Method and system for protecting players from visual game cheating based on machine learning

Abstract

The invention provides a method and a system for protecting a player from cheating by an automatic visual sighting device in a video game. The method comprises the following steps: acquiring each frame of the video game; superposing a pre-generated universal defense disturbance on each obtained frame, and presenting the frame superposed with the universal defense disturbance to a player of the video game; wherein the universal defense disturbance superimposed on each frame is visually invisible to a player of the video game, and an object detection model in a visual automatic sighting device during running of the video game cannot recognize a target object, so that the automatic sighting function of the visual automatic sighting device fails. According to the scheme, the automatic visual sighting device cannot accurately recognize the game target, so that the completeness of the game is ensured, legal game playing methods are not influenced, and the automatic visual sighting device can be effectively expanded in different game settings and player groups and can adapt to the dynamic characteristics of the game environment.

Description

Technical Field

[0001] This application relates to the field of machine learning, and in particular to machine learning-based methods and systems for protecting players from visual game cheating. Background Technology

[0002] In recent years, the first-person shooter (FPS) game industry has experienced significant innovation and rapid growth. However, the rise in cheating has also cast a shadow over the industry, particularly the use of aimbots, which undermine game security and fairness through automated aiming and shooting. With the development of artificial intelligence, visual aimbots have become increasingly prevalent and effective. These do not require memory-related operations but instead utilize game visual effects and integrated detection models to extract game information, enabling automatic target detection and aiming. This evolution renders traditional anti-cheat technologies ineffective against visual aimbots, highlighting a critical gap in current game security protocols. Summary of the Invention

[0003] This application proposes an active defense system against visual auto-aiming cheating in first-person shooter games—the Invisibility Cloak—to fill this gap. The key component of this system is a "Cloak Crafter," which generates visually invisible perturbations (also referred to as a "cloak") that prevent the object detection model in the visual auto-aiming device from detecting target objects in the game screen, thereby preventing the visual auto-aiming device from automatically aiming and firing. The above-mentioned defense function is mainly achieved through the following two processes:

[0004] (a) Generate a generic cloak: A generic cloak is pre-generated using a training process based on multiple proxy models (different proxy models can represent different types of object detection model architectures used in visual auto-aiming) for static deployment, thereby ensuring real-time protection in a visually inconspicuous manner.

[0005] (b) Cloak refinement for model variability: Fine-tune the general cloak to adapt to dynamic real game environments and effectively cope with changes in cheat models and game scenarios.

[0006] By integrating this invisibility cloak with the normal game rendering process, the generated cloak can be applied to the player's display device, achieving non-intrusive defense without monitoring user processes. This application is applicable to a wide range of FPS games, providing them with a universal defense mechanism. In experiments, using popular real-world games like CrossFire (CF) and Counter-Strike 2 (CS2) as examples, the defensive performance of the invisibility cloak was compared with existing state-of-the-art adversarial attack techniques (such as RayS, DAG, and TOG). Experimental results show that this application can achieve real-time re-rendering of high-quality game visuals while effectively blocking various mainstream object detection models. Its real-time performance and portability far exceed existing methods, and its efficiency is dozens of times higher than other methods.

[0007] According to a first aspect of the embodiments of this application, a method for protecting players from visual auto-aiming cheats in video games is provided, comprising the following steps:

[0008] S1: Capture each frame of the video game;

[0009] S2: Superimpose pre-generated general defense perturbations onto each acquired frame;

[0010] S3: Presents frames with overlaid universal defense perturbations to video game players.

[0011] The general defensive perturbation superimposed on each frame is visually invisible to the player in the video game and can prevent the object detection model in the visual auto-aiming system during video game runtime from recognizing the target object, thereby disabling its auto-aiming function.

[0012] In some embodiments, the method may further include: detecting an object detection model of a visual auto-aiming device running in a video game; fine-tuning the general defense perturbation based on the detected model to obtain a real-time defense perturbation; and superimposing the real-time defense perturbation onto the acquired frames of the video game and presenting it to the player of the video game.

[0013] In some embodiments, the general defensive perturbation may be generated by training a cloak maker through the following steps:

[0014] a) Obtain a set of consecutive game screenshots and multiple proxy visual models and initialize the initial general defensive perturbation, which serves as a model parameter, with random noise, where the different proxy visual models represent different types of object detection models that can be used with the visual auto-aiming device;

[0015] b) Overlay the current general defense perturbation onto each game screenshot;

[0016] c) For each agent visual model, obtain its confidence score in identifying target objects on a game screenshot superimposed with general defense perturbations as a prediction value;

[0017] d) Calculate the loss value based on the predicted value output by each agent visual model and its corresponding confidence label, wherein the loss function used is designed to reduce the confidence score, and the confidence label corresponding to each predicted value is set to 0;

[0018] e) Calculate the gradient information of the loss function with respect to the current general defense perturbation;

[0019] f) Update the current general defense perturbation using the gradient information;

[0020] g) Calculate the cloak maker's defense success rate;

[0021] h) Iterate through steps b) to g) until the defense success rate reaches the preset target value or the loss function converges.

[0022] In some embodiments, the confidence score for identifying a target object for each proxy visual model can be the probability that the target object is contained in the bounding box generated by the proxy visual model in the game screenshot.

[0023] In some embodiments, the defense success rate is the proportion of instances in which the cloak maker successfully prevents the proxy visual model from recognizing the target object.

[0024] In some embodiments, step f) can be used to update the current general defense perturbation based on the learning rate and truncation function of the cloak maker and gradient information, wherein the truncation function is used to constrain the infinity norm of the general defense perturbation to be below a specified threshold.

[0025] In some embodiments, fine-tuning general defense perturbations may include the following steps:

[0026] For the detected object detection model, evaluate its real-time confidence score in identifying target objects in real-time game screenshots;

[0027] Corresponding to an assessed real-time confidence score equal to or greater than a preset threshold, the following steps are performed based on a set of continuous real-time game screenshots and the detected object detection model to refine the current general defense perturbation to obtain a real-time defense perturbation:

[0028] a') Initialize the real-time defense perturbation used as a model parameter to the current general defense perturbation, and initialize the current proxy visual model to the detected object detection model;

[0029] b') Overlay the current real-time defense disturbance onto the real-time game screenshot;

[0030] c') For the current agent visual model, obtain its confidence score in identifying target objects on game screenshots superimposed with real-time defense disturbances as the prediction value;

[0031] d') Calculate the loss value for the predicted value output by the proxy visual model and its corresponding confidence label, where the loss function is designed to reduce the confidence score, and the confidence label for each predicted value is set to 0;

[0032] e') Calculate the gradient information of the loss function with respect to the current real-time defense perturbation;

[0033] f') Use the gradient information to update the current real-time defense perturbation;

[0034] g') Calculate the current real-time defense success rate of the cloak maker;

[0035] h') Iterate through steps b') to f') until the real-time defense success rate reaches the preset target value or the loss function converges.

[0036] In some embodiments, the real-time defense success rate is the proportion of instances in which the cloak maker successfully prevents the detected object detection model from identifying the target object.

[0037] According to a second aspect of the embodiments of this application, a system is provided to protect players from visual auto-aiming cheating in video games, comprising: a cloak maker, which is used to acquire each frame of a video game to be displayed, superimpose a pre-generated universal defense perturbation onto each acquired frame, and send each frame superimposed with the universal defense perturbation to a display device, wherein the universal defense perturbation superimposed on each frame is visually invisible to the player of the video game and enables the object detection model in the visual auto-aiming system during the operation of the video game to fail to recognize the target object, thereby disabling its auto-aiming function; and a display device, which is used to display each frame processed by the cloak maker.

[0038] In some embodiments, the cloak maker may further include a cloak fine-tuning module for detecting an object detection model of a visual auto-aiming device running in a video game; fine-tuning the general defense perturbation based on the detected model to obtain a real-time defense perturbation; and superimposing the real-time defense perturbation onto the acquired frames of the video game and presenting it to the player of the video game.

[0039] In some embodiments, the cloak maker may further include a cloak generation module that generates a general defensive disturbance through the following steps:

[0040] a) Obtain a set of consecutive game screenshots and multiple proxy visual models and initialize the initial general defensive perturbation, which serves as a model parameter, with random noise, where the different proxy visual models represent different types of object detection models that can be used with the visual auto-aiming device;

[0041] b) Overlay the current general defense perturbation onto each game screenshot;

[0042] c) For each agent visual model, obtain its confidence score in identifying target objects on a game screenshot superimposed with general defense perturbations as a prediction value;

[0043] d) Calculate the loss value based on the predicted value output by each agent visual model and its corresponding confidence label, wherein the loss function used is designed to reduce the confidence score, and the confidence label corresponding to each predicted value is set to 0;

[0044] e) Calculate the gradient information of the loss function with respect to the current general defense perturbation;

[0045] f) Update the current general defense perturbation using the gradient information;

[0046] g) Calculate the cloak maker's defense success rate;

[0047] h) Iterate through steps b) to g) until the defense success rate reaches the preset target value or the loss function converges.

[0048] According to a third aspect of the present application, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements the method described according to the first aspect of the present application.

[0049] The beneficial effects of this application are as follows:

[0050] 1. The invisibility cloak can actively block visual auto-aiming devices that existing anti-cheat methods cannot solve, preventing the auto-aiming devices from accurately identifying game targets, thereby ensuring the integrity of the game without affecting legitimate gameplay.

[0051] 2. Real-time performance and scalability: This application minimizes the impact on game performance, provides real-time protection, and can be effectively scaled across different game settings and player groups, adapting to the dynamic characteristics of the game environment.

[0052] 3. Non-intrusive implementation: Unlike most traditional existing anti-cheat methods, this application does not require monitoring the user process. Instead, it integrates with the normal game rendering process, overlaying the generated cloak onto the player's display device, thus achieving non-intrusive defense.

[0053] 4. Versatility: This application provides a universal defense mechanism across multiple FPS games to defend against visual auto-aiming devices, demonstrating its good adaptability and effectiveness.

[0054] 5. Non-visible protection: Experiments show that the method of this application can effectively protect players from visual auto-aiming devices without compromising visual quality or real-time performance, thus not affecting the gaming experience. Attached Figure Description

[0055] The embodiments of this application will be further described below with reference to the accompanying drawings, wherein:

[0056] Figure 1 This illustration shows the working stages of the invisibility cloak in a massively multiplayer online game (MMOG) architecture according to an embodiment of this application.

[0057] Figure 2 A flowchart illustrating the steps of a method for protecting players from visual auto-aiming cheats in video games according to an embodiment of this application;

[0058] Figure 3 This is a graph showing the changes in Defense Success Rate (DSR) and frames per second (FPS) with the number of initialization iterations according to one embodiment of this application.

[0059] Figure 4 A bar chart illustrating the effect of learning rate α on DSR according to one embodiment of this application;

[0060] Figure 5 A bar chart illustrating the effect of the upper limit of the disturbance amplitude ε on DSR and frames per second (FPS) according to one embodiment of this application;

[0061] Figure 6 A schematic diagram illustrating the detailed process of an invisibility cloak in a CF according to an embodiment of this application is shown.

[0062] Figure 7 This is a graph showing how the loss decreases with increasing iterations according to one embodiment of the present application until the cheating model is successfully defended.

[0063] Figure 8 Visual examples of different approaches in two popular first-person shooter games, CS2 and CF, are shown under the l∞-norm constraint (ε = 8 / 255), where IC represents the invisibility cloak;

[0064] Figure 9 This shows a schematic diagram of the user's assessment of naturalness. Detailed Implementation

[0065] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description, in conjunction with the accompanying drawings, provides specific embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0066] In video game cheating, the most prevalent and harmful cheating tool is the auto-aiming device, which can improve a player's aiming and shooting accuracy, fundamentally undermining the integrity and fairness of the game. Auto-aiming devices primarily perform two steps: acquiring game data and automatic firing. Based on the different data acquisition methods, auto-aiming devices can be broadly divided into two categories: memory access auto-aiming devices and visual auto-aiming devices. Memory access auto-aiming devices can directly access game data in the client's memory (e.g., precise target object locations and resource locations). Existing anti-cheat tools typically disable memory access auto-aiming devices by preventing unauthorized client access to game memory.

[0067] However, unlike memory access aiming devices, machine learning-based visual auto-aiming devices do not require memory access. Instead, they rely entirely on the game's visual screen, using an integrated visual detection model (also known as an object detection model or simply a detection model) to identify target objects. The visual auto-aiming device captures a rectangular area around the mouse cursor in real-time from the game screen, then uses the detection model to obtain the character's bounding box from the screenshot. It then automatically moves the mouse to the identified target box and begins firing. This cheating method is non-intrusive, relies solely on the game screen, and can be applied to various game scenarios and devices. Existing anti-cheat tools are unable to effectively defend against such visual auto-aiming devices.

[0068] To address this, this application proposes an active defense framework (also known as an "invisibility cloak") against visual auto-aiming cheating. The core idea is to introduce an invisible perturbation into the game screen (in this document, unless otherwise specified, this visually imperceptible invisible perturbation can also be referred to as a cloak, which is essentially a type of noise). This perturbation is imperceptible to human players but prevents the detection model integrated within the visual auto-aiming device from accurately identifying targets in the game screen. Considering the usability, practicality, and deployability of this method, effective defense against visual game cheating needs to overcome the following challenges: (C1) Portability: Since it is impossible to know in advance the cheating patterns used by the cheater, the method should be portable. (C2) Robustness: The method should be applicable to various complex situations. Furthermore, to ensure a normal player experience, the method also needs to meet the following requirements: (C3) Imperceptibility of the perturbation; (C4) Real-time performance.

[0069] To address the aforementioned challenges within the invisibility cloak framework, this application's active defense framework comprises two main stages: offline universal cloak generation and online cloak refinement. In the universal cloak generation stage, multiple detection models and different game screenshots are used to generate universal defense perturbations (also referred to as universal perturbations). In the cloak refinement stage, the universal perturbations are refined within the current practical game environment to adapt to specific game scenarios. To satisfy C3 and C4, the perturbations throughout the process can be further constrained to be sufficiently small, and the number of iterations can be limited. To evaluate the defensive effectiveness of this application's active defense framework, the inventors conducted comprehensive experiments on two of the most popular FPS games, CrossFire (CF) and Counter-Strike 2 (CS2). Experimental results show that this application's "invisibility cloak" effectively resists visual game cheating; in CF and CS2, related visual auto-aiming devices become ineffective without affecting the player's gaming experience. Furthermore, this application simplifies the online deployment process.

[0070] More specifically, Figure 1 The diagram illustrates the operational phases of the invisibility cloak according to embodiments of this application within a modern massively multiplayer online game (MMOG) architecture. For example... Figure 1 As shown, stages ① to ④ illustrate the standard architecture of an MMOG. In this architecture, after the game's rendering process is complete, the visual output presented on the display becomes vulnerable to attack if no appropriate protection measures are taken, as shown in stage ⑦. In this case, the unprotected display content is easily exploited by cheat software, which is specifically designed to gain an unfair competitive advantage by acquiring and analyzing visual information. Therefore, in the embodiments of this application, after the rendering process is completed, the visual output of the game is protected by introducing an invisibility cloak technology, as shown in stage ⑤. Specifically, after rendering is completed, the vulnerable display feedback is first provided to the invisibility cloak for processing, thereby preventing attacks from the visual auto-aim. The invisibility cloak aims to disrupt the effectiveness of the detection model in the visual auto-aim by adding a visually imperceptible perturbation to the game screen before the auto-aim performs object detection, thus disabling the visual auto-aim. As shown in stage ⑥, cheating methods cannot detect any targets on the screen. At the same time, another significant feature of the invisibility cloak is that the added perturbation is invisible enough that it is imperceptible to the player and therefore does not affect the player's visual experience.

[0071] In this cloak of invisibility system, the cloak maker is the core component. It receives game frames that need processing and quickly outputs game frames with an added invisible perturbation. This added perturbation is invisible, making it undetectable to both the player and the auto-aim. From the player's perspective, the gameplay experience remains unchanged, as no noticeable alteration is perceived. Conversely, for the auto-aim, this invisible perturbation disrupts its core function—the ability to accurately identify targets on the screen—preventing it from moving the mouse to eliminate them.

[0072] In this application, a cloak refers to a defensive perturbation, essentially a type of noise superimposed onto video frames. When applied to raw game images, this cloak can address challenges including real-time performance, imperceptibility, transferability, and robustness. For ease of explanation, the relevant definitions are as follows: A set of consecutive game screenshots is represented as X = {x1, x2, ..., x...} T}, where x represents a frame. The detection model integrated into the visual auto-aiming device used by the cheating player is denoted as M. C (Also known as a cheating model), this cheating model takes a game screenshot x as input and outputs the location, category, and confidence score S of the target object in the game. The active defense of this application aims to find the perturbation δ and add it to x in order to reduce S, which can be shown by the following formula (1):

[0073]

[0074] Here, ε is the upper limit of the perturbation amplitude. If S is below the threshold θ, the defense will usually succeed.

[0075] In some embodiments, the cloak maker includes two main modules: a general cloak generation module and a cloak refinement module. The general cloak generation module generates a general perturbation that can disrupt the ability of various cheating models to detect targets in different scenarios. The cloak refinement module uses an efficient search mechanism based on a momentum gradient optimization strategy to improve and optimize the generated general perturbation to adapt it to the actual game scenario, thereby ensuring its efficiency and effectiveness.

[0076] Given that visual autoaiming tools can use different object detection models, in embodiments of this application, the training strategy for the cloak maker is designed to be model-independent and applicable to various types of detection model architectures. To avoid the potential problem of cloaks overfitting a single model, different surrogate models are used during the training phase to participate in the generation of a generic cloak. These different surrogate models represent different types of detection model architectures that can be used in visual autoaiming tools. This strategy enhances the transferability of the cloak maker and ensures its effectiveness across various object detection models used in visual autoaiming tool cheating.

[0077] Beyond its transferability across different object detection models, the robustness of the cloak maker extends to its effectiveness across various game scenarios and player settings. Different games have different maps, backgrounds, and resolutions, requiring general perturbations to adapt to these variations. To achieve this, in embodiments of this application, the training dataset includes various types of game scenarios, including different maps, special effects (e.g., smoke, Molotov cocktails), and scenarios with varying numbers of characters and objects (e.g., animals, footballs). Furthermore, the training dataset is enhanced through resolution tuning, further ensuring the cloak's effectiveness across diverse settings.

[0078] In this application, l is used ∞ To control the magnitude of the perturbation, this is the most popular and widely used norm. Specifically, although l ∞ Norm constraints are more stringent, making perturbations harder for the human eye to detect and enhancing robustness to overly sensitive detection models, thus improving applicability in real-world scenarios. Furthermore, the inventors found that altering the bounding box's position through perturbation is more challenging than lowering its confidence score. Therefore, in the embodiments of this application, the invisibility criterion is based on the predicted bounding box's confidence score falling below a set threshold, rather than using the intersection-over-union (IoU) ratio between the predicted bounding box and the ground truth. Such a criterion does not require more information from the model itself and avoids pre-annotating the bounding box's position in the dataset.

[0079] In some embodiments, considering the high frame rate demands of modern first-person shooter games, the deployment strategy employed is to insert pre-generated static universal perturbations (i.e., universal cloaks) into all game scenes, achieving zero latency and, in most cases, directly defending against visual cheating. Furthermore, improved cloaks can be generated almost instantly through efficient momentum gradient search and strict iterative constraints. These improved cloaks are then deployed intermittently into game frames. This deployment strategy ensures that the cloak maker maintains game smoothness by providing real-time defense without sacrificing game quality.

[0080] In some embodiments, the process of generating the universal cloak is completed offline, specifically including the following steps:

[0081] Step 1: Initialize. Randomly initialize a noise δ with the same size as the input x. U This refers to the initial perturbation. Each frame x of the game screenshots used here is collected from different complex scenes. K proxy visual models {M} are set up. 1 M 2 ,···,M KThese represent different object detection model architectures. For each proxy vision model, its initial input is the perturbated frame obtained by adding a perturbation to frame x: x + δ U .

[0082] Step 2: Evaluate the confidence score for each agent visual model. Given a perturbed input x+δ U The k-th agent visual model M k The output predictions are generated, which consist of a set of bounding boxes and a confidence score associated with each bounding box. This set of confidence scores is denoted as S. k ∈R N , where N is the number of bounding boxes. In some object detection models of visual auto-aiming systems (e.g., YOLOv5), confidence can represent the probability that each box contains a target object. In other object detection models (e.g., NanoDet), confidence is the probability that each bounding box is classified as a target category (in first-person shooter games, the target object is usually defined as 'person'). The above process is represented by the following formula (2):

[0083] S k =M k (x+δ U (2)

[0084] Step 3: Construct the loss function. The training objective for each proxy vision model is to minimize the confidence score of that proxy vision model used as a cheating model when the input is perturbed, so as to ensure that it cannot correctly identify the game target. Therefore, in one embodiment, a binary cross-entropy (BCE) loss is used, with the confidence labels of all boxes set to 0. This loss function can be understood as the predicted value of the output of all proxy vision models, as shown in the following formula (3):

[0085]

[0086] Where s k i ∈S k It is S k The i-th confidence score. It should be understood that the above formula (3) gives the joint loss function from a mathematical perspective, which sums the confidence losses of all proxy models to form the overall optimization objective. In the actual training process, the gradient can be calculated for each proxy visual model based on its confidence loss, and then these gradients can be combined as the total gradient of the joint loss function, thereby jointly guiding the update of the general perturbation.

[0087] Step 4: Update the general perturbation by calculating gradients via backpropagation. Since the various proxy vision models used are fully accessible (i.e., open source), backpropagation can be used to calculate the loss function of each proxy model with respect to the model parameters δ. U The gradient of each proxy model is then summed to obtain the overall gradient. The general perturbation δ can then be updated using gradient information. U For example, the update method can be shown in formula (4) below:

[0088]

[0089] Where α represents the learning rate, which is a global hyperparameter preset during training, and Clamp(·) is the truncation function, which constrains the perturbation to have an l∞ norm below the threshold ε, which can usually be set to 8 / 255 or 16 / 255. This indicates that the loss function L is based on δ. U The overall gradient of the model parameters. In one example, the learning rate α can preferably be set to around 0.005 or 0.01.

[0090] Next, repeat steps 2 through 4 until the universal perturbation δ is reached. U The defense success rate on the validation set reaches a preset threshold or the loss L cannot be further reduced. Upon completion, a general-purpose cloak δ that can be statically deployed for real-time protection is obtained. U The entire process is conducted offline. It can be seen that the generation of the universal cloak is actually a process of continuous updating and optimization during training, utilizing gradient information provided by multiple proxy visual models. During the training phase, various proxy visual models jointly guide the update of the universal perturbation, thereby obtaining a universal perturbation that has a good suppression effect against various cheating models. The universal cloak generated in this way is visually inconspicuous to both players and cheaters, providing protection in various game scenarios and defending against detection models integrated into various visual auto-aiming devices.

[0091] However, due to differences in cheating model frameworks and their respective confidence scoring algorithms, the universal cloak is merely a robust, general perturbation and is not applicable to any specific model or game scenario. Therefore, it may not perform optimally in all situations. To address this, in some embodiments, the proactive defense system also involves dynamically updating the generated universal cloak in real time to adapt to different cheating models and game scenarios encountered during gameplay, thereby further strengthening its defense mechanism. Furthermore, in the dynamic environment of first-person shooter games, various cheating models and constantly changing game scenarios are encountered, and the universal cloak may not always be perfectly aligned with the current data stream. Therefore, a process is also needed to fine-tune the universal cloak to adapt to the real game environment.

[0092] Due to the online nature of this process, efficiency is paramount. To ensure the real-time nature of cloak refinement, the refinement process in this application is further limited to meet the following conditions: (1) the number of iterations is limited, typically to 5 or fewer; (2) the proxy visual model used in the iterative update process must be lightweight and suitable for efficient inference. For ease of description, the currently detected lightweight proxy visual model is denoted as M, and the current game frame input is denoted as x. The cloak refinement process may include the following two stages.

[0093] Phase 1: Performance Evaluation of the Universal Cloak. First, the performance of the universal cloak δ was tested. U Whether it will effectively prevent the current game's visual auto-aiming detection model M from correctly identifying the target object, i.e., whether the maximum confidence score Max(S) is lower than the threshold θ (usually 0.4). If successful, a universal cloak can be used directly, avoiding additional refinement overhead.

[0094] Phase 2: Conditional cloak refinement. If the general perturbation is invalid, initialize the noise δ to the general cloak δ. U The general perturbation is iteratively updated using steps 2 through 4, similar to those described above for generating the general cloak, but with only the current detection model M used as the surrogate visual model and the currently captured frame data x. Given the limited number of iterations, the initial learning rate α is updated before each iteration, as follows:

[0095]

[0096] Where α i It is the initial learning rate, μ t s(t) and s(t) are intermediate values ​​updated iteratively by the Adam optimizer (Adaptive Moment Estimation). The Adam optimizer is a common gradient update algorithm used in the training of machine learning-based models.

[0097] In some embodiments, the deployment strategy for the invisibility cloak includes the following two phases:

[0098] 1) Deployment of the Universal Cloak. The Universal Cloak was initially deployed by game developers as the default protection. It is pre-made offline and integrated into the game's rendering pipeline, ensuring zero latency during gameplay and providing basic protection for all frames. In some embodiments, the Universal Cloak can be customized based on the scene (e.g., the game map) and updated regularly to ensure it is not easily accessible to attackers.

[0099] 2) Intermittently Inserted Refined Cloak. Given that modern first-person shooter games require high frame rates, with a comfortable gaming experience starting at 60 frames per second (FPS), cloak generation speed often cannot keep up with the game's rendering speed. To maintain a smooth gaming experience without sacrificing protection, frames are sampled periodically for cloak refinement. This means that not all game frames will have a refined cloak, which may slightly affect the defensive capabilities of some frames. However, the primary goal is to significantly disrupt cheaters' reliance on visual auto-aim. Cheaters use auto-aim to gain an unfair advantage, enhancing their experience at the expense of other players. The strategy in this application ensures that even if some individual frames fail to defend, the overall effectiveness of the auto-aim is greatly diminished. The high accuracy of cheat tools is crucial, and defense can significantly reduce the accuracy of the auto-aim, causing cheaters to gradually abandon it.

[0100] In some embodiments, the refined cloak may be generated based on the game application. For cloud gaming platforms where graphics are rendered by a server, the refined cloak is securely generated on the server side. For PC games that rely on client-side rendering, a Trusted Execution Environment (TEE) can be used to prevent the cloak from being modified or deleted.

[0101] Figure 2 A flowchart illustrating a method for protecting players from visual auto-aiming cheating in video games according to an embodiment of this application is shown. The method mainly includes the following steps: S1: acquiring each frame of the video game; S2: superimposing a pre-generated universal defense perturbation onto each acquired frame; S3: presenting the frame with the superimposed universal defense perturbation to the player of the video game. The universal defense perturbation superimposed on each frame is visually invisible to the player of the video game and is used to prevent the object detection model of the visual auto-aiming device running in the video game from recognizing the target object. The generation process of this universal defense perturbation can be referred to the description above.

[0102] In some embodiments, the method may further include: detecting an object detection model of a visual auto-aiming device running in the current video game; fine-tuning the general defense perturbation based on the detected model to obtain a real-time defense perturbation; and superimposing the real-time defense perturbation onto the acquired frames of the video game and presenting it to the player of the video game.

[0103] In some embodiments, a general defense perturbation may be generated through the following steps:

[0104] a) Obtain a set of consecutive game screenshots and multiple proxy visual models and initialize the initial general defensive perturbation, which serves as a model parameter, with random noise, where the different proxy visual models represent different types of object detection models that can be used with the visual auto-aiming device;

[0105] b) Overlay the current general defense perturbation onto each game screenshot;

[0106] c) For each agent visual model, obtain its confidence score in identifying target objects on a game screenshot superimposed with general defense perturbations as a prediction value;

[0107] d) Calculate the loss value based on the predicted value output by each agent visual model and its corresponding confidence label, wherein the loss function used is designed to reduce the confidence score, and the confidence label corresponding to each predicted value is set to 0;

[0108] e) Calculate the gradient information of the loss function with respect to the current general defense perturbation;

[0109] f) Update the current general defense perturbation using the gradient information;

[0110] g) Calculate the cloak maker's defense success rate;

[0111] h) Iterate through steps b) to g) until the real-time defense success rate reaches the preset target value or the loss function converges.

[0112] For details regarding the specific loss function and the general defensive perturbation that uses gradient information to update model parameters, please refer to the above description.

[0113] In some embodiments, the confidence score for recognizing a target object for each proxy visual model can be the probability that the proxy visual model contains the target object in the bounding box generated in the game screenshot. In some embodiments, the defense success rate is the proportion of instances in which the cloak maker successfully prevents the proxy visual model from recognizing the target object. In some embodiments, step f) can be updated based on the cloak maker's learning rate and truncation function, as well as gradient information, where the truncation function is used to constrain the infinity norm of the general defense perturbation to be below a specified threshold.

[0114] In some embodiments, fine-tuning general defense perturbations may include the following steps:

[0115] For the detected object detection model, evaluate its real-time confidence score in identifying target objects in real-time game screenshots;

[0116] Corresponding to an assessed real-time confidence score equal to or greater than a preset threshold, the following steps are performed based on a set of continuous real-time game screenshots and the detected object detection model to refine the current general defense perturbation to obtain a real-time defense perturbation:

[0117] a') Initialize the real-time defense perturbation used as a model parameter to the current general defense perturbation, and initialize the current proxy visual model to the detected object detection model;

[0118] b') Overlay the current real-time defense disturbance onto the real-time game screenshot;

[0119] c') For the current agent visual model, obtain its confidence score in identifying target objects on game screenshots superimposed with real-time defense disturbances as the prediction value;

[0120] d') Calculate the loss value for the predicted value output by the proxy visual model and its corresponding confidence label, wherein the loss function used is designed to reduce the confidence score (e.g., the loss function when k=1 in formula (3) above), and the confidence label corresponding to each predicted value is set to 0;

[0121] e') Calculate the gradient information of the loss function with respect to the current real-time defense perturbation;

[0122] f') Use the gradient information to update the current real-time defense perturbation;

[0123] g') Calculate the current real-time defense success rate of the cloak maker;

[0124] h') Iterate through steps b') to f') until the real-time defense success rate reaches the preset target value or the loss function converges.

[0125] In some embodiments, the real-time defense success rate is the proportion of instances in which the cloak maker successfully prevents the detected object detection model from identifying the target object.

[0126] Experimental Analysis

[0127] To further illustrate the effectiveness of the active defense system (invisibility cloak) provided in this application, the inventors conducted the following experiments. In these experiments, the defensive performance of the invisibility cloak was compared with that of the most advanced existing anti-attack technologies using popular real-world games such as CrossFire (CF) and Counter-Strike 2 (CS2). Table 1 below shows a description of the datasets collected from CS2 and CF.

[0128] Table 1

[0129]

[0130]

[0131] 1 #Frame: Number of frames;

[0132] 2 #eng.: Number of engagements (30 frames per engagement window);

[0133] 3 #Target: Number of targets detected;

[0134] 4 aTPF: Average number of targets per frame.

[0135] experiment

[0136] 1. System Configuration

[0137] The experimental setup included an Intel(R) Xeon(R) Gold5418Y CPU with 96 cores and an NVIDIA GeForce RTX 4090 GPU with 24.564GB of memory. This configuration simulated a user client, enabling a comprehensive evaluation of defense mechanisms against visual auto-aiming devices.

[0138] 2. Data Collection

[0139] To evaluate the proposed method, two datasets, ACVC-CS2 and ACVC-CF, were constructed. Details and characteristics of these datasets are shown in Table 1. These datasets consist of 72,150 consecutive screenshots from real-world match-3 gameplay, each with a resolution of 320×320 pixels, consistent with the default capture size of the visual auto-aimer. Specifically, the ACVC-CS2 dataset contains 14,820 screenshots from actual gameplay of Counter-Strike 2, while the ACVC-CF dataset contains 57,330 consecutive screenshots from CrossFire. These images were filtered to retain only those recognizable by the visual auto-aimer.

[0140] 3. Proxy Model

[0141] First, a cheating model was simulated using a recent open-source visual autoaiming tool. This tool uses the YOLOv5 family of models, which are anchor-based and widely considered effective object detection models. NanoDet was also considered, standing out in the anchorless category as a lightweight yet powerful object detection model with 5.5k stars on GitHub. Depending on the experimental objectives, specific models from the YOLOv5 and NanoDet families were used as proxy models for different evaluations. The cloak maker's performance on these different models highlights its overall effectiveness and adaptability in proactively defending against visual autoaiming across various detection frameworks.

[0142] 4. General Cloak Training

[0143] Following the aforementioned method, the top 10 widely used detection models from the YOLOv5 family were selected as proxy visual models during the training process, and two general-purpose cloaks were trained on two datasets. During training, it was observed that using more models generally improved the transferability of the general-purpose cloaks. However, conflicts between the loss functions of different models made it impractical to infinitely increase the number of trained models. Therefore, models were selected from the YOLOv5 family to ensure high defense success rates and satisfactory transferability.

[0144] 5. Benchmark

[0145] The cloak maker is the primary mechanism for achieving the invisibility cloak defense capability. Currently, there are no specific defense methods against visual game cheating. Therefore, to rigorously evaluate the effectiveness and efficiency of the cloak maker, its defensive performance was compared with existing state-of-the-art anti-attack techniques such as RayS, DAG, and TOG. RayS and TOG represent black-box and white-box models, respectively, while DAG is highly regarded for its unique approach and outstanding performance. Therefore, comparing the cloak maker with these models allows for a comprehensive evaluation of the solution's efficiency.

[0146] 6. Evaluation Indicators

[0147] When evaluating the cloak maker, a multi-dimensional set of metrics was employed, focusing on efficiency, effectiveness, and impact on player experience. These metrics are crucial for validating the practical applicability of the proposed solution in mitigating visual auto-aiming in game scenarios.

[0148] • Query: The number of object detection model iterations required to generate the cloak is a key indicator of computational efficiency. Fewer iterations indicate a more efficient algorithm, which is crucial for real-time applications.

[0149] • Frames Per Second (FPS): FPS indicates the number of frames per second that the cloak maker can process. A higher FPS means greater efficiency and smoother gameplay. It's important to emphasize that cloaks can be deployed intermittently, and the FPS here refers to the crafting speed of the refined cloak, not the actual game frame rate.

[0150] • Defense Success Rate (DSR): The effectiveness of the cloak maker is quantitatively evaluated by its Defense Success Rate (DSR), which measures the proportion of instances in which the method successfully prevents visual cheating attempts.

[0151] • Structural Similarity (SSIM): SSIM is used to predict the perceptual quality of digital images or videos. A high SSIM score indicates that the cloak's impact on visual quality is negligible.

[0152] 7. Defensive capabilities

[0153] Table 2 shows the performance of different defense methods on the ACVC-CS2 and ACVC-CF datasets, using imperceptible random noise as a baseline to compare the cloak maker with three other existing techniques. Since the random noise is static, there are no frames per second (FPS) or iteration metrics. As shown in Table 2, the random noise exhibits a high SSIM, indicating good visual quality. However, its defense success rate (DSR) is consistently poor across all models and datasets, with most DSRs in the single digits. This suggests that random noise is not an effective defense strategy. The cloak maker consistently achieves 100% DSR across all tested anchor-based cheating models (YOLOv5 variants), while RayS has a significantly lower DSR. Although DAG and TOG show higher DSRs, they do not reach the complete success of the cloak maker. Even when tested on NanoDet-Plus-m (an anchorless model not used for training), the cloak maker exhibits excellent DSRs, comparable to other methods. Furthermore, the cloak maker exhibits superior efficiency, reflected in its high frame rate per second (FPS) and low iteration count. By limiting the number of iterations, the cloak maker's FPS can reach tens of times that of other defense models. This efficiency suggests that directly deploying the other three defense methods in actual gameplay can severely hinder game smoothness, leading to noticeable latency. In contrast, the cloak maker's high FPS allows for the rapid generation of sophisticated cloaks based on generic cloaks, covering most game frames through deployment strategies. Moreover, SSIM results demonstrate that the proposed scheme maintains high image quality. However, the perceptibility of perturbations is not entirely dependent on SSIM; in human visual perception, even small perturbations in individual pixels are more noticeable than large-area noise and consistent perturbations. This explains why RayS achieves a high SSIM score, yet its visualization results are easily noticeable.

[0154] Table 2

[0155]

[0156] *: Anchorless model

[0157] Table 3 highlights the Cloak Maker's superior adaptability for visualization purposes. Different defense models were compared using the same set of object detection models as both proxy and cheat models. While this is a basic transferability test, the table shows that all other defenses besides the Cloak Maker exhibited significantly lower DSR and frames per second (FPS) when tested on YOLO, indicating their inability to defend against even slight model changes. Although RayS achieved 100% DSR on NanoDet, its extremely low FPS required hundreds of queries to find a suitable perturbation, which is impractical for real-world applications. In contrast, the Cloak Maker consistently maintained high DSR and FPS. This performance evaluation demonstrates that the Cloak Maker can ensure real-time defense without impacting game smoothness, providing stealth protection. This contrasts sharply with the other three defense methods.

[0158] Table 3

[0159]

[0160] *: Anchorless model

[0161] 8. Transferability assessment

[0162] Following initial horizontal transferability testing, a comprehensive vertical evaluation was conducted to delve deeper into the transferability of the cloak maker. Achieving high transferability in adversarial attacks, particularly in object detection, remains a significant challenge, and existing methods have yet to achieve substantial success. However, for the specific application of defending against visual auto-aiming, success does not solely depend on perfect transferability; rather, it aims to disrupt the cheater's reliance on the auto-aiming mechanism. In this context, the cloak maker demonstrates commendable performance. Table 4 illustrates the transferability of the cloak maker across different models. The lightest and most commonly used models, YOLOv5n and NanoDet, were chosen as surrogate models to ensure the practicality of the transferability discussion. Since the cloak is trained on an anchor-based visual model, its DSR test results on anchorless cheating models such as Faster R-CNN, RTMDet, and NanoDet are not high, but still acceptable. The observed data indicate that the cloak maker performs well when using YOLOv5n as the surrogate model, achieving an impressive average of 63.67 frames per second (FPS). On the other hand, using NanoDet as a proxy model requires more queries, resulting in lower frames per second (FPS).

[0163] Nevertheless, overall performance remains strong, with an average DSR of 52.71 and an average of 41.62 frames per second (FPS). These metrics highlight the cloak maker's efficiency and portability across different model architectures, demonstrating its potential for a wide range of practical applications.

[0164] Table 4

[0165]

[0166] *: Anchorless model

[0167] 9. In-game stability

[0168] The in-game robustness of the Cloak Maker was carefully examined through three experiments. These evaluations covered its adaptability to various game maps, its effectiveness against single and multiple enemies on screen, and its consistency across different screen resolutions. A series of YOLOv5 models were used to simulate cheating based on popular open-source cheating projects. This comprehensive evaluation aimed to verify the Cloak Maker's reliability and effectiveness in different game scenarios, ensuring its robust defense against visual auto-aiming mechanisms under realistic conditions.

[0169] 10. Robustness in different game scenarios

[0170] In this robustness test, the Cloak Maker was evaluated on 9 maps in CS2 and 7 maps in CF, using three different proxy models for each game. The results (see Table 5) show that all proxy models consistently maintained high DSR levels. YOLOvx6 achieved an excellent average DSR of 99.92% across 16 maps, while the other two models also achieved average DSRs exceeding 70%.

[0171] Furthermore, the cloak maker maintained a stable frame rate of around 30 frames per second (FPS) across all maps. These results confirm the cloak maker's excellent versatility and operational efficiency across various maps and game scenarios in different games.

[0172] Table 5

[0173]

[0174] 11. Performance stability of single / multiple objects

[0175] Table 6 shows the performance of the Cloak Maker in scenarios with varying numbers of visible characters on screen, particularly compared to popular YOLOv5 series models used for cheating. The most robust model, YOLOv5x6, was selected as the proxy model to illustrate the improvements in transferability offered by a powerful proxy model. Similar to game scene robustness tests, the Cloak Maker performed well on all tested cheat models, maintaining stability regardless of the presence of one or more characters. These results demonstrate that the Cloak Maker can consistently function in realistic game scenarios, even in complex multiplayer battles.

[0176] Table 6

[0177]

[0178] 12. Consistency at different resolutions

[0179] In the process of testing the effectiveness of the cloak maker at different game resolutions, it was realized that players use different settings in actual gameplay. By adjusting the image size to simulate different screen resolutions, and using 320×320 as a baseline, the defensive capabilities of the cloak maker were rigorously tested.

[0180] The results (see Table 7) show that the cloak maker maintains its performance without significant degradation, regardless of whether the resolution is above or below the baseline.

[0181] It is worth mentioning that the proposed solution demonstrates enhanced performance in image magnification scenarios, surpassing its performance in magnification environments.

[0182] Table 7

[0183]

[0184] *: Baseline resolution

[0185] 14. The impact of the proxy model and the universal cloak

[0186] First, we discuss the impact of the generalized cloak and different local agent models. Since the scheme in this application is based on successfully defending against agent models using the invisibility cloak, the generalization of the local model is crucial in this application.

[0187] Table 8

[0188]

[0189] *: Anchorless model

[0190] Game cheaters prefer to use powerful and widely used lightweight models, such as YOLOv5n. Therefore, this model was used in the experiments to simulate cheating. As shown in Table 8, the investigation employed various proxy models to compare their performance with and without the universal cloak. The results show that the presence of the universal cloak consistently enhances the performance of all evaluated models, highlighting its importance in defense methods. Furthermore, when the proxy model has an architecture similar to the cheating model, such as the YOLOv5 series, the proxy model generalizes better. Additionally, it can be inferred that using a more powerful proxy model can achieve better transmission defense; for example, the transmission performance of YOLOv5x6 is superior to YOLOv5x in the table. Therefore, the results indicate that when selecting a proxy model, model series that cheaters are more likely to choose and more powerful models should be selected to obtain better stealth performance.

[0191] 15. Initialization

[0192] Since the refinement process must be completed in real time, these hyperparameters have a significant impact on the final performance.

[0193] First, the maximum number of iterations during the refinement process was considered. When encountering adverse situations, an increase in the maximum number of iterations correlated with an increase in the duration of defense (although results from Tables 2 to 7 show that in most cases, only 1-3 iterations are needed for successful defense). Two proxy models with different architectures and the same cheating model were selected. For example... Figure 3 As shown, setting an upper limit of approximately 5 iterations ensures a near 100% defense success rate (DSR) while maintaining a high frame rate per second (FPS). Further increasing the number of iterations results in a slight improvement in DSR, but at the cost of a decrease in FPS. Therefore, if the minimum DSR requirement is met, it is recommended not to excessively limit the number of iterations to prevent diminishing returns. The impact of the learning rate α on cloak refinement is then discussed. YOLOv5n is chosen as the proxy model, and YOLOv8n as the cheat model without a universal cloak. A fixed number of iterations of 20 is used, without early stopping, to more clearly demonstrate the impact of the learning rate on DSR. Figure 4 As shown, the results indicate that a learning rate of 0.1 or 0.005 is appropriate. The reason for choosing 0.005 as the default value is to minimize the size of the cloak so that it is imperceptible without affecting the DSR.

[0194] 16. Noise Amplitude

[0195] Typically, noise below 8 / 255 epsilon(ε) is not easily detected by the human eye in RGB images. In the ablation experiments, different cape epsilon values ​​were set as defined in Equation 1. Figure 5This study demonstrates how variations in the maximum l∞-norm constraint (ε) of the cloak affect DSR and frames per second (FPS) on the AVCA-CF dataset. While larger cloaks result in higher DSRs, this also means a greater impact on image quality. Maintaining a satisfactory FPS requires ensuring a stable DSR and that the cloak is imperceptible to the player. In this experiment, YOLOv5n was chosen as the proxy model, and YOLOv8n as the cheat model without a universal cloak. The number of iterations was fixed at the default value of 5, and an early stopping criterion was set. The results show that setting ε to 8 / 255 is more suitable, resulting in a sufficiently high DSR without a significant decrease in FPS. Notably, when ε is set to 16 / 255, the DSR of the transferred defense actually decreases, meaning that a higher ε does not necessarily improve the cloak's transferability.

[0196] 17. Adaptive Attack

[0197] First, a simple experiment was conducted to evaluate its robustness to random noise by adding it before and after the Cloak of Invisibility. As shown in Table 9, it demonstrates that random noise has less than 5% impact on the DSR. In most cases, the Cloak maker maintains a DSR of over 95% while achieving satisfactory frames per second (FPS) and query performance.

[0198] Table 9

[0199]

[0200] *: Anchorless model

[0201] Furthermore, further adaptive attack evaluations were conducted. The visual autotargeting model was fine-tuned on the dataset, and adversarial training was performed on the fine-tuned model using protected samples to simulate the cheater's resistance. Adversarial training was performed using 20% ​​of the dataset because it was assumed that the cheater collected significantly fewer samples than the protector. As shown in Table 10, adversarial training reduced the DSR by less than 20% on the AVCA-CS2 dataset, but it failed to breach the defenses on AVCA-CF. This is because CF has simple scenes and consistent graphics, resulting in only a limited improvement in the robustness of the cheating model after adversarial training. The DSR was slightly below 100% when ε = 8 / 255 on the AVCA-CF dataset. This can be attributed to the fine-tuning, which improved the performance of the cheating model, leading to more challenging situations for the cloak. However, the simple scenes in CF conflict with the adversarial samples, allowing the DSR to reach 100% after adversarial training.

[0202] Table 10

[0203]

[0204] + The model has been fine-tuned;

[0205] AT: Model that has undergone adversarial training.

[0206] Case Studies

[0207] 1. The detailed process of developing the invisibility cloak

[0208] Firstly, through Figure 6 The demonstration visualizes the refinement process of the invisibility cloak. While the deployment of the universal cloak enables real-time defense with zero latency, certain adverse situations still require iterative refinement of the cloak. Therefore, after creating the universal cloak, the refinement process is crucial for practical applications. Figure 6 This process is visualized; it shows that, through refinement, the confidence score of the bounding box of the target in the image continuously decreases until the cheating model can no longer detect it. Next, we discuss how to create a cloak for the input game frame. To achieve this, we reduce the confidence score of the bounding box of the target in the detected frame by minimizing the loss function (Equation 3). Figure 7 This demonstrates the reduction in losses during the cloak search process. Figure 7 The symbols in the figure represent successful defenses by YOLOv5n and YOLOv8n in the 2nd and 7th iterations, respectively. The number of iterations was fixed at 20, with no premature termination. In the experiments, it was observed that among all samples that successfully defended against YOLOv8n, only one sample had been defended against before YOLOv5n, accounting for less than 1% of the total. This demonstrates the difficulty of using white-box gradient information to defend against unknown models. Although multiple commonly used white-box cheating models can be used to design loss functions and jointly construct gradients, the forward and backward overhead in these additional models is impractical for real-time defense scenarios. Therefore, in this application, the generalized cloak effectively addresses the challenge of generalization.

[0209] 2. Perspective of normal / cheating players

[0210] Figure 8 Visualization examples of different methods under the l∞ norm constraint of ε = 8 / 255 are presented in a real-world game scenario. It can be observed that different methods produce different visualization results despite having the same constraint on individual pixel perturbations. In particular, although RayS has a higher SSIM, as shown in Table 2, it exhibits similar perturbations over a large area, making them more noticeable to the player. While our proposed scheme does not outperform other methods in the SSIM evaluation metric, the stealth effect of the invisibility cloak is evident from the figures.

[0211] 3. Actual Impact Analysis

[0212] A paid, anonymous survey was conducted in the form of a questionnaire to assess the indistinguishability and naturalness of cloak-protected game scenes (randomly selected from a subset of the experimental data). The data used consisted of cloaks refined according to the aforementioned criteria. All 122 participants were over 18 years of age, and 80% had experience with shooting games. Best practices for ethical human subject surveys were followed, and no unnecessary personal information was collected. Preliminary findings suggest that it is difficult for individuals to determine whether a cloak has been added to a game scene.

[0213] This study included two types of tasks to assess the indistinguishability of the protected game screen. The first task involved a binary choice, where participants were asked to select a realistic game scene from two options: one with a cloak, and the other without any modifications. The overall accuracy for this task was 47.87%, below the 50% random guess threshold. The second task required participants to judge the realism of pairs of game scenes, with four possible combinations: both true, both false, and one true and one false (in any order). The overall percentage of correct answers was 23.77%, below the 25% random guess threshold. This indicates that participants could not perceive the cloak, thus demonstrating its indistinguishability.

[0214] The naturalness of protected game screens was assessed using a task to select the naturalness of game screens. Participants were asked to choose the naturalness of a randomly selected screen (original screen and protected screen) from five options, such as... Figure 9 As shown.

[0215] The Pearson correlation coefficient between the original frame and the protected frame was 0.983 (p = 0.0027 < 0.05). This provides strong statistical evidence that the correlation between the original frame and the protected frame is not accidental, illustrating the naturalness of the cloak.

[0216] Furthermore, multiple-choice questions were used to assess participants' perceptions of the reliability of the cheating. Only 9.3% of participants would continue using the visual auto-aimer when the success rate was below 70%, while 27.8% indicated that the accuracy needed to be at least 90%. These findings highlight the importance of auto-aimer accuracy to users, suggesting that even minor performance deviations can lead to user abandonment.

[0217] 4. Real-world effect verification

[0218] Evaluating this application in a real-world scenario involves activating a visual autoaiming device in a real game match. To address ethical concerns and control variables, a video source was used instead of implementing a state-of-the-art visual autoaiming device directly in the game. Two of the most effective settings were selected from all common cloak configurations in CS2 and CF. These settings were pre-trained using different YOLOv5 combinations and overlaid onto corresponding real-time game video sources for real-time validation.

[0219] Table 11 shows the two open-source, real-world full-game video sources used for evaluation: CS2 and CF. This additional dataset is completely different from the previous evaluation dataset. In this experiment, over approximately 39.5 minutes of CS2 gameplay and approximately 29.4 minutes of CF gameplay, thousands of aimbot and auto-aiming detections were reduced by three orders of magnitude. By using an invisibility cloak, aimbot and auto-aiming detections were controlled to single digits, effectively preventing visual cheating.

[0220] Table 11

[0221]

[0222] 1 #Detection: Target the number of times the robot has successfully detected something;

[0223] 2 #Auto-Aiming: The number of times the aiming robot has successfully aimed automatically.

[0224] The above experiments demonstrate the following beneficial effects of the machine learning-based method for protecting players from visual game cheating provided in this application:

[0225] 1. The invisibility cloak can actively block visual auto-aiming devices that existing anti-cheat methods cannot solve, preventing the auto-aiming devices from accurately identifying game targets, thereby ensuring the integrity of the game without affecting legitimate gameplay.

[0226] 2. Real-time performance and scalability: This application minimizes the impact on game performance, provides real-time protection, and can be effectively scaled across different game settings and player groups, adapting to the dynamic characteristics of the game environment.

[0227] 3. Non-intrusive implementation: Unlike most traditional existing anti-cheat methods, this application does not require monitoring the user process. Instead, it integrates with the normal game rendering process, overlaying the generated cloak onto the player's display device, thus achieving non-intrusive defense.

[0228] 4. Versatility: This application provides a universal defense mechanism across multiple FPS games to defend against visual auto-aiming devices, demonstrating its good adaptability and effectiveness.

[0229] 5. Non-visible protection: Experiments show that the method of this application can effectively protect players from visual auto-aiming devices without compromising visual quality or real-time performance, thus not affecting the gaming experience.

[0230] Although this application has been described through preferred embodiments, it is not limited to the embodiments described herein, and various changes and modifications are included without departing from the scope of this application.

Claims

1. A method for protecting players from visual auto-aiming cheats in video games, comprising: Capture each frame of the video game; Pre-generated generic defense perturbations are superimposed on each acquired frame, and the frames superimposed with generic defense perturbations are presented to the video game player; The general defensive perturbation superimposed on each frame is visually invisible to the player in the video game and prevents the object detection model in the visual auto-aiming system during video game runtime from recognizing the target object.

2. The method according to claim 1, further comprising: An object detection model for detecting visual auto-aiming devices running in video games; The general defense perturbation is fine-tuned based on the detected model to obtain real-time defense perturbation; as well as The real-time defense perturbation is superimposed on the captured video game frames and presented to the video game player.

3. The method according to claim 1 or 2, wherein the universal defensive disturbance is generated by training the cloak maker through the following steps: a) Obtain a set of consecutive game screenshots and multiple proxy visual models and initialize the initial general defensive perturbation, which serves as a model parameter, with random noise, where the different proxy visual models represent different types of object detection models that can be used with the visual auto-aiming device; b) Overlay the current general defense perturbation onto each game screenshot; c) For each agent visual model, obtain its confidence score in identifying target objects on a game screenshot superimposed with general defense perturbations as a prediction value; d) Calculate the loss value based on the predicted value output by each agent visual model and its corresponding confidence label, wherein the loss function used is designed to reduce the confidence score, and the confidence label corresponding to each predicted value is set to 0; e) Calculate the gradient information of the loss function with respect to the current general defense perturbation; f) Update the current general defense perturbation using the gradient information; g) Calculate the cloak maker's defense success rate; h) Iterate through steps b) to g) until the defense success rate reaches the preset target value or the loss function converges.

4. The method of claim 3, wherein the confidence score for identifying the target object for each proxy visual model is the probability that the proxy visual model contains the target object in the bounding box generated in the game screenshot.

5. The method of claim 3, wherein the defense success rate is the proportion of instances in which the cloak maker successfully prevents the proxy visual model from recognizing the target object.

6. The method of claim 3, wherein in step f) the current general defense perturbation is updated based on the learning rate and truncation function of the cloak maker and gradient information, wherein the truncation function is used to constrain the infinity norm of the general defense perturbation to be below a specified threshold.

7. The method of claim 3, wherein fine-tuning the general defense disturbance comprises the following steps: For the detected object detection model, evaluate its real-time confidence score in identifying target objects in real-time game screenshots; Corresponding to an assessed real-time confidence score equal to or greater than a preset threshold, the following steps are performed based on a set of continuous real-time game screenshots and the detected object detection model to refine the current general defense perturbation to obtain a real-time defense perturbation: a') Initialize the real-time defense perturbation used as a model parameter to the current general defense perturbation, and initialize the current proxy visual model to the detected object detection model; b') Overlay the current real-time defense disturbance onto the real-time game screenshot; c') For the current agent visual model, obtain its confidence score in identifying target objects on game screenshots superimposed with real-time defense disturbances as the prediction value; d') Calculate the loss value using the loss function for the predicted value output by the proxy visual model and its corresponding confidence label; e') Calculate the gradient information of the loss function with respect to the current real-time defense perturbation; f') Use the gradient information to update the current real-time defense perturbation; g') Calculate the current real-time defense success rate of the cloak maker; h') Iterate through steps b') to f') until the real-time defense success rate reaches the preset target value or the loss function converges.

8. The method of claim 7, wherein the real-time defense success rate is the proportion of instances in which the cloak maker successfully prevents the detected object detection model from identifying the target object.

9. A system for protecting players from visual auto-aiming cheats in video games, comprising: A cloak maker is used to acquire each frame of a video game to be displayed, overlay a pre-generated universal defense perturbation onto each acquired frame, and send each frame with the overlaid universal defense perturbation to the display device. The universal defense perturbation overlaid on each frame is visually invisible to the player of the video game and makes the object detection model in the visual auto-aiming system of the video game unable to recognize the target object. Display device for displaying each frame processed by the cloak maker.

10. A computer-readable storage medium, characterized in that, It stores a computer program that, when executed by a processor, implements the method of any one of claims 1-8.

Images