A detector turns observations into a signal. To assess that signal, ask what was observed, what rule matched, and how often it makes mistakes in the population where it runs. Its output is not automatically a verdict.
Section: Different signals measure different things.
A signature detector matches a known pattern. A byte signature can identify a known code sequence, as in Lesson 5.7. A file hash can identify exact bytes. Matching a pattern is only as meaningful as its uniqueness and the trust in the observation.
A heuristic is a rule based on an expected pattern rather than an exact identity. Repeated input timing or an unlikely view change might trigger one. Legitimate devices, accessibility controls, or gameplay changes can also produce that pattern.
A behavioral detector studies actions over time. It may compare input edges, aiming transitions, or movement consistency. A statistical model describes the distribution of these observations. A machine-learning model learns relationships from labeled examples. Both need evaluation on legitimate cases outside the data used to build the model.
An integrity signal compares observed state with an expected reference. Hardware and account signals describe another part of the environment or its history. A new account or private profile is not itself proof of an unfair game action. Combining signals requires attention to what each actually measures.
Section: Count a rare event before trusting a flag.
The base rate is how common a condition is in the population being tested. Use a hypothetical population of 100,000 players. Assume one in 1,000 cheats. Then 100,000 divided by 1,000 equals 100 cheat, and 100,000 minus 100 equals 99,900 are honest.
Now assume the detector catches 99 percent of cheaters and wrongly flags 1 percent of honest players. These are chosen teaching assumptions, not claims about a real anti-cheat product.
Among the 100 cheaters, 0.99 times 100 equals 99 are caught. The remaining 100 minus 99 equals 1 is missed. Among the 99,900 honest players, 0.01 times 99,900 equals 999 are wrongly flagged. The remaining 99,900 minus 999 equals 98,901 are correctly left unflagged.
The flagged group therefore contains 99 + 999 equals 1,098 people. Only 99 divided by 1,098 approximately 0.0902, or about 9 percent, are cheating.
The picture groups nine flagged people into each dot. Nine is chosen because it divides both flagged counts exactly: 99 divided by 9 equals 11 dots for cheating, and 999 divided by 9 equals 111 dots for honest players. Together they make 122 dots. It depicts the flagged group, rather than every person in the original population.
Detection precision is the fraction of flags that are correct. In this example it is about 9 percent, even though the detector catches almost all cheaters. Detection recall is the fraction of cheaters caught: here 99 divided by 100 equals 99 percent. The two numbers answer different questions.
In brief: A small error rate applied to a large honest population can produce more false flags than true ones.
Section: Match the response to the evidence.
A hard rule violation, such as an impossible purchase against server-owned inventory, can be prevented immediately. A weak behavioral flag can send a trace for review without publicly naming the player.
Rechecking with another observation can help, but its errors may be correlated with the first check. Two models trained on the same mislabeled examples are not two independent witnesses. Measure the combined decision on real legitimate cases instead of multiplying error rates by assumption.
Delaying enforcement can allow further validation and group related cases. It also leaves time for harm, so prevention and mitigation must continue. Human reviewers need the trace and its context, clear decision criteria, and a way to correct mistakes. A human verdict is not automatically error-free either.