Anti-cheat no longer cares what is on your PC. It watches how your hand moves

For most of gaming's online history, anti-cheat software asked one question: what is running on this computer? The systems that guard competitive shooters ask a different one. Riot Games' Vanguard, Valve's VACnet and Activision's Ricochet now train machine learning models on mouse paths, reaction times and aiming patterns, and compare every player's movement with what a human body can physically do. The files on your drive matter less and less. The way your hand moves is becoming the evidence.

Why hunting for files stopped working

The classic approach was a scanner. Anti-cheat software searched the player's machine for known signatures: cheat programs, injected DLLs, suspicious processes running in the background. It caught amateur cheats well enough, but it had a structural weakness. A cheat developer only had to change a few bytes of code for the signature to stop matching. Every detection started a race, and the security team was always the one catching up.

That weakness turned fatal once cheats stopped living on the gaming PC at all. DMA cheats use a second computer connected through hardware to read the game's memory directly. Computer vision cheats go further: they capture the screen, find targets in the image and move the mouse physically from outside the operating system. Neither leaves a file to scan. With no suspicious software on the machine, the only trace left is behavior: how the cursor travels, how fast aim corrects, how cleanly a weapon's recoil is cancelled.

Phillip Koskinas, head of anti-cheat at Riot, made the point in an interview with XDA Developers. To run a computer vision cheat without getting caught, he said, a cheater essentially has to duplicate the game's display and stream it to a second machine. Anything less, and Vanguard catches it immediately.

Reading a hand in numbers

Under the hood, these systems treat input as time series data. Each mouse movement becomes a sequence of positions, velocities and accelerations, and that sequence feeds a model trained to separate two groups: people playing on their own and people getting help from software. The idea comes from behavioral biometrics, a field that has long used typing rhythm and mouse dynamics to verify identity. Researchers Nan Zheng, Aaron Paloski and Haining Wang, for example, showed that the angles in a person's mouse movements could be used to verify who was at the keyboard.

A traditional aimbot tends to give itself away. It draws near-perfect straight lines to the target, corrects instantly and reacts faster than a human nervous system can manage consistently. Human movement is messier. It has micro-corrections, tremor, tiny hesitations and an uneven acceleration curve. Those flaws are hard to fake at scale, because faking them means simulating the imprecision of a body.

Academic work shows how well this can perform. A study called YAACS, short for Yet Another Anti-Cheat System, built a server-side classifier using aim speed, shots fired, distance to target and movement patterns, without ever touching the player's files. Its stacked LSTM model reached 88.6 percent accuracy with a false positive rate of just 0.97 percent, working on sequences of 128 server ticks. The authors preferred it over a decision tree that scored higher on raw accuracy, 96.2 percent, but produced almost three times as many false positives.

Similar results turn up elsewhere. A study published by Springer captured mouse movement in Minecraft through a mod and tested two neural network designs. A two-dimensional convolutional model reached an F-score of 99.68 percent, and an LSTM version reached 99.42 percent. Numbers like those explain why large publishers are moving engineering effort toward this kind of detection.

What the big three are doing

Valve was early. It presented VACnet publicly in a talk at the Game Developers Conference in 2018, describing a problem with the old model: engineers had to write detections by hand for individual cheats, and as soon as cheat makers noticed a detection, they adjusted their software. Valve called it an endless treadmill of work.

The system has since grown into what Counter-Strike 2 players call VAC Live. Matches where the model is highly confident it has spotted blatant cheating, such as rage hacking or anti-aim, can be cancelled in real time, with the offender banned before the round ends. Humans remain in the loop for the gray areas. Valve brought back Overwatch, its system in which trusted players review replays flagged by the model, to help tell a professional-level flick from a well-tuned aimbot.

Riot has signaled that it is combining computer vision detection with movement biometrics. Outside technical analyses of Vanguard claim the company uses GPU-accelerated models to spot aimbot behavior at a subpixel level in under 50 milliseconds, along with measures of mouse movement entropy, recoil heat maps and input patterns. Riot has not published those details itself, so they are best read as informed outside reporting rather than confirmed specifications.

Activision applied the same thinking to a problem console players know well. Devices such as the XIM and the Cronus Zen sit between a mouse and keyboard, or a modified controller, and the console, pretending to be a standard gamepad so that the user benefits from controller aim assist. Rather than looking for software, Ricochet learned to recognize the aiming signature these devices produce. When it detects it, Call of Duty simply closes, and repeat offenders risk a ban.

The cheats learn too

The other side has machine learning as well. A paper called GAN-Aimbots, published in IEEE Transactions on Games, trained an aimbot with generative adversarial networks to reproduce the aiming paths of real players.

The results were uncomfortable. Tuned to be subtle, the aimbot slipped past most common anti-cheat approaches. Turned up to a more aggressive level, it was caught, yet experienced human reviewers still struggled to tell by eye that the player was cheating. In effect, the aimbot learned from real human data exactly where the line between suspicious and acceptable sat, and tried to ride as close to it as possible.

This is an arms race running in both directions. Every generation of behavioral anti-cheat trains on real match data, and every generation of cheats tries to generate synthetic movement that fools those same models. It is also why Riot and Valve say so little about what their classifiers look for. Every detail that leaks gives cheat developers something to train against.

The false positive problem

A behavioral model that understands human movement well will also notice unusual human movement, and the most unusual humans in any shooter are its best players. An exceptionally gifted player can, statistically, look a lot like a bot. The YAACS authors put this at the center of their work: cutting false positives, rather than chasing raw accuracy, is the real bottleneck. A wrongful ban destroys trust far more than one cheater surviving a few extra matches.

That is why almost no major publisher lets a model ban on its own. The model works as a triage filter, flagging accounts for human review before any permanent punishment, as Valve's return to replay review in Counter-Strike 2 and Activision's own replay investigations for Ricochet both show.

Can online play ever be clean?

The direction is clear. Anti-cheat will depend less on finding a hidden file and more on understanding how you play. That raises real privacy questions, because profiling how a person moves a mouse is, technically, collecting a kind of biometric data. It also closes gaps that only exist because traditional detection cannot see external hardware or a camera pointed at a screen.

Cheating will not disappear. The cheats will keep learning to move like people, and the detectors will keep learning what people really move like. For players who play fair, there is one upside in the shift: a system that watches your aim has no interest in what else you have installed. It only cares whether your hand moves like a hand.

Platforms: PCPlayStationXbox