An Exploration of an Anti-Anti Cheat FPS

In June of 2020, Riot Games released VALORANT, a game that responded to the rampant cheating present in first-person shooter games with a very invasive and thorough kernel-level client side anti-cheat. In this post, we explore the issues that plague the player integrity of FPS games today and offer a proposal of how these issues might instead be addressed with intelligent game design.

By: TheHans255

7/30/2025

While it's admittedly not a game type that I actually play all that much, I have a soft spot for the Defuse style of play in first-person shooters. A game mode first popularized by Valve's Counter-Strike, it involves two teams of five who participate in opposite sides of a guerilla military operation - one side is tasked with planting a bomb at one of two or three bomb sites, and the other side is tasked with either preventing the bomb from being planted or defusing the bomb once it has been planted. Individual rounds last less than two minutes, and because a single, well-placed bullet is all it takes to down a player for the rest of the round, matches are always tense, careful, and exhilirating as players manage how to map out an area and use tools such as smoke grenades and Molotov cocktails to manage vision and block movement. Many versions of this mode also have a long-term planning element - Counter-Strike, for instance, is played in halves of 15 rounds each, and players need to buy their weapons and tools using a limited salary that increases when you win a round or get kills (not to mention that if you survive a round, you can keep your weapons with their ammo refilled for the next round).

Unfortunately, it is also a game mode that is plagued by rampant cheating. Because these games are so competitive and are often played at high levels with real cash prizes (or even just online at high ELOs), you'll get people that hack their clients and do things like aim-botting (automatically targeting players instead of having to move the mouse to them), wall-hacking (seeing players through walls in order to prepare for them to peek or even to shoot them outright with a weapon with high wall penetration), auto-clicking (automatically clicking on a target when the cursor is over it instead of clicking with proper reaction time), scripting (automatically scheduling actions in order to pull off game-breaking techniques such as excessively fast bunny hopping), and other exploits that allow abilities not available to a normal player. And because every split second counts in these games and has the ability to turn an entire tournament around, players can often toggle these cheats and try to pass of a single suspicious moment as just incredibly lucky or skilled.

As a result, nearly all of these games employ some level of client-side anti-cheat in an attempt to prevent players from tampering with the game locally. Most notably, VALORANT by Riot Games uses a very invasive kernel-level anti-cheat solution called Vanguard that acts with the same level of permissions as a Windows driver, meaning that if it wanted to, it could surveil everything happening on your computer and interfere with its function. While it is relatively unique in that it must be constantly running from the moment you start the computer up, many other games use solutions such as Easy Anti-Cheat that have just the same permissions over your computer, with the caveat that they are only active while the game is running.

Generally, I do not think that such solutions are good for us as computer users. Anti-tamper and anti-cheat solutions running at the kernel level essentially mean that the computer belongs to the person running the driver, and solutions like these are used to restrict what you can do with the computer in order to satisfy the true owner's capitalistic (or worse) ends. And even if they don't have malicious intent, they can certainly suffer from incompetence, as the Crowdstrike incident from July 2024 showed us.

Worse, these solutions are not even entirely effective. Ultimately, when you have physical access to hardware for an extended period of time (as is true of anyone who owns a computer in their domicile), anyone can get anything to run on it with enough determination, including a version of whatever game client that gives them powers they shouldn't have - and they are under no obligation to tell anyone they have done this. And, of course, the PC platform where first-person shooters are often played makes this easier than it would on, say, a video game console, so you still end up with people who cheat at VALORANT despite all of Riot's best efforts.

And that's to say nothing about the possibility of using AI to play the game using an external feed - there is no reason that a computer vision algorithm could not emulate a display, keyboard, and mouse and augment your own actions by aimbotting towards shapes it believes to be players.

I believe that the best long term solution for these problems is to assume that players can modify their clients as they please and to not trust their inputs. As much as possible, cheats should be detected using algorithms and tests issued and verified by the game server, which is managed and owned either by the game's publisher or a trusted neutral third party, and the game server should not trust to be able to offload any game critical information to the client. The server should also avoid sending any information to the client that the player is not supposed to know, restricitng the client to any decisions the player might normally make.

However, first-person shooters, especially tactical shooters like Counter-Strike and VALORANT, have a unique problem in this regard: the action moves very, very quickly - so quickly, in fact, that the window for a critical moment is often shorter than the client's ping time, or the amount of time it takes for a message to get to the server to the client and for the client to send a reply.

Let's consider an example of watching an opponent peek around a corner. Both of you start on opposite sides of a wall, nominally unable to see each other, with an open archway to your right (your opponent's left). At some point, one of you might move towards the archway and see more behind it, with your opponent eventually revealing themselves to you through the archway (and you revealing yourself to them). At the exact moment one of you reveals themselves, you become vulnerable to the opponent turning towards you with their weapon and taking a shot.

Most servers for Counter-Strike run at 64 ticks, meaning that the game state updates about once every 15.6 milliseconds (ms). When a player reveals themselves to you, they are visible on the tick that they reveal themselves and are not visible on the tick before that, meaning that the latter tick is the first tick in which you should be aware of the player. However, the average ping time for a typical online game is at least 30 ms, meaning that it takes two ticks for the server to inform you that the player has appeared and two more ticks for you to inform the server that you are shooting at them.

A server might choose to respond to this information by placing a delay on your actions, so that you are always two ticks or more in the past. However, for a game like Counter-Strike, it can't really do this, because the situation is symmetric - that other player peeking around the corner, if they are facing the correct direction, will also see you, and you will be vulnerable to them shooting you. Therefore, there is a race between which of you will notice the other and shoot the other first, and each player will want to be able to start that race at the first opportunity legally presented to them.

Hence, in order to facilitate this, the server will need to tell each of you about the other person just before your opponent has actually peeked around the corner - that is, your client knows that there is someone behind the wall but must choose not to tell you this. When a player hacks their client to reveal this hidden player, this is known as a wallhack.

This problem gets much worse when you consider the higher-performance conditions in which these games are usually played. Not only do some servers run at 128 ticks, but many players play Counter-Strike with frame rates as high as 300 FPS, using very low latency displays such as high-end OLED models or even CRT displays. This means that network round trips can take as much as four or even five ticks with an Internet server, and the game displays interpolations between those ticks in order to catch as many events as possible. These low-latency, high-performance characteristics of the game are one of their primary value adds, as these conditions do the best at getting out of the way of players' unmitigated skill. And unfortunately, our online networks are simply not fast enough to handle games of this speed without placing some trust in the client.

Ultimately, I think that better network infrastructure that lowers worldwide ping times will eventually get us better server-client information management and server-side cheat detection, and I think these will be what's best for this game genre going forward.

But while we're waiting for those developments or other permanent solutions, I think it would be fun to take a little time to brainstorm and consider an opposite approach to VALORANT's approach to the cheating problem. Essentially, what if, instead of taking cheating behaviors that cannot be solved on the server and solving them with client-side anti-tampering, we simply made those behaviors an integral part of the game's design? That is, if we accept as fact that a client will tell the player about any player that the server tells them about (even someone behind them!) and that a client will shoot any opponent they know about if it's advantageous for the player to do so (even without any input from them!), can we still design a fun, competitive tactical shooter in the Defuse gameplay style?

I've spent quite a long time thinking about this, and I can't quite say for sure. However, I do think I've come up with a pretty compelling set of ideas that could easily turn into a fun game in its own right - not one that could replace the current titans of the genre, but a good alternative for players who want to use FOSS operating systems and/or value a higher focus on macro tactical gameplay.

I think I would keep the overall objectives and game structure the same. There is an attacking team and a defending team, each with 5 players. There are two bomb sites close to where the defending team starts, and the attackers have a little less than 2 minutes to either kill the defending team or place a bomb at one of the two sites, while the defending team must either kill the attacking team or run out the clock. Once the bomb is placed, the defending team must defuse the bomb, while the attacking team must either finish off the defending team or let the bomb go off. The game is played as best-of-30, with teams switching sides after 15 rounds, and during each half, players accumulate a salary based on their performance which is used to buy weapons and items.

I should also take a moment to outline the game's network architecutre and trust model. Each player would be on their own client and would send their moves to a server, which all of the clients trust to be a neutral third party. The server is the one that runs the game logic and validates whether all moves are legal, keeping track of all player positions and states internally. When some public information happens that the clients need to know about, the server reports that to the clients, but keeps other information to itself. Hence, each client knows only what the player has the right to know during the game.

First, obviously, if we played a normal game of Defuse where all players can aimbot, autoclick, and wallhack, then all players will see each other when the match starts and shoot at each other immediately. This therefore leads to the first rule change - all players are cloaked, rendered completely invisible and likely completely inaudible, unless they either plant the bomb, set off a trap designed to break cloak, or fire their weapon, making them instantaneously visible and vulnerable to retailiation. Several other actions, such as defusing the bomb, will not break your cloak, but they will display their own visible signs and often narrow down your location enough for players to retaliate with a wide-area weapon or technique.

This creates a pattern where whenever a player attempts to advance the game state or gets caught in a trap, the other players enter a chain of retaliations - one player on the opposing team will fire their weapon in an attempt to stop or punish the action, and another player on the first team will fire their own weapon to retaliate against the second player. This chain will continue until there is no one else able to fire into the retaliation chain.

Of course, it would not be fun if these fights resolved in total board wipes every time, or if they resolved due to random hit chance. Therefore, when players fire their weapons, they do so from a bank of hit currency - hits closer to the player cost less currency, while hits farther away from the player cost more, up to 100% currency to fire a weapon at maximum range. Players also drain hit currency as they move, especially if they sprint, and regain it as they stand still, especially if they crouch. If a player has too little hit currency, they can fire an extra "whiff" shot that will not hit anyone - this shot will break cloak, but grants a large amount of hit currency that can then be used immediately for the next shot.

From this, a theme starts to emerge. I think you could probably create something with a cyberpunk theme starting with these two basic rule changes, with "hit currency" representing some sort of "focus" value, but if we instead render hit currency as mana, the resource often used in fantasy settings to cast spells, then our game's theme could be about wizards who attack each other with deadly magic and use portal bombs and gadgets to steal priceless artifacts. Personally, I think wizards are more fun and would also do a great job of separating the game out from the current kings of the Defuse genre, which currently all use a military or cyberpunk aesthetic.

The most bread-and-butter spell would probably be some sort of neck snap, or a spell that affects a single point and does a lethal amount of damage if it hits correctly - this would be the most effective spell for retaliating against broken cloaks. However, with this spell, I would also take advantage of the wizard theme and add the concept of last-breath retaliation: when your health is brought to zero, you have a single tick to cast whatever spell you please before you die, which - if you have the mana for it - can simply be a neck snap to hit the player who killed you.

With this theme, setting the bomb would instead be replaced with the act of placing a portal on the target to be stolen, of which there will be two on each map closer to the defending side. Any wizard with the portal spellbook (of which there will be one given to the attacking team at the start of each round) can use the spellbook to cast the portal, which will take a few seconds and break cloak the moment it finishes casting. Any defending wizard can go up to the portal's start point and attempt to disenchant it, with the portal appearing strained as this happens and thus providing a visual cue that an enemy is nearby.

Wizards may also cast other spells in order to hit wider areas or to gain other advantages. These include things like the fireball which hits a decently wide area with damage over time, the light javelin which hits everyone intersecting with a straight line, and the dynamo which electrocutes anyone touching various metal map features such as boxes or precious objects. The economy system from Counter-Strike and VALORANT would also feature here, with smaller versions of these spells being on sale for lower prices and players needing to work up to the full versions of each spell in consecutive rounds.

To round out their attacks, wizards have a dagger which they can use to attack opponents at close range. Like wizards' other weapons, the dagger can also be used automatically, thanks to the fact that if you are walking and collide with an invisible object, the likelihood is very high that the object you are colliding with is another player. And due to the fact that finding and hitting an invisible player with the dagger is very difficult, I would make the attack an instant kill that does not break the user's cloak, meaning that a wider area spell such as a fireball would be needed to retaliate against a dagger kill. The existence of the dagger would also make having specific equipped weapons important - if two players collide into each other and know to use the dagger, but only one player has their dagger out, that player will win, but if you are killed by a dagger while having your spellbook out, you can use your last-breath retaliation to attack the dagger user. (And if both players have their daggers out, then the winner is the one with more mana remaining, though they will have mana drained from them equal to what the loser had).

A major part of the game's strategy also includes utility, or spells/tools that can be used to alter the play area or impart status effects on opponents. One such example could be an ice storm spell, which does very light area of effect damage but has the additional effect of making it cost less mana to fire into the storm and more mana to fire out of it. Another important spell would be the flashbang, which can be cast at a point in 3D space and blinds anyone looking at that point for a second or two, granting a window in which teammates can fire spells without enemies seeing them break cloak.

An important dynamic in Counter-Strike exists in the "AWP" sniper rifle - a large, heavy, and expensive weapon that is capable of one-hit killing players with either a body shot or a head shot from an incredible range, and is hence typically wielded by one player per team. It might be good to do something similar in this game, granting a spell or another ability that allows a player to attack from a very long distance in order to end retaliation chains. One such idea for this might be a special version of the neck snap spell that can fire from very long distances, on the condition that your cloak is disabled while carrying it and thus players would be able to seek you out and kill you once they got in range. Another idea would be some kind of obelisk or sniper tower you can enter that greatly extends the range of all your spells, but lights up when you enter it.

It's possible I may also want multiple character classes. I don't think this is strictly necessary - while I do like VALORANT's hero dynamic, I also think it is ultimately a strength of Counter-Strike that all players on a particular side have the same access to abilities. If I did have classes, an important one would be the artificer rogue, who does not have access to spells, but is quicker with the dagger and has access to more utility gadgets, such as throwable grenades. In particular, I would grant the artificer a portal spider, an automaton that can be wound up and placed on a portal target in order to start the portal spell - importantly, this does not break cloak, meaning that an area spell must be used instead of a single-target spell to punish portal spider placement.

So that's the basic breadth of my ideas. I've sat on this concept for a while, honestly ever since the release of VALORANT back in 2020, but when I sat down earlier this year to actually hash out how the game engine and netcode would be constructed, I realized a problem: while this construction would entirely mitigate the need for client side anticheat, it would still be plagued with the same issue of slow network ping that the more traditional model of Defuse gameplay is plagued by.

Specifically, as in traditional Defuse, every tick counts in Wizards' Defuse, and game clients need to be able to react to any piece of new public information that comes their way by choosing whether or not to cast their spells. On top of this, every time a player casts a spell, they break cloak, creating another new piece of information for everyone else to react to. This means that, during a retaliation chain, instead of the game moving at one tick per 1/64 or 1/128 per second, it now moves at one tick per ping roundtrip of the slowest client in the game whose player is still alive. This might be acceptable if it happens only once or twice per round, since you could animate some kind of cinematic slowdown to clearly show the retaliation chain, but not only will there be more than that as things like flashbangs or dagger kills happen, this slowdown also has the potential to happen even if a piece of public information turns out to be a false alarm that does not lead to any attacks, but does lead to changes in how players move (which the server will need to take into account).

Also, to be frank, at the end of the day, I would not be in this game's hardcore audience. I certainly do not have enough regular online friends to organize a ten-person game of Defuse, or even to organize a 5-person Defuse team that could match against random teams online. Whenever I play video games, it's usually a 1-player or 2-player experience. I feel like this game would be better handled by a team that could actually play it regularly and have the insights needed to tweak the game balance and make it more fun.

I do think there's still something appealing here, though. Wizards' Defuse takes away the aim and reaction time of traditional Defuse, but emphasizes the macro play and strategy aspects. I also don't think the ping problem is necessarily insurmountable - if the game can be kept interesting and deep even with only a small number of public events per round, using a cinematic slowdown might well work. And even if that can't happen, and retaliation chains are too cumbersome to orchestrate across the public Internet, if they can be orchestrated well over LAN, where ping times fall easily within the server tick rate, I think we will have accomplished something, since the likes of Counter-Strike are still plagued by client-side cheating even in LAN e-sports tournaments.

Plus, there's a certain delicious horror aspect to the whole thing. I mean, a game where you're hunted down by expertly trained crackshot killers who you can't see, but who are simultaneously being hunted down by expertly trained crackshot killers who they can't see? A horror game where the monster really is just as afraid of you as you are of it? Sign me up for that!