Anti-cheat16 July 20265 min read

Where hardware stops mattering

Past a certain point, the question is no longer what your machine looks like, but what your results look like.

By Lethal Research

Most discussion in this market is about the machine: which card, which firmware, which profile and which second PC. That discussion has a ceiling, and it is not a technical limit of the hardware. The ceiling is that a well-built setup answers a question nobody asks on its own any more. The server does not need to know what your hardware is if it can judge what your hardware produced. Judging outcomes is a different craft from enumerating devices.

What has Valve published about VACnet?

Valve presented its approach at GDC 2018, so none of this is speculation, and none of it depends on a leak. John McDonald's talk described VACnet, a deep-learning system trained on convictions from Valve's own human review programme. The reported design is narrow and instructive: it does not try to evaluate a player all the time. Instead, it focuses on the moment a shot is fired, which is when an aim assistance system has to reveal itself. It reads a short window around that instant, covering how the player's pitch and yaw moved just before and just after the shot. It also adds context such as the weapon, the distance and whether the shot connected.

External projectRobocalypse Now: Using Deep Learning to Combat Cheating in CS:GOJohn McDonald of Valve at GDC 2018, in the talk that describes VACnet.

Two things about that design matter if you are thinking about hardware. First, none of its inputs are device identifiers, so it never asks what is in your PCIe slots. Second, its reported limitation teaches as much as its capability. An approach trained on blatant behaviour is good at detecting blatant behaviour, while a player operating far below that threshold is a harder case. That is a statement about thresholds, not about immunity, and reading it as immunity leads to bad decisions.

What can match data show about a player?

This approach works because a match produces a huge amount of information about a player, and none of it has anything to do with their machine. Server-side data is not a rendering of what you did but the authoritative record of it.

Signal class	What it is	Why hardware does not change it
Aim kinematics	The shape of view-angle movement over time: acceleration, correction, overshoot, settle.	However the input arrives, the movement it produces is recorded server-side as angles over time.
Reaction timing	Distribution of time between a target becoming available and the player acting.	Timing distributions are a property of the pipeline producing the input, not of the transport carrying it.
Information usage	Actions that are only rational given knowledge the player should not have: pre-aiming, tracking through walls, rotating early.	This is the signal that architecture cannot touch at all. It is about what you knew, not how you knew it.
Outcome distributions	Accuracy by distance, headshot ratio, first-shot hit rate, performance consistency across sessions.	Aggregate statistics over many matches. No device identity is involved.
Population comparison	Where a player sits relative to a rank cohort of millions, and how that changed over time.	Comparative, not absolute. A step change in a player's own history is visible without any baseline about hardware.

What more hardware spending cannot change

A review of inputs and outcomes can identify a player, and past a certain point, spending more on hardware buys you nothing against that review. This point is rarely made in this market, because hardware is what shops have to sell. We sell it too, but the point is still true. Architecture addresses one class of detection, while the class it does not address is indifferent to your card, your firmware, your profile and your second PC. We cannot promise you an outcome, and we will not pretend that the hardware layer is the whole problem.

How should this change your spending?

The step from no separation to architectural separation is the one that changes anything, and further steps have sharply diminishing returns against behavioural review.
Money beyond what a working build needs is better spent on the parts that decide whether your build works at all. That means a decent second machine, a good cable, and a monitor and display path that do not give you trouble.
Feature choices carry behavioural weight in a way hardware choices do not, because what a setup does in a match is what gets judged.
Consistency over time is itself a signal, because a player whose measurable performance changes sharply has produced a data point that no hardware decision addresses.

Why we explain the limits of hardware

The alternative to explaining them is a customer who believes they bought an outcome and later finds out otherwise, which is worse for them and worse for us. Hardware architecture addresses one detection surface, and both that surface and the engineering behind it are real. There are other surfaces, however, that it does not reach. Anyone selling you the idea that the right card solves the whole problem is selling you something they cannot deliver.

The guides behind this post

Secure Boot: what it does and what turning it off costs

8 min read

Secure Boot checks each boot component's signature against keys the firmware trusts, but never inspects PCIe devices or blocks DMA hardware. Several current anti-cheats require it, so disabling it to fix an unrelated problem can lock you out of the game entirely.

Open the guide

DMA setup for PUBG, a game whose publisher names DMA in public

6 min read

PUBG runs Zakynthos, Krafton's own anti-cheat, and Krafton's 2026 roadmap puts DMA detection first. Krafton says it banned about 260,000 accounts for DMA cheating in 2025, and no other publisher covered here has said that about this hardware. This store sells no DMA cheat for PUBG, only an external one at /products/pubg, though every firmware tier lists the game.

Open the guide