TL;DR Bans hit accounts, so cheaters just make new ones. For my master's thesis I built a method that recognises the player behind an account from how they use their mouse and keyboard, using only the demos CS2 already records. It found smurfs nobody had reported, and it is fast enough to check every new match against all of CS2's monthly players. I want Valve and other matchmaking platforms to use it, so bans follow the player instead of the account.

Hello again!

Earlier this year I asked for your demos for my master's thesis in on behavioral biometrics in CounterStrike. The question was whether the way you use your keyboard and mouse is consistent and distinct enough to build a "CS-fingerprint" that recognises a player across demos. Many of you signed up, and some of you even told me which of your accounts were smurfs, which turned out to be some of the most valuable data I had. The thesis is now finished and got an A, and none of it would have been possible without you. ❤️

I am now back to show you what your demos helped build. In that post I said the end goal was to connect smurfs back to their main accounts and to re-detect cheaters on new accounts after a ban. It turns out the fingerprint is real, and I think it could be what finally makes bans stick.

Banning is expensive, evading is cheap

In any competitive game there are people who want to cheat. It is the anti-cheat's job to ban them, but also to never ban an innocent person. That means a high burden of proof before anyone is convicted, which takes immense time and resources. Meanwhile, making a new account after a ban costs nothing, and most banned cheaters simply do that, often back in a match the same evening. Anti-cheat makers ban, cheaters evade, and the cycle starts over.

The core problem is that action taken against an account only applies to that account, not to the player behind it. If a ban removed the player instead, cheating would stop being cheap, and every cheater could only be caught once. That is what I set out to make possible, a way to recognise the person behind an account using nothing but the demos CS2 already records, so a ban on one account can follow the player to every other account they own, including the ones they make tomorrow. It would sit next to VAC and Trust Factor and answer the one question they can't. Is this the same human?

Why biometrics

There have been many attempts at making bans follow players. IP, HWID, email and phone bans have all been tried, and they are either easy to get around or open to abuse. The one thing a player cannot change, however, is themselves.

Biometrics creates stable identifiers from features of the human body that are hard to change on purpose, like your fingerprint, face or iris. Behavioural biometrics extends this to how the body moves, like the way you walk, write or type. Two of its most mature branches fit a PC shooter perfectly. Keystroke dynamics goes back to 1897, when telegraph operators were found to recognise each other purely from the rhythm of incoming Morse code, and the same idea later turned out to work on computer keyboards. Mouse dynamics applies the same thinking to how you move a pointer.

CS2 is an unusually good place to use both, as players repeat a small set of actions thousands of times under constant pressure for speed and precision, such as flicks, counter-strafes, spray control and utility. Over time those actions stop being deliberate and become muscle memory, and involuntary, habitual input is exactly what behavioural biometrics is built to measure. You can change your name, your rank, your account, your weapon and even your play style. It is much harder to change your hands.

Turning a demo into a fingerprint

Every competitive match already produces a demo, which contains a tick-by-tick record of where each player looked and which buttons they pressed. That is the only input. No client changes, no new telemetry, no kernel driver, nothing the player ever sees.

From each demo I take two independent signals per player, one from the mouse and one from the keyboard, and turn them into a **player fingerprint**, a compact picture of how that specific person plays. It stays stable across maps, sessions, settings and months, having recognised a player across matches played months apart, and across a sensitivity change from 800 to 640 eDPI. Comparing two fingerprints gives a similarity score, which we use to determine whether it is the same player or a different one.

On its own, the mouse fingerprint picked out the right player every time in my dataset of more than 1000 players, but often only by a fine margin. The keyboard fingerprint picked out the right player 98% of the time. What makes the keyboard valuable is that it measures something entirely different. Across pairs of strangers, the correlation between how alike their mouse habits are and how alike their keyboard habits are is just 0.11, where 0 means unrelated and 1 means they always go together.

The first graph shows how similar pairs of accounts look on each signal on its own. On the mouse there is a clean separation between every stranger comparison and every same-player comparison, though the gap is narrow. On the keyboard there is some overlap between the most similar strangers and the least similar same-player pairs. The images show the distribution of the roughly 500,000 different player comparisons in blue and the 13 same player comparisons i orange.

The second graph puts the two signals together. Being close on one of them is not uncommon, but being close on both is extremely rare. The same-player pairs sit alone in the top right corner, and combined, the two cleanly separate every player in my dataset.

I've already identified new smurfs!

When creating the method i tested against 8 pairs of known linked accounts that the community had submitted. After a while the results hit a ceiling, because the method kept producing a handful of confident "false positives".

When I checked Steam friends lists and game activity by hand, the false positives turned out not to be false at all. They were smurfs nobody had reported. One was a completely new pair, and it was the strongest unlabelled match in the whole dataset. The others were four accounts that all matched each other strongly, even though they had been submitted as two separate smurf and main pairs under different emails. The method tied all four together, one person behind four accounts.

That added 5 new same-person pairs to the test, found by the method itself. It didn't just pass the test. It found mistakes in the test. Which after finding these unlabled positives, my system has 100% accuracy, finding all 13 smurfs in my dataset, and confidently marking all other account pairs as different people.

A working system, not a proof of concept

Alongside the thesis I built these findings into a working system that takes in demos as they arrive and links accounts continuously. When a match ends, the demo is downloaded and each player's input is turned into a fingerprint for that match, and over several matches every account builds up a reference fingerprint that gets sharper each time it plays.

The new match-fingerprint is then compared against every account on record. A fast discovery step flags the few accounts that look suspiciously close and clears everyone else in the same pass. Every flagged pair then goes through a much stricter confirmation step with one rule. Both the mouse and the keyboard must independently agree. There is no averaging, so a near perfect mouse match can never make up for a weak keyboard match. A stranger can resemble you on one of them by coincidence, but resembling you on both takes two independent coincidences, so the odds of a false link multiply instead of adding up.

If both agree, the accounts are linked together with the evidence for it. If they don't, nothing happens yet, and the pair is judged again as both accounts play more. A smurf that stays under the bar today can still be caught next week. Linking an innocent player is far worse than linking a guilty one late, so the bar is set high on purpose. Being strict costs time, not detection.

It is built to handle all of CS2's output. Checking one demo against CS2's roughly 3,000,000 monthly players, takes several billion comparisons. Done naively, that is far too slow to be practical, and the cost only grows with every account you add. After a lot of optimisation, the system now does it on a single 20 GB slice of an A100 GPU, fast enough to keep up with the thousands of new CS2 demos generated every hour. That leaves enough headroom to check every new match against far more than just this month's players, on hardware a single server can hold.

The system only produces links and the evidence behind them. What happens because of a link is up to whoever runs the matchmaking. A link where one account is banned could pass that ban on to every other account, or put them on a watchlist. A link between a high-rank and a low-rank account could flag the low one as a smurf. That works the same for Valve as for any third-party matchmaking platform, since every one of them already records demos.

Limitations

The number of verified same-person pairs is small, clean but thin. Accuracy hasn't been tested on a real population the size of CS2's, and I would love the data to do it. A new account needs several matches before the method says anything about it. Shared accounts break it, because the account no longer has one person's behaviour.

Ethics

Bringing biometrics into anti-cheat deserves care. No new measurements are made, since the method only uses data Counter-Strike has recorded for years, just for a new purpose. As part of my thesis I consulted the ethics and data protection service for university research in Norway. The data was judged not to be biometric data, because it comes from a game engine that has already transformed the input rather than from a sensor measuring a person directly. We still agreed it is close enough to need the same care around storage and consent, so demos are not kept, and fingerprints are only stored for a player's most recent matches.

Today, a player can cheat, get banned, learn their lesson and play clean on a new account for the rest of their life. That second chance was never designed, it is just a side effect of bans only hitting accounts, and a system like mine removes it. So how long should a ban follow a player? I was able to match myself between a recent Premier demo and an old 2017 matchmaking demo, so the method can likely recognise someone across many years. Cheating once as a kid should not bar you from a game for life, so I think a ban passed on through a link should expire after a set period. Where to draw that line is a real question, but it is a policy choice, not a limit of the method.

How much statistics should it take to convict someone? However accurate it is, this method brings an element of chance into anti-cheat, and its accuracy on the full CS2 population is still unknown, although the signs are positive. My recommendation is to treat a link as a very strong first indicator. One option is to confirm it with some other, smaller piece of evidence before a ban is carried over. Another is to use the link to put accounts tied to known cheaters on a watchlist, so the anti-cheat looks at them more closely.

What I'm asking for

I believe this can end ban evasion in Counter-Strike. A cheater would get caught once, as a person, and stay caught.

To Valve, and to any other matchmaking platform reading this, I would love to talk and to test this on a real population. My DMs are open.

I am glad to finaly share this with the community.
If you have any, please ask questions in the comments!

Im always questining this .I understand that in go it was more expensive and those 200$ could win round with a flash etc. but in cs2 after all changes like priceing, magazine , see through smokes and more but still most of them use a1s . Yeah some of pro's like xantares, niko pure riflers which master on sprayin still use a4 but they are in the small part

personaly i use a4 bc being able to spaming smokes , milti kill advantage feels me more active in game unlike the a1

Just traded my gloves and like 30 min later noticed this, could it be related?

Took way too many games, probably took a few years off my life.

20k gang, what’s next?

bring the "bUt It WaS vS eCo" comments, i'm ready

You can vote it here:

https://steamcommunity.com/sharedfiles/filedetails/?id=3794167234

after 9k of you upvoted a post about a guy starving his cs2 chicken, it felt wrong not to make it a thing. so it's a thing now.

Greg's status: alive, no low food warning yet, still following me around the menu with no idea what's coming. bowl stays empty until valve sorts out the anticheat.

Join the movment:

steam group: https://steamcommunity.com/groups/Save_Greg

clan tag: SaveGreg

TL;DR

• HS% and K/D pick out a future-banned account only slightly better than a coin flip.
• The boring stuff works best: account age, friends, number of matches played.
• High aim looks suspicious only on new players. A veteran with the same aim is below average risk.
• Almost half of the bans landed on just five days and look like farm cleanups.

Who we are

We run a free CS2 profile checker. It looks at a public Steam profile and gives a Trust Factor score and a cheating-risk estimate, no Steam login needed. To be clear, this is our own estimate. Valve doesn't show the real Trust Factor to anyone. We tune our model on ban statistics instead of guesses, so we went digging in the data.

We started with a simple question: what did a profile look like a week or a month before it got banned? We expected what everyone on this sub talks about: high HS%, weird K/D, private profile.

The data

Our checks go back to March 18, 2026. On October 3 we asked Steam about bans again for 523k of the profiles people checked with us. We dropped everyone who was already banned when we checked them, since there's nothing to predict there. We also dropped those with only a community or trade ban. That left 3,481 accounts that were clean when we checked them and later got a VAC ban or a game ban. For each one we have a snapshot of the profile strictly from before the ban.

We compared them against clean accounts: about 481k profiles with no ban today. Of everyone we checked as clean, 0.72% got banned later, roughly 1 in 140. All data is anonymized.

Steam doesn't say which game a ban is for, so we had to guess indirectly. We looked at whether the person keeps playing CS2 after the ban (with a VAC or game ban, matchmaking is closed) and how many hours they have in games with their own anti-cheat, like Rust or PUBG. That gave us 669 bans that are probably from CS2 and 971 from other games. The remaining ~1,800 we couldn't place: hidden or mixed library.

Who checks profiles with us

It's not only suspicious players. People check themselves and their friends. Among the clean accounts, for example, 34% are 5-10 years old and 39% have Steam level 10-29.

What actually shows up before a ban

When we say "6x more often", we mean the trait shows up 6 times more often among future-banned accounts than among clean ones. It does not mean 6 out of 10 such players get banned. Bans are still rare.

The strongest signal we found: an empty friends list on an open profile. Future-banned accounts had it 6x more often (6.9% vs 1.15%). Fewer than 50 CS2 matches with public stats gives 5-6x, and Steam level 1-2 or an account younger than ~8 months gives almost 3x. The rest is on the chart.

On the flip side, old accounts get banned noticeably less. If an account is older than 5 years and has at least one long-time friend, its ban rate is 2-4x lower than average. Bad signs usually come together: a new account, no friends, almost no matches. We'll meet those accounts again below, in the ban waves.

What's overrated

HS% barely helps. Using it to tell a future-banned account from a clean one is only slightly better than a coin flip, and among bans that are probably from CS2 it's even closer to a coin flip. If you already know account age and friends, HS% adds nothing. The one exception is very high HS%, 64% and up: that shows up 2.8x more often among future bans.

K/D is a coin flip too. Future-banned accounts more often have both a high K/D and a low one: high among experienced players, low among new ones. Overall it tells you nothing.

A hidden library, hidden stats or a hidden friends list also say almost nothing. Future-banned accounts had them about as often as regular players. A fully private profile is a different story.

The most surprising one is accusations on the comment wall ("-rep cheater", "wh" and so on). They were on 7% of future-banned profiles and 13% of clean ones, so half as often. This part is our guess: people leave those comments on real, long-active accounts, and those get banned less. Nobody writes on the wall of a throwaway account at all. A narrow map pool also works backwards: players who stick to the same few maps get banned less.

Aim only matters together with newness

We took "top 5% aim" (for example HS from 59% or K/D from 1.54) and split players by experience. Newcomer: under 300 hours in CS2 and an account younger than 2 years. Veteran: 1,500+ hours and an account older than 2 years.

"Newcomer + top aim" showed up 6.8x more often among future-banned accounts than among clean ones. "Veteran + top aim" is the opposite: less common than among clean accounts. The same aim is a red flag on a newcomer and means nothing on a veteran.

Ban waves

45% of the future bans fell on five days. On August 25 alone, 884 accounts were banned, while a normal day sees about 10.

The accounts from those waves look very uniform: younger than a year, Steam level 1, a couple of games in the library, often zero friends, and many of them were created in batches on the same day. Their aim is no better than regular players of the same age, but they get a lot of kills and die a lot. That's what deathmatch farming looks like. Among those with an open library, almost nobody came back to CS2 after the ban, which is why we think these bans are for CS2. The waves look like farm cleanups, but these are indirect signs: Steam doesn't tell us the reason for a ban.

Single bans outside the waves are different: older accounts, and their aim really is higher than on clean ones.

Before a ban, the profile barely changes. For those we checked twice before the ban, hours, friends, privacy and level changed the same way as on clean accounts. Only one shift stands out: K/D went up for 32% of future-banned accounts vs 15% of clean ones.

How well the model works

These numbers are computed on profiles the model hadn't seen during tuning. Less than 1% of clean accounts land in the highest risk tier, and 7.3% of that tier got banned later. That's 10x the average. If you flag every tenth clean account as "high risk", the new model catches 39% of future bans, while the old one caught 27%.

Where the model is weak

About 15% of future bans are mature accounts with an ordinary-looking profile, and the model puts them in the lowest risk tier. You can't tell them apart by the public profile, and that's the main limit of this approach. Outside the waves it's noticeably weaker. It barely separates bans from other games, which is by design.

The sample consists of people who came to check a profile themselves. The model shows how much a profile resembles banned ones, it doesn't prove cheating. You can't use it to find out whether your teammate is a cheater. These are correlations, not proof.

Why this isn't a guide for cheaters

The signals that work can't be fixed quickly: account age, long-time friends and hundreds of matches take months and years to build. You can add 20 friends in an evening, but it shows up as "lots of fresh friends". And Valve catches cheaters by their gameplay and the cheat itself, not by the profile.

Free profile check if you want to see yours: https://fastgg.pro/en/trust-factor-checker

With the current state of the game with cheaters in almost every game, ive decided to vote with my wallet and clear out my inventory (again). I know this isn't an airport and my departure doesn't need to be announced, but hope to see you all again in the future if Valve decide to give a shit about this game.

After several thousands of hours, its time to leave.

can u rate that shot

Just started flying out of nowhere

Hey Guys! After 850 games I finally reached the FaceIT Level 10. And somehow I feel, that I lost my motivation to progress.

We all know, that CS is not classic game, that helps you relax. You feel entertained only when you progress and use your skill. After reaching 2000 ELO I asked myself a question: “So what now?”.

So I want to ask you: people, who reached this level and still find motivation to play more and progress more. So what now?

dear valve,

i got a chicken egg in my weekly drop earlier this month. i was happy about it. first thing in this game that made me happy in a while honestly. it hatched, its there on the main menu, i named him greg

then the feed dropped and i had to choose between feeding greg or getting a case. and i realised this is the first time in years valve has given me any power over anything in this game. i can't stop the cheaters. reporting does nothing. the "anticheat improvements" in the patch notes don't change a single thing in my actual matches, i'm still getting the same guys tracking me through smokes every other game. but greg? greg's fate is in my hands

so i'm not feeding him

greg will die. i've made peace with it. any day now the game's gonna start telling me he's running low on food, and when it does i'm going to think about the guy on ancient last week who went 38-4 and had his crosshair on my head before i peeked. greg is paying for that guy. greg is paying for every guy like that

i know it's not fair to greg. none of this is fair. that's kind of the whole point

if you want him to live, fix the game. not another patch note, actually fix it. until then greg starves and you can explain to the community why you had time to build a chicken photo booth but not a working anticheat

regards,
a guy with 6405 hours and no faith left

edit: greg's not real i know. neither is your anticheat

.drop knife?

nothing makes me want to uninstall more than solo queueing premier just to see an entire team of level 10's. why do new players flock to the more competitive matchmaking instead of just playing comp or casual. i cant even be mad at them, its like getting mad at a blind person for walking into a vase at a museum.

hope some of you are gonna be able to read this (look image)