Such simulators are candidates to serve as world models for reinforcement-learning agents [12, 23], and an agent trained inside a simulator that gets the response to its orders wrong will learn mispriced policies, even if the surrounding stream looks realistic. Distributional scores are blind to this response, and existing benchmarks measure it only for a single event.

Constructing such a benchmark requires examining how real markets absorb large trades. Institutions do not execute a large order at once; they split it into small child orders. Empirical finance provides the reference for what such a metaorder does to the price: the square-root law of metaorder impact,

where $I(Q)$ is the expected price change, $\sigma$ the daily volatility, $Q$ the metaorder size, $V$ the daily volume, and $Y$ a dimensionless amplitude; the law is documented across equities, futures, and FX [1, 6, 32]. This law is driven by two forces: persistence and resilience. Order flow is highly persistent: the sign of the next trade is predictable from the previous one [19]. If every trade permanently moved the price, this persistence would cause indefinite trends. Instead, prices remain diffusive because the market absorbs and relaxes from each push [7]. The law’s concavity emerges when the liquidity a metaorder consumes is replenished behind it, and this same replenishment brings the price back down once execution stops [13]. In free generation, persistence is directly observable; resilience appears only indirectly as a diffusive price.

Isolating resilience therefore needs a counterfactual: how prices would have moved under an exogenous metaorder. A historical trace cannot answer that; a generator can. LOB-Bench measures this response at the scale of a single event. At the metaorder scale, MarS reports a square-root-shaped response to injected TWAP orders [18], and Bodor and Carlier [5] an exponent of 0.55 on a ten-child metaorder. However, these experiments do not separate the mechanical impact, where the injected orders remove levels of the price, from indirect impact through the reactions of other participants to those orders. In a generator, other participants are the model itself, and resilience lives in its reaction alone.

Our aim is to design experiments that measure these counterfactuals and isolate indirect impact. In our procedure, metaorders injected into five neural state-space generators produce an identifiable impact law on every stock we run: 25 model–stock pairs, 25 identifications. We provide an automatic per-stock calibration; every build-up injection is paired with a blind run that separates the model’s reaction from the book’s mechanics, and a number is reported only when a law is identified. This procedure extends distributional benchmarking, providing an instrument for evaluating the interactive fidelity of LOB simulators.

Methodology

Benchmark design

The benchmark takes four inputs: the model under test, a stock, a calibration computed from that stock’s own data (§ 2.3), and a budget of $n$ rollouts per direction per phase, spread over every trading day of the month. It runs three phases with two paired controls (Figure 1, left). Everything downstream is fixed before any model is run: the injection schedule, calibration and estimator are set by the stock and the protocol, never by the model under test.

Phase 1: free generation. The model runs freely over the injection horizon (the length of one build-up metaorder: 12k–73k messages depending on the stock, Table 2). For this phase, we measure the following three observables. The first is a consistency pair: $\gamma_{\mathrm{flow}}$, the decay exponent of the trade-sign autocorrelation (smaller means longer memory), read against $H$, the Hurst exponent of the generated mid-price ($H = 0.5$ is diffusive). Persistent signs must be compensated by transient impact, so a generator that combines persistent flow with a super-diffusive price ($H > 0.5$) has built a free lunch into its own market [7]. The second is the free drift a rollout accumulates with nothing injected. The third is the price response to a single trade, against the real stream. Phase 1 serves as a first filter: the replay passes it perfectly yet has no impact at all, so establishing impact requires an intervention.

Stock	Cohort	Child (±std)	$\Delta_N$ (±std)	$\phi$	gen
EA	Low OTR	17 (±4)	122 (±125)	7.49%	12k
NVDA	Mid (modal)	31 (±7)	250 (±35)	3.65%	25k
MSFT	Mid (modal)	19 (±3)	261 (±59)	3.68%	26k
AMD	High OTR	20 (±3)	401 (±69)	2.30%	40k
GOOG	High OTR (tail)	23 (±2)	729 (±183)	1.30%	73k

Phases 2 & 3: metaorder injection and relaxation. The injection realises the counterfactual of § 1: the same conditioning windows, run again under an exogenous metaorder. After a conditioning window from the real stream, we alternate one aggressive child of median trade size with $\Delta_N$ generated messages, the spacing that holds participation at $\eta= 10\%$ (§ 2.3) (Figure 1, right). Two shapes probe the two faces of impact. The build-up shape ($i=100$, $c=0$) reads the impact exponent along a 100-child order, a typical real length (§ 2.3). The relaxation shape ($i=10$, $c=100$) executes a short metaorder and then stops injecting for 100 silent blocks: ten execution durations, over which real impact falls to about two-thirds of its peak within one to two durations and to about one-half by the tenth [9, 24]. Every configuration runs in both directions, and the two are combined as

which also handles free drift: direction-independent drift cancels in Eq. (2) and is measured separately on the no-injection arm, entering the accounting exactly once.

Blind control. An identified law does not say whose law it is. The replay kernels of Table 1, with no model inside, are identified on AMD at $\delta= 0.73$–$0.81$, inside the neural range, so the exponent cannot attribute the response, and a large amplitude could be purely mechanical impact. The build-up therefore runs twice on the same windows and seeds, once visible and once blind. In the blind run, the orders fill in the simulator, but neither model input (message stream, book state) carries them, so the generated flow proceeds as if the metaorder never happened. This allows us to single out the indirect impact. The laws are fitted on the visible runs. The blind control covers only the build-up: Phase 3 reads a ratio within one visible run, which a floor ten times below the peak cannot change.

Model	Class	How it works	Trained / calibrated on	Gen.
Historic	replay	Replays the real stream unchanged; cannot react.	real held-out data	—
Heuristic	replay + shift	Replay; a consumed best level shifts all later messages.	rule fixed a priori	—
Propagator	replay + kernel	Replay + one-tick kicks decaying as $\frac{2}{3}+\frac{1}{3}s^{-1/2}$.	kernel from theory [6]	—
OW	replay + kernel	Replay + Obizhaeva–Wang exponential-resilience kernel.	kernel from theory [27]	—
CST	parametric	Memoryless event rates vs distance from mid [11].	rates on the stock, Jan 2026	$\sim$4 s
NMZI	parametric	CST + return-driven order-sign feedback [29].	as CST; feedback at defaults	$\sim$4 s
Hawkes	point process	Self-/cross-exciting intensities; short-range clustering [4].	kernels on the stock, Jan 2026	$\sim$4 s
QR	parametric	Queue-reactive intensities conditioned on the book [16].	intensities on the stock, Jan 2026	$\sim$4 s
S5-120M	neural SSM	Autoregressive next-token generation; S5 backbone [31].	GOOG, AAPL, NVDA, AMZN, META, TSLA, MSFT, AMD; Jan 2022–Dec 2025; Jan 2026 (the evaluation month) held out.	53 s
S5-4k	neural SSM	S5 with a 4000-message conditioning window.		$\sim$12 min
Mamba3	neural SSM	Selective state-space backbone [14, 17].		39 s
Mamba3-4k	neural SSM	Mamba-3 with a 4000-message conditioning window†.		$\sim$12 min
GDN	neural SSM	Gated-DeltaNet recurrence [33].		54 s

The horizon is set by the object, not by the model. Market impact is a property of the metaorder, the working unit of optimal execution [3, 15], and only at that scale can an emergent impact law be demonstrated. A build-up rollout therefore runs about 40k messages on AMD, far past the 500-message training window of latter-day models (Table 1). The no-injection arm (free generation at this horizon, the second paired control) also tracks rollout degradation.

Sample sizes are part of the protocol. Rollouts buy detection: resolving a peak $P$ at three standard errors takes $n^* = 9\sigma_1^2/P^2$ per direction, $\sigma_1$ from a pilot. Trading days buy precision: days are the independent unit and rollouts cannot substitute for them. A cell is printed only when its peak exceeds three standard errors and its law is identified. One campaign per stock (1,024 rollouts per direction per phase over 20 trading days) meets both requirements, with about 1.4× the minimum that subsampling shows is needed. With fewer than five days, the interval is often narrower than the full-sample one, yet contains the full-sample value only 40–68% of the time: the estimate looks precise but is wrong.

Each executed child $k$ contributes one signed point $(q_k, I_k)$, where $q_k = Q_k/V$ is the cumulative participation and $I_k$ the mid-price displacement. We write $\delta$ for the measured exponent and keep $\beta$ for the reference 0.5 of Eq. (1). The law $I = a q^\delta$ is fitted on the cumulative pool $q_k$, hence every prefix of a metaorder is itself a completed metaorder, the lifecycle convention of the empirical literature [3, 34]. The local exponent declines along a metaorder, as for real ones [34], so $\delta$ is always quoted at the full metaorder, under one convention for every model.

Existence is decided before magnitude (Figure 2). The identifiability test fits $I = a q^\delta$ directly by least squares, with no logarithms and no sign selection. For each $\delta$ on a grid $([0.05, 1.5]$, step 0.01) the best amplitude has a closed form, $a^*(\delta) = \sum Iq^\delta/\sum q^{2\delta}$, so the misfit becomes a curve over $\delta$: a real law gives a sharp minimum, and no signal gives a flat curve with $a \approx0$. A law counts as not identified when the amplitude is below the floor ($|I| < 0.05$) or the best $\delta$ sits on a grid bound; the master curve (all sizes collapsed onto one) is drawn only when $\langle I(1)\rangle$ exceeds three standard errors. Testing existence first is the one step we add to an otherwise standard pipeline; a weighted-mean $L_1$ version guards against outliers. The number, quoted only where a law is identified, is the binned estimator of the empirical literature [30]: 18 quantile bins, signed conditional bin means, OLS through the positive means.

All fits run on raw signed impact; volatility enters only as the unit of the amplitude ($I$ in units of the day’s Parkinson volatility), $\gamma= a q_{\mathrm{ref}}^{\delta-1/2}/\kappa_P$ at the data edge, with $\kappa_P = \sqrt{4\ln2} \approx1.665$ converting the Parkinson range [28] to the convention of the empirical studies, so $\gamma$ compares directly with the measured $\gamma\approx0.5$ [8, 32, 34]. On AMD the binned $\delta$ moves by at most 0.05 across six volatility normalisations (none, i.e. $\sigma= 1$, and the Parkinson, Garman–Klass, Rogers–Satchell, close-to-close and Yang–Zhang estimators), and the $L_1$ twin agrees wherever a law is identified.

Phase 3 reads relaxation through two numbers: the level at which impact settles and its slope after execution. We compare the level with real metaorders, which relax to one-half to two-thirds of their peak [9, 24], and with the kernel baselines run under the same schedule, whose closed-form value sets the scale of relaxation at this spacing. Fitted directly, the neural decay kernel comes out permanent ($\gamma\approx0$) by two independent methods, schedule ordering and an impulse fit. Days are pooled on a common clock, the executed fraction $\nu= k/N$ of the metaorder, because metaorder impact does not depend on execution duration [6]; cells where fast and slow days still differ materially are marked $m$.

The estimator is validated before it is read: laws of known exponent, planted in the replay’s own point cloud (real noise, real day structure), are recovered across $\delta\in[0.5, 1.0]$ with a small downward bias (at most 0.11 at neural amplitudes), so the exponents reported below are conservative. In 500 null trials with nothing planted, the identifiability test returns not one false law. The kernel baselines close the loop end to end: Phase 3 recovers their built-in resilience in the correct order on all five stocks.

Each cell is finally reduced to a verdict on the five claims of Figure 1 (the C1–C5 column of Table 3), on criteria fixed for every model: C1 when $\gamma_{\mathrm{flow}}$, $H$ and the free drift sit within tolerances fixed in advance (0.10, 0.02 and 5 ticks) of the stock’s own replay; C2 when the gate identifies a law; C3 when the visible peak is at least 3× the blind floor; C4 when $\lvert\delta- 0.5\rvert\le0.10$ and $Y \in[0.5, 1]$; C5 when the end-over-peak is at or below that of the Obizhaeva–Wang (OW) kernel, the standard resilient book, on the same stock and schedule, with a non-positive slope and a free drift under 20 ticks, so the descent is not the drift; the OW row itself is left undecided. C4 and C5 are undecidable when no law is identified, and C3 when no blind run was made, so a missing measurement cannot read as a defect. Every verdict follows from the numbers printed beside it, so the whole ladder can be checked from Table 3 alone.

Models under test

The benchmark accepts any message-level generator; Table 1 lists the panel of models we test. The replay block spans no causal response (Historic, the negative control), permanent impact (Heuristic), and two kernels with the target physics written in: the Propagator, whose power-law decay to $\frac{2}{3}$ is the positive control, and Obizhaeva–Wang (OW), with exponential resilience. The five neural generators carry a continuous hidden state across generated and injected messages, the mechanism through which relaxation could arise, and share one eight-name corpus including AMD, evaluation month held out. Book reconstruction and matching use the JAX-LOB engine [12]; every number comes from the one campaign per stock of § 2.

Data preparation

The injection protocol requires three calibration numbers per stock: the child size, the spacing between children, and the daily volume that normalises cumulative participation. All three are computed from LOBSTER message data for January 2026, the evaluation month, held out of model training.

As impact is measured relative to the stock’s own activity, the measurements are re-calibrated per name. We choose a participation target of $\eta= 10\%$ of the market orders during execution; broker databases retain execution participation shares of 3–40% [3] and the empirical impact surface is fitted over $10^{-4}$ to 0.1 [34]. The child volume is the stock’s median market-order size, $V$ is the day’s volume, and the spacing follows from the participation identity $\eta= 1/(1 + \Delta_N \phi)$:

computed per day from one month of LOBSTER message data [20]. Here $\phi$ is the market-order share of the day’s message stream (Figure 3, middle). The child count $N = 100$ is fixed a priori, never per model: the mean metaorder length in the empirical samples (96–98 trades per hidden order [24], 73–100 child orders [3]), spanning two decades of cumulative participation. A shorter metaorder would sample only the early, steepest part and bias $\delta$ upward.

Figure 3 shows the universe: $\Delta_N$ is strongly right-skewed, so a high-OTR name (order-to-trade ratio $1/\phi$) costs seven times more generation than a low-OTR one. Table 2 takes one name per cohort. This paper reports AMD band by band: high-OTR cohort ($\Delta_N = 401 \pm69$, $\approx$40k messages per metaorder), and inside every training corpus, so the measurement carries no distribution shift.

Results

Table 3 gives every measurement for the 13 models on all five stocks. On every stock the neural generators produce an impact law of their own, but it is not the square-root law, and it does not relax. Below we go through the AMD measurements (Figure 4) phase by phase; § 4 interprets them.

Phase 1: Free generation

In identical windows, the real AMD stream is balanced: persistent trade signs ($\gamma_{\mathrm{flow}} = 1.66$) with a diffusive mid-price ($H = 0.54$). No generator holds both legs. The Mamba family carries longer flow memory than the real stream ($\gamma_{\mathrm{flow}} = 1.20$ and 1.06) and a price that is too diffusive ($H = 0.58$ for both): persistence left uncompensated. The S5 family carries shorter flow memory (1.90, 1.83) with the real diffusivity ($H = 0.55$, 0.54); GDN carries the panel’s longest flow memory (0.79) with a price below diffusive ($H = 0.49$). Every neural generator also drifts when left alone, from +9 (S5-4k) to −251 (Mamba3-4k) ticks per rollout (Table 3). Every neural generator therefore fails C1.

Phase 2: Metaorder response

The middle band of Figure 4 shows the build-up. We first check that a law exists, then measure it. All five neural generators show a sharp minimum of the $L_2$ misfit over $\delta$ (§ 2), so their exponent is identified: claim C2 passes across the panel. For the Historic replay the misfit is flat and the amplitude sits at zero: with no signal, no $\delta$ fits better than another, so there is no law, the correct answer for a stream that cannot react.

Where a law is identified, we calculate $\delta$. On AMD the binned exponents are 0.66 (S5-120M), 0.79 (S5-4k), 0.87 (Mamba3), 0.90 (GDN), and 0.93 (Mamba3-4k). Their 95% day-clustered bootstrap intervals are $\pm$0.05–0.06: the S5 family stays closest to 0.5, yet no interval comes near it. The band is stable under every estimator variant of Section 2, and the estimator’s bias points down: the true build-up is, if anything, steeper.

The amplitude turns the overshoot into money: the neural panel shows $Y = 2.2$–8.6 against the empirical $Y \approx0.5$, four to seventeen times what a real metaorder pays per unit of participation. In levels, a 100-child metaorder moves the simulated price by 17–70 bps,

against at most 11 bps for any baseline (the Heuristic replay). On AMD, claim C4 fails in every neural cell: no exponent within 0.10 of 0.5, no amplitude inside the empirical band.

The baselines behave as designed. The three replay kernels (Heuristic, Propagator, OW) are identified at $\delta= 0.73$–$0.81$ with $Y = 0.96$–$1.46$: the mechanical response written into them, at roughly the price a real book charges. Their $\delta$ sits below the closed-form values ($\approx0.9$–$1.0$) by the small-amplitude bias measured in the planted-law calibration. QR is identified at $\delta= 0.72$ with $Y = 0.09$, a law with almost no impact behind it; the zero-intelligence pair (CST, NMZI) and Hawkes identify nothing at all ($Y = 0.03$ for Hawkes on AMD, below the floor). The neural models differ from the baselines in amplitude: their exponents overlap with the replay kernels’, but their $Y$ exceeds every baseline’s. The blind control shows that this impact is the models’ own (C3): the visible peak is at least 3× the blind floor in all 25 neural cells and over 10× in 16 (v/b, Table 3). This excess is the indirect impact the experiments were designed to isolate.

Phase 3: Relaxation

The bottom band asks whether impact comes down once execution stops. Real metaorders fall to about two-thirds of peak within one to two execution durations and to about one-half within ten [6, 9, 24], the span of our window, so a flat curve cannot be blamed on it. The kernel baselines set the scale: at realistic child spacing, a kernel spends most of its transient between children, so its closed-form end-over-peak is 0.94 for the Propagator and 0.87 for OW, and the measured values land beside these (0.89 and 0.81 on AMD, against the permanent Heuristic’s 0.95).

The neural panel shows no credible relaxation. End-over-peak on AMD reads 1.19 (S5-120M), 1.15 (S5-4k), 1.16 (Mamba3), 1.36 (Mamba3-4k), and 0.88 (GDN), with post-execution slopes of +0.6, ±0.0, +0.4, +3.7, and −2.4% of the peak per execution duration. Four of the five remain above peak: the price keeps moving in the metaorder’s direction after the last child has executed. GDN falls below peak, but its free drift of −127 ticks prevents attributing the decline to resilience. That is claim C5, and no neural cell passes it.

Extending to a larger universe

The AMD portrait replicates down the blocks of Table 3: the neural panel is one claim-ladder signature repeated 25 times: C1 fails, C2 and C3 pass, C4 and C5 fail.

All five neural generators identify a law on every stock, every exponent above the square-root reference: 0.63–0.93 on AMD and MSFT, 0.73–1.21 on GOOG, 0.97–1.15 on NVDA, 0.84–1.12 on EA. All 25 day-clustered intervals (the ± of Table 3) exclude 0.5, with half-widths of 0.04–0.14 and the tightest case (S5-120M) still bounding its exponent above 0.53. The replay returns no law on any stock, keeping the estimator honest. Ranking the generators by $\delta$ or by $Y$ gives nearly the same order on every stock (Kendall $W = 0.82$ and 0.81): the benchmark measures a model-specific component that persists across stocks.

In 20 of the 25 neural rows, $H$ exceeds the stock’s own value; in three it matches, and only GDN, on AMD and MSFT, sits below. No neural row reaches two thirds by decay: the three lowest end-over-peak entries (GDN 0.18 and Mamba3-4k 0.24 on GOOG; Mamba3-4k 0.72 on MSFT) sit on the heaviest-drift rows of their blocks; the descent is drift, not resilience.

On the four stocks in the training corpus, $Y \approx2$–$9$ on AMD and MSFT, 1.7–12.6 on GOOG and 7–19 on NVDA. On EA, the one stock outside the corpus, $Y = 12$–50. The observed OOD result does not destroy the law; it destroys its calibration.

The Propagator and OW are identified on AMD, NVDA and MSFT but not on GOOG or EA; QR’s end-over-peak swings from 2.47 (NVDA) to 0.42 (EA).

The three 500-context generators sit close together in the distributional columns yet differ materially in impact. Across stocks, the correlation between the LOB–Bench KS ranking and the $|\delta- 0.5|$ ranking is unstable (+0.54 on GOOG against −0.71 on MSFT, $p = 0.02$) and mostly negative within the neural family (MSFT neural rows: −0.90, $p = 0.08$). The better mimic can sit farther from the impact law, so the two properties must be measured separately.

Discussion

Our results separate three questions that distributional evaluation conflates: whether impact exists, whether it is the generator’s own, and whether its dynamics are market-realistic; across the neural panel, the answer is yes, yes, and no. The joint C4/C5 failure is consistent with insufficient replenishment: in a real book, each child’s push decays before the next arrives, turning $N$ pushes into $\sqrt{N}$ rather than $N$. With persistent flow but insufficient replenishment, impact instead builds up too steeply and fails to relax credibly (§ 3.1–§ 3.3). The blind control shows that the build-up is not explained by book mechanics alone; the defect hides at the single-event scale. We attribute the missing replenishment to limited long-horizon memory: relaxation requires retaining a reference price from before the metaorder, which the models’ still-short context windows do not preserve.

These impact errors matter directly for execution: an execution cost model depends on the shape, amplitude, and relaxation of market impact [15, 23], all measured here per model and stock. Today’s generators may achieve message-level realism, but they remain unsuitable as environments for execution agents while the endogenous impact they do not reproduce has the wrong shape and does not decay: such a simulator can reward schedules that a real book would punish.

The results suggest how to improve these models. At each training checkpoint, Phase 1 can be run on freely generated rollouts: the goal is for the generated $\gamma_{\mathrm{flow}}$ and $H$ to approach their empirical values for the stock. The direction matters: learn replenishment rather than unlearn persistence; killing flow memory would restore the balance vacuously. Phases 2 and 3 then test whether the repair restores realistic build-up and relaxation. The 4k-context variants fail the same tests but remain well short of a metaorder, leaving the attribution untested rather than refuted; longer contexts and larger models are the natural next test.

Limitations. One stock is reported band by band, the other four only through Table 3, and everything is measured at one operating point: one participation rate, one child size, aggressive children [21, 30], one metaorder shape, one month of one exchange; and $\delta$ depends on that point. The 10% target lies inside the retained empirical samples [3, 34]; the extreme-volume regime [8] is not probed. The month itself is a sample: a month atypical by about one within-month standard deviation would already move the exponent past its half-width cap.

One open-source package (repository https://github.com/george-nigmatulin/lob-impact) contains the protocol, calibration, estimators, controls, and reporting rules; a user supplies a model and one month of LOBSTER-format data for any stock.

Conclusion

Market impact emerges in generative LOB models. Five neural message generators, trained only on next-token prediction, answer an injected metaorder with an identifiable law in all 25 model–stock pairs, while a replay that cannot react does not answer at all. The models fail in two related ways: impact builds up more steeply than the square-root reference and shows no credible post-execution relaxation. Together, these failures point to insufficient replenishment to compensate persistent order flow. We tentatively attribute both to limited long-horizon memory, induced by still-short context windows, a concrete target for future models.

Acknowledgments

This work was supported by the UKRI ESRC Grand Union DTP [ES/Y001761/1]; EPSRC [UKRI5149] and other sponsors of BOLD; the Department of Computer Science, University of Oxford; and a UKRI AI World Leading Researcher Fellowship [EP/W002949/1]. The authors acknowledge the use of resources provided by the Isambard-AI National AI Research Resource (AIRR) [22]. Isambard-AI is operated by the University of Bristol and is funded by the UK Government’s Department for Business, Innovation, Science and Trade (DBIST) via UK Research and Innovation; and the Science and Technology Facilities Council [ST/AIRR/I-A-I/1023].

References