how-anti-cheat-works

Anti-cheat is software that detects or blocks players who gain an unfair advantage in online games, usually by running programs the game's designers never intended. It matters most in competitive multiplayer games, where one cheater can ruin a match for everyone else.

What counts as cheating?

Cheating is harder to define than it sounds. Players disagree about whether using a walkthrough, exploiting a glitch, or buying an advantage counts, and the line often depends on the community and the game^[2].

Researchers have sorted online cheating into several broad types^[3]:

• Modifying the game client, such as an aimbot that aims for you or a wallhack that shows enemies through walls.
• Abusing the network, such as deliberately causing lag so other players see you in the wrong place.
• Exploiting bugs the developers haven't fixed yet.
• Abusing accounts or the economy, such as stealing accounts or duplicating items.

Anti-cheat software focuses mostly on the first two, because they rely on programs running alongside the game.

How anti-cheat finds cheaters

Most cheats work by reading or changing the game's memory while it runs, for example to find where every enemy is or to move the crosshair onto an enemy's hitbox^[4]. Anti-cheat tries to catch this in a few ways.

Signature scanning

Like antivirus software, anti-cheat can look for the fingerprints of known cheat programs on the player's computer. It's fast and reliable for cheats it already knows, but cheat makers can change their code to avoid detection.

Behavior analysis

Instead of looking for the cheat itself, the game watches how a player plays. Superhuman reaction times, perfectly snapping aim, or always knowing where hidden enemies are can all be signs of cheating. Many games now use statistics and machine learning to flag suspicious players for review.

Server-side checks

The game's servers can refuse to trust the player's computer. If the server only sends a player information they should be able to see, a wallhack has nothing to reveal.

Kernel-level drivers

Some anti-cheat systems install a driver that runs with the highest level of access on the computer, often starting when the computer boots. This makes them much harder for cheats to hide from, but it is also the most controversial approach.

The systems most games use

Most players never see anti-cheat directly, but a handful of systems protect a large share of online games:

1. Valve Anti-Cheat (VAC), used in Valve's games and many others on Steam. VAC bans are permanent^[1].
2. Easy Anti-Cheat, owned by Epic Games and used in many cross-platform games.
3. BattlEye, common in shooters and survival games.
4. Riot Vanguard, a kernel-level system built for Valorant and later used in League of Legends.

Developers update these systems constantly, often through regular game patches, because cheat makers keep adapting.

Why anti-cheat is controversial

Every new detection method is answered by a new way to hide.

That arms race pushes anti-cheat deeper into players' computers, which raises real concerns:

• Privacy and security. Kernel-level software has broad access to a computer. A bug in it can crash the system or be exploited by attackers.
• False positives. Automated systems sometimes ban innocent players, and appeals can be slow or impossible.
• Compatibility. Some anti-cheat systems have kept games from running on Linux or the Steam Deck, unless developers turned that support on.

Even with these problems, most competitive players accept some anti-cheat, because a game full of cheaters isn't worth playing.

Learn more

Valve's Steamworks documentation explains how VAC works from a developer's point of view. For the bigger question of what cheating means to players, see Consalvo's Cheating^[2].