Comment by fracus

This is a thing, yes. Statistical cheat-detection methods are more or less required for online chess, for example, because anyone can run Stockfish. A lot of that came out of academia, so you can just find papers like this: https://cse.buffalo.edu/~regan/papers/pdf/RBZ14aaai.pdf

The techniques they use will always be a little secret-sauce, though, because anti-cheat is adversarial. The best public anti-cheat mechanisms I know of are not technical anyway:

- Play with friends or a small community that you trust not to cheat

- Structure the game to remove incentives for cheating. This is the entirety of how daily games like Wordle prevent cheating, but limits how competitive your game can be

- Closely control and monitor the environment in which the game is played. This is sometimes done at the ultra high end of competitive esports: "We provide the computer you will use. You don't have the unsupervised access necessary to install a cheat." The most common version of this, however, is in casinos.

Reminds me many years ago I was playing online poker. The site I was on did this special anniversary giveaway thing. Every million hands or so, there would be a massive (in relative terms) jackpot. If you win the hand, you get the jackpot. It was so large, that you should never fold any hand, at all. (At these microstakes, normally a big hand was $5. These were like $300, so risking your whole stack of $2 was totally worth it).

At the start of the hand, the rules were announced, and there was a very long wait (10-20 minutes), so everyone had a lot of time to process what was going on.

I was dealt into two of these hands. In one, I raised all in and everyone folded. In another, someone else did this, and everyone except me folded.

That convinced me that almost everyone was a bot. There was no rational explanation for this behaviour.

With how bad it's gotten in some games I honestly just don't even bother playing PVP game modes anymore unless it's on a private server with close friends. The only modes I play public multiplayer on are coop or pve ones. The cat and mouse games from a developer vs cheat developer perspective from what it seems like is basically unwinnable outside of drastic actions like requiring ID/camera that no one is going to be willing to do for entertainment.

I can't really blame game developers for giving up on trying to fight cheaters for that reason. In an ideal world they'd be able to dedicate all their time/resources to game content itself giving us more to enjoy instead of having to waste an unreasonable amount of man hours and money on anticheat solutions that are only temporary anyways.

> present the players with a bot who's purpose is to be un-hitt-able unless the player is cheating

Escape from Tarkov had/has something vaguely similar to this. They'll put a very valuable piece of loot in an inaccessible room under the map or inside a locked car and monitor which accounts pick it up. I think Call of Duty warzone did it as well with the fake enemies that only accounts suspected of cheating will see

The problem with a statistical method is you can't ban the best players. For most cheats, you can dial the cheat down until it's at a human level.

I think statistical methods are the best primary option. There are a lot of other tools you can use but this is the most impenetrable from the outside.

The chances that the cheater is able to anticipate the statistical state of everything logged server-side is negligible. There is no way to "sandbag" performance on purpose if you don't know how your performance is being measured.

There is also the problem (solution) of sample size. The players' performance in one or ten games is ideally not relevant to the heuristic. There is a threshold that is crossed after hundreds of rounds of dishonest play. Toggling cheats within a match or tournament series would be irrelevant.

Whose purpose. Who's means who is

Theres plenty of what you suggest going on all the time, loot spawning in unlootable places etc.

Problem is, theres always some difference between valid and invalid target, and if the game knows it, cheat extracts that information and acts "dumb" around those honeypots. It wont shoot targets that the game doesnt render because the bot checks that attribute. It wont loot that honeypot because its in manualy upkept white/blacklist.

Its just another level of cat and mouse game.

Yeah this would be my instinct even if someone somehow got a leaked TPM root EK and spoofed it with a bootkit. Your timings/latency/variance are still going to be different from a hardware chip, almost certainly. Yes you might be able to measure this and attempt to replay it but that gets hard, then you have to figure out e.g. how can you pin your hypervisor/mock TPM to a core so timings don't vary under load, etc. It's getting measurably harder to write good cheating software at this point.