How Does a CEX Distinguish between Legitimate Arbitrage and Malicious Front-Running?

A CEX's surveillance system distinguishes between the two primarily by analyzing the intent and mechanism of the trades. Legitimate arbitrage involves simultaneous trades across different markets to profit from a price difference.

Malicious front-running involves an internal actor or an external bot exploiting non-public order information or manipulating the execution order to profit from a price change caused by another user's trade on the same exchange. The key is the use of privileged information or manipulation of the execution sequence.