What 12,644 Real Scans Taught Us About False Positives

1. Why we did this

An anti-cheat that bans innocent players is worse than none: it drives honest players away and teaches communities to ignore its results. Until October 2026 we judged our accuracy mostly from appeals and from scans of our own PCs. Appeals only show the cases where a player noticed, cared and wrote to us. To see the whole picture we needed to look at everything.

2. Data and method

The dataset is every scan uploaded to aacguard.com up to 9 October 2026: 12,644 scans made with clients 0.0.8 to 0.0.11. Each upload contains the verdict, the score and the scan log with every finding and its source. We worked on a copy of the database on a separate machine.

1. We grouped all findings by source (Prefetch, AmCache, browser history, game folder, running process and so on) and by the name or rule that triggered them.
2. For the groups that contributed most to CHEAT DETECTED verdicts, we identified the actual software behind the file names and paths, using file paths, publishers and, where present, file fingerprints.
3. A group was marked as a false positive only when the software was clearly legitimate (for example a signed program from a known publisher in its normal install folder) and nothing else in the scan pointed to cheating.
4. Finally we re-ran the verdict logic of the current client over the same findings and compared the result with the stored verdicts and with the bans on record.

We did not contact players for this audit, and ground truth is not known for every scan: a scan can be correct for reasons the log does not show. The numbers below are therefore about our rules, not a claim about how many players cheated.

3. What we found

3,409 of 12,644 scans (27%) had been marked CHEAT DETECTED. Many of them were correct: known loaders, injected modules and cheat files found in several independent sources. But a large share rested on evidence that should never have decided a verdict.

3.1 Browser history deciding verdicts

504 CHEAT DETECTED verdicts, belonging to 244 players, were based only on visits to cheat websites, all from clients 0.0.8 to 0.0.10. A visit to a cheat site is a lead (people read about cheats, follow links, look up a cheat they were accused of using) but it is not proof that anything was downloaded or run.

3.2 Names matched inside longer words

Older clients matched cheat names as substrings. That turned ordinary software into cheats:

3.3 Judging tools by their name

About 92 bans came from macro software alone: AutoHotkey, AutoIt, TinyTask and macro recorders, including the one in Microsoft Power Automate. These tools are used for work, accessibility and games that allow macros. Their name says nothing about what a user does with them.

3.4 Legitimate programs that behave like cheats

• Process Lasso keeps a handle to every game it manages, which looks like an external cheat reading game memory.
• NVIDIA capture components, SteelSeries GameSense, Voicemeeter, the Java ahead-of-time compiler and a laptop camera service were reported because of their names or because they touch the game or its devices.
• Miles sound codecs (.asi files) and the protectors that non-Steam CS 1.6 builds ship as .asi plugins looked like cheat plugins. One player with about seven non-Steam builds collected nine plugin findings and a CHEAT DETECTED.

3.5 Weak evidence adding up without limit

Several weak findings from the same source (for example nine deleted Windows components whose names contained a cheat word) added up to more than one strong finding would. The verdict did not distinguish between "one strong reason" and "many weak guesses".

4. What we changed

4.1 In the client

• Whole-word matching for cheat names, and a built-in list of legitimate name parts (such as the Windows Perception components and training maps) removed before matching.
• Browser history never decides. It can support stronger findings, nothing more.
• Name guesses are capped at 75 points per source, however many there are.
• A score-based CHEAT DETECTED needs at least one strong finding. An exact match with a known cheat file or fingerprint still decides on its own, because it is not a guess.
• Macros are judged by what the script does. Macro software never counts; only scripts that control recoil, repeat jumps (both medium) or aim by screen colour (strong) do. See our guide Macros, AutoHotkey and mouse software.
• Trusted publishers: programs such as Process Lasso count only if they are signed by their real publisher, so a cheat using the same name is still caught.
• Plugins in non-Steam builds count once per scan unless there is cheat code inside, and files reviewed as legitimate are recognised by their fingerprint.
• About 50 new whitelist entries for the legitimate software found in the audit.

4.2 In the ban pipeline

Automatic bans are created by a server job from high-confidence scans. We changed it so that it applies the same whitelist as the client, never bans on browser history and has two new modes: a review mode that lists automatic bans the current rules would not create, and a lift mode that removes them after writing a file that can restore every one of them. Manual bans by staff are never touched by either mode.

5. Results

Re-running the current rules over the same 12,644 scans produces automatic bans for about 620 players, compared with 1,187 bans on record at the time of the audit. In other words, roughly half of the older automatic bans would not be created by today's client. They are not all wrong (some of those players have strong findings in other scans), which is why every lift goes through the review list first and every lift can be undone.

The wrongful verdicts were concentrated in clients 0.0.8 to 0.0.10. Players whose verdict was caused by one of the classes above can appeal from their scan page.

6. What we do differently now

1. Every new cheat name is tested against the full scan archive before it is added. If a name matches legitimate software in real scans, it is not added as a name; at most it goes into the list of exact file names.
2. Plain words are never cheat names. Many cheats have ordinary names (a colour, a city, a mythological figure). Those are matched only as exact file names, never inside other words.
3. Every source has a cap. No single kind of evidence, however often it appears, can push a scan to CHEAT DETECTED by repetition.
4. Every finding shows its points and reason in the app and on the scan page, so players and admins can see exactly why a verdict was reached and dispute a single finding instead of the whole scan.

7. Limitations

The audit can only see what uploaded logs contain. It cannot find false negatives (cheaters marked CLEAN), and it cannot prove that a finding we kept is a true positive. We also only reviewed the largest groups by hand; smaller groups of one or two scans may still contain mistakes. False-positive reports from the app and appeals remain the way we find those, and confirmed reports are fixed for everyone.