DMA and AI are the next frontier of online cheating, but Riot has a plan

In the vast, competitive realm of online gaming, maintaining game integrity is crucial. Riot Games, renowned for titles such as League of Legends and Valorant, is leading the charge in this arena, employing sophisticated anti-cheat systems to ensure fairness. Recently, Nick Peterson and Phillip Koskinas, key figures in Riot's anti-cheat technology, provided insights into the complexities of gaming security during an interview, addressing questions about the future of anti-cheat technology.

As a primer, it's important to know that these games employ a kernel-level anti-cheat system known as Vanguard, granting them extensive control at a highly privileged system level. This level of access allows the anti-cheat systems unparalleled monitoring capabilities on users' computers. While some view this as a privacy concern, others consider it essential for maintaining integrity in online play. With the emergence of Direct Memory Access (DMA) cheats and artificial intelligence-based cheats, the community has understandably raised many questions and concerns.

The growing threat of DMA cheats

An industry-wide problem

Anti-cheat is a growing industry that's being used to deal with a growing problem, but there are a number of challenges that developers face. Peterson's response was insightful when I asked him about those challenges, and he told me that, "our software must make at least some minimal defenses against local analysis, while also reliably detecting cheating software (and hardware), while also being stable on tens of millions of computers. Bringing all of this together in the form of something functional is the art of anti-cheat."

On top of that, cheating in video games has evolved significantly over the years, transitioning from simple code hacks that run internally in an application or externally to complex hardware and AI-driven methods. One of the primary concerns today involves Direct Memory Access (DMA) cheats. As Peterson explains, "DMA devices [...] attempt to look like an innocent device such as a network card, USB host controller, sound card, you name it. [...] The goal here is to get undetected reads on memory." Riot's approach to combatting such cheats is a closely guarded secret that they won't necessarily share, but Peterson tells me that they are working on it.

"There’s a few different approaches studios could take to make DMA usage more difficult in online games. Ours at Riot is one we’ve been slowly rolling out for several years," Peterson explains. There have been multiple Valorant ban-waves that banned a number of DMA cheat users, which seems to lend credence to the claim that Riot has managed to find ways to detect DMA cheating devices so far.

A critical aspect of Riot's strategy involves hardware-level security through IOMMU requirements, a move not yet broadly adopted across the industry. As Peterson explains, though, he thinks that "the industry ain’t quite ready for this kind of thing yet." IOMMU, or Input-Output Memory Management Unit, is a hardware technology that allows the operating system to manage the memory access for input/output (I/O) devices. It's been widely speculated that IOMMU has allowed Riot to catch many different DMA-based cheats, something that no other competitor in the anti-cheat space uses right now.

This technology improves security by restricting the device's ability to directly access memory locations, therefore preventing unauthorized access or manipulation of memory by potentially malicious devices. By enforcing IOMMU requirements with an anti-cheat, those systems can significantly reduce the risk of hardware-based cheats that exploit direct memory access.

Cheating is a growing problem but needs to be balanced with privacy

The weekly ban numbers are crazy

Detecting cheats is inherently challenging as it involves a delicate balance of data collection and user privacy. "I can’t exactly say everything that the anti-cheat collects, as that would make it too easy for cheaters to clean their rooms before mom gets home," Koskinas jokes, alluding to the secrecy necessary to keep the anti-cheat effective. He's aware of the privacy issue when it comes to data collection though, and is candid about what is or isn't necessary. "More data is just more risk for us, so the majority of this stuff is preventative. For example, we don’t need a load of notifications for all the read handles we block," he explains.

Koskinas also had this to say when it comes to concerns surrounding kernel-level anti-cheat.

Unlike consoles, PC players get much greater command over their system (which is a good thing), but all that control forces the developing studio into a position where they’ve gotta confirm that nothing’s being tampered with. It’s no longer enough to just “not trust the client,” we can’t even trust mouse inputs to that client, what Windows has to say about the process, or what hardware is connected to the machine. The attackers chose the battlefield, and we’re already at an extreme disadvantage. We need a heightened level of access to turn Windows into an environment we can trust, but that’s necessitated an anti-cheat driver that admittedly, no one’s any sort of excited about. The words “spyware” and “rootkit” get thrown around, and it’s just all become so noisy that we can barely get a word in.

As a result of that, this is also why it's very unlikely you'll ever see a competitive FPS title come to Linux with a kernel-level anti-cheat. In essence, the entire operating system can be a cheat that injects into a running game.

Largely thanks to the advanced techniques employed by Vanguard and all of the data that it collects, the sheer volume of cheat bans that it hands out is staggering. "We ban almost 60k accounts a week in VALORANT today. It’s absurd," reveals Koskinas. However, Peterson notes that the company does occasionally need to ban people manually, but that "sub 1% of all bans are truly 'manual'."

As is standard for most anti-cheat systems, they also tell me that Vanguard bans players on a timed basis. Rather than banning people as soon as they're detected to be cheating, the anti-cheat will collect data on that user and then drop the hammer on them later on. Interestingly, it sounds as if the team at Riot can recreate certain aspects of rounds that are played after the fact based on the data that Vanguard collects. I asked what data Vanguard collects, including if it collects raw mouse movement. Peterson told me that it doesn't, but said that "Val[orant]’s got a pretty quick server (128 tick rate), so we can snag most of our vectors from a server buffer reserved for sampling directions before and after a hit."

The future of anti-cheats

And the implications for cheaters, too

Looking forward, both Peterson and Koskinas see potential in integrating AI more deeply into anti-cheat systems. However, they remain cautious about its current effectiveness. "AI isn’t just a machine classification method, it’s also a path to generative input that 'looks' vaguely human," says Koskinas, suggesting that the future might see AI playing a more significant role in both detecting and simulating human play to further complicate the battleground between cheaters and anti-cheat. This could mean cheat makers employing generative inputs for mouse movements in order to make them look more human to an anti-cheat that's analyzing raw mouse movements.

When it comes to AI computer-vision cheats right now, though, Peterson tells me that he doesn't actually think much of it. "I think they’ve hopped on the AI buzzword bandwagon," he explains. Koskinas elaborates further, stating that "Setup gets intense, because you basically have to duplicate and exfiltrate screen data to a second machine or [Vanguard] is gonna spank you. Then you gotta inject input back into the main PC “somehow,” and that’s all gonna be a surface we stand a chance of noticing. Doing it external adds delay, and frankly, the performance was already poor. DMA is cheaper."

As it stands, Koskinas believes that there may be a bit of an AI war of sorts between cheats and anti-cheats.

Maybe the whole thing will unhelpfully devolve into AI vs AI. I’m reminded of PED-detection blood tests in the Olympics. How’s your model to know when a record is broken legitimately if it only knows what prior human performance looks like? Personally, I don’t think AI anticheat will ever be enough, at least not on games with mouse input as it exists today. Maybe when the game is piped directly into your hippocampus.

The day of AI vs AI in cheats isn't quite here yet, though, as Koskinas also tells me that "models today are only effective at detecting the most obvious cheaters," mirroring similar sentiment from Valve in relation to its VACnet anti-cheat network in Counter-Strike. It's an arms race between anti-cheat developers and cheat makers, and Riot is intent on winning that race.