ZK14 - ZK-AntiCheat: a novel approach for video game anti-cheat software - Khaled Suliman

Transcript

Uh welcome everyone. Today I'm going to speak about game verification in ZK. So, uh whenever you play an online competitive game, there's like uh special software running in your kernel, highly privileged. You cannot audit it. You cannot see what it's doing. And I think as crypto people we have a word for that, it's called a spyware. You do You cannot really see anything. And after all the privilege you give it, everything you everything and still gets bypassed and sometimes it's abused against players. Sometimes you could actually get banned from the game for no reason. Sometimes some malware groups use it to to drop malware through in through the anti-cheat because it can bypass the antivirus software.

So, I took the uh the threat model the existing threat model of the anti-cheat and I said, "Okay, we don't need really need to give it that much privilege cuz we already have some technologies to verify things." And the [snorts] the attacker can owns the machine. So, they can tamper the memory, they can craft a new state within the game, but they cannot really break cryptography, they cannot create something outside of the existing game logic. So, the insight here is that the that means the game code cannot change. So, the game binary has some static fields. So, the textures, the logic is always intact. There are things like the player can only be on the map.

It cannot has the NPC cannot have a health between zero more than 100 cuz it's defined within the game. So, we have the range range checks. And generally if we treat the game as a as a deterministic thing, so uh legitimate gameplay falls a probabilistic uh way of going. So, you only have a finite set of things you could do. Uh cheating is a is actually a deviation from the state machine. So, we treat the game as a state machine and you could see for example, when you teleport, it's not possible to jump more than 10 steps at the time in one frame.

So, we can extract those predicates from the game, so the static checks, the bound checks, and the state transition from previous state. And I applied it on speed running. Why speed running? Because speed running has this offline thing, so you actually make the submission. Usually you have a video, and you submit your clicks, and some moderator somewhere has to go through that manually. And the good thing is that it's done offline, so I don't really need to be simultaneously. I could do it after a week. So, someone could publish the game, and they can commit to that to some hashes, and then they can publish the proof later on.

And that's what I did. So, basically first we take the snapshot of the RAM, and we create a Merkle tree out of it. And then we publish inclusion inclusion proofs, which are like that the static code is the same. Some bounds, so then we have to make public openings, which correspond with the with the video, so like the position, the score, the health, so such things. And then you could publish the full proof of the trace. So, given that we're publishing a proof every second or so, we have to aggregate that. So, you could use a recursion, but that's really heavy.

I It wasn't really that important that's helpful for me. It It's better to just go with a consensus thing on chain because you could just publish like batch 20, 30 transactions a second. Especially with L2s. So, the first case study was NES games because they're very simple. The address space is very small, so it's like 64 64 kilobytes. And the proof was the proof time was 3 seconds, and were for static checks was 1.8 seconds. That's really good. And for the next case study is that Okay, now we look at the game industry, we say we're saying, "Okay, that sounds ridiculous that you're running some unconstrained code. You don't know what it's doing, but a lot of us are doing

that right now. We're running some AI agents in the background, and we don't know what it's doing. So, I was benchmarking the game with Factorio game with some AI models, and I was using the agent Codex. And if you have played Factorio before, to reach you're supposed to craft some things and launch a rocket, but that takes 40 hours. The LM did it in like four steps, and I was like, that's impossible. You ask the LM and it says, I did this and that. It doesn't make sense at all. So, when I looked into it, I realized that the LM actually found the unpatched unpatched API method and was able just to spawn the rocket in there.

And that's really ridiculous. It invalidates most of the benchmarks done there. I don't know if the other people who published the benchmarks actually checked into this. And the the LM log somewhere in there it was like, yeah, it already exposed this thing, why should I bother with that? And the anti-cheat was able to catch it with the predicates because it just came out of nowhere. So, uh how does the circuit architecture look? Uh it's just uh sat check. So, basically we have some predicates, we apply the witness on them. So, we have public predicates of the game. So, we define what the game what the what an actual legitimate gameplay would should be. So, we have some consensus with among the community. And you just have to publish uh a private witness with a proof. So, this can be done with an MPC, you could do it

locally, you could do it on the server side. Since it's speed running or a video submission, you don't really care if it's done at the same second. Okay. So, where did I apply this in practice? So, right uh for the past few months, I was working with Catecon, and we have an AI agent live streaming games and sometimes trading on chain. And uh it's your personal AI streamer, in fact. And we hit this problem in production because we have sometimes like the Factorio instance, I could actually like eyeball it, but when we have thousands of sessions and those all of those AI agents, I you actually need an anti-cheat in there or something like that. And that's where I'm I'm applying the software.

Yeah, and that's that's that's about it. Thanks everyone. >> [applause] >> Okay, you were faster than anticipated, but it's a very cool use case. Do I have any question in the room? Cuz we do have a lot of time. So, for a speed running So, for a speed running, uh this is more like proof of task, right? In the sense that you cannot prove that a human actually pressed the buttons in this way. You can prove that that there is a sequence of buttons that leads to this result.

>> Yeah, effectively with a task you're just playing a game, like it's really I don't know, some human could click those buttons, but Well, Yeah, [laughter] but it's usually a machine in some cases. Yeah, it's very hard to verify. Even the regular anti-cheats, they don't. So, >> of task is also cool. Yeah. Any questions? Yes. Any Any idea how to extend this to games with hidden information?

Where, like, for instance, if you if you have a bot playing Counter-Strike, you don't want it to be able to see through walls. Yeah. Uh that that there is called with the static checks. So, you check that textures are not overloaded because in those hacks you overload textures with something else, which you can see through. >> you can still input you can still Like your witness can still depend on state that shouldn't be accessible to to the player. Yeah, well, in that case, that's the same case for the normal anti-cheat. Yeah. But they they usually like prevent you from like inspecting memory, right? You're not allowed to like attach to a process.

>> thing is that there are a lot of documented hacks. So, some people run it in a VM, and then you could just outside of this layer modify things. Okay. Yeah, it's really Yeah, it's really broad range of things. >> Yeah, I thought that wasn't a kernel level thing there to prevent like exactly this kind of Yeah, but you don't see what it's doing. You can run this, but you actually know what it's doing, at least. That's the point. Is that you could run this in your kernel, you know what it's doing. That's the point. Okay, thanks. Thanks. Yes.

So, you said that you're mainly using it like offline, but how well does it scale and could it be used like live like during the gaming? So, during the gaming, the design would be that the state you would submit it to an MPC protocol or a real-time server. So, you have to trust that. You You have to sign it. So, in the real protocol, I used to sign the memory state and send it to a server and I just trust the server that what I intended it to do. So, you could use it. The benchmarks are done on regular hardware, so just on my laptop. So, on a server it could scale pretty much a lot.

Are there any more questions for Khalid? Come on, guys. It's games. You should have plenty of questions. Oh okay. Just needed to push you a bit, yeah. Is there Is there a way to prevent like if we look at like CS:GO wall hacking, like is there a way of you know, even if the player still using correct sequence of moves and doing that correctly, are they reading values that they're not supposed to to to see other players, for example?

Yeah, so the thing is that you cannot really know about such a thing. It's like I could have a camera reading through things. So, some attacks that I said, you have a virtual machine running the game and you inspect the memory of the virtual machine. How could you detect that? I could actually inspect the hardware memory within the game. It's like how There's actually It's a It's an open topic and the things that most anti-cheats that you have out there proprietary ones they're they're just there. All of them are just they're just to have a higher level. So that's the the basic people won't be able to bypass them but if you're skilled enough you could bypass them.

Great. Thank you. How would you catch people cheating for example for speedruns where A lot of things depends on how the map is generated at the beginning. So for example how would you catch somebody that takes a map that he already knows to get an advantage of that? If that's something you thought about. So usually with a speedrun sometimes you have a specific seed so like with Minecraft you have a specific seed which you would brute force. In that case we would have the the since we generate a Merkle tree at the beginning you could check the inclusion proof that this is the this type of map is being used. So they have to publish

which map they used. So if it's a random one we should so instantly we should use that and then we check that the static regions match what we intended to be. Thank you very much Khalid.