How we detect cheaters

What the model reads

Every uploaded or imported demo is parsed with demoparser2 into per-tick events — positions, view angles, shots, kills and weapons. Two models then read that data:

• Wall model — engine visibility at the moment of each kill, wallbang timing, tracking through smoke and walls, and headshot ratio. It looks for reactions to information a player shouldn't have had.
• Aim heuristic — crosshair placement, flick magnitude and speed, pre-aim angles onto unseen enemies, and time-to-kill. It looks for movement that is faster or more precise than human input tends to be.

Signals are combined per match into a single 0–100 suspicion score, with a dominant aim or wall tag showing which pattern drove it. Where a demo isn't scored, we fall back to headshot percentage as a weak proxy.

Calibrated triage, not a verdict

A high score does not mean a player is cheating. It means this match sits in the tail of the distribution and is worth reviewing. Scores are calibrated so that the label — High, Watch or Low — maps to a rough confidence band, and we surface the underlying kills so a human can judge the evidence directly rather than trusting a number.

How we handle false positives

• Low sample is never flagged. Players with too few kills in a match are shown as low-sample rather than scored.
• Confirmed-clean accounts are trusted. Operator ground-truth labels override model output.
• Thresholds favour caution. We tune to keep false positives low, accepting that some genuine cheaters score below the line.
• Everything is labelled alleged. Public listings say so, videos publish Unlisted pending moderation, and nothing is presented as a factual accusation.

Appeals and removal

Any accused player can request removal from the public watchlist. Appeals are logged to an audit trail and reviewed by a moderator, and the associated video stays Unlisted while a report is under review. We treat takedown requests as a first-class part of the pipeline, not an afterthought.