Combining everything #TeamRICOCHET has developed over the course of the last three years with new Machine Learning advancements, RICOCHET: Anti-Cheat™ is preparing for the launch of Call of Duty®: Modern Warfare® III with a stronger and faster process to combat cheating.

Machine Learning, in combination with client and server-side systems that continue to evolve and grow, helps advance both the speed and accuracy of our prevention techniques and detection systems.

How Does #TeamRICOCHET Use Machine Learning?

Machine Learning advancements have been integrated into our tech to help with efficiency and speed in prevention, detection, and removal of cheaters. Machine Learning advancements enhance our team’s ability by:

• Examining client and server data to find new cheat behaviors
• Issuing account challenges to validate abnormal behavior
• Collecting and collating problem accounts for action

In short, Machine Learning helps us anticipate behavior better and operate with more effectiveness, with our team validating for accuracy.

Machine Learning works in concert with our team, providing information to make account decisions – but Machine Learning systems do not issue bans.

Machine Learning also helps enhance existing tools. One example of how we’re using Machine Learning to accelerate our anti-cheat capabilities is with the Replay tool.

Machine Learning x Replay Investigation Tool

Earlier this year we announced a replay investigation tool that captured gameplay data so it could be converted into video internally, allowing our teams to review player matches for problem behavior. This tool has been beneficial since it launched, but the team wanted to drive toward a new goal: Speed.

On average, a #TeamRICOCHET teammate could review somewhere in the ballpark of 700 replay clips in any given day.

Some clips are easy: the most egregious “rage hacking” is simple to spot, but the Replay Investigation Tool was helpful to identify hackers who used tools to give them a slight advantage that was harder to spot in-game, such as wall hacks.

For the launch of Modern Warfare III – and across all titles protected by RICOCHET: Anti-Cheat – the #TeamRICOCHET team is activating Machine Learning processes to increase the efficiency and strength of our anti-cheat efforts.

For the Replay Investigation Tool, a Machine Learning model is trained to identify suspicious behavior like wall hacks or raging (plus many others), and immediately prioritizes and alerts the team to review the issue for account action. A single PC running the model can review up to 1,000 clips per day – a number that grows exponentially when multiple computers are tasked with operating this specific Replay Machine Learning Investigation model.

We’re just getting started on Machine Learning integration for the Replay Investigation Tool, but we’re excited to see how it evolves over time. A major focus for this and many advancements is Ranked Play modes across our titles, combating anyone attempting to jump the ranks of the leaderboard unfairly.

This is one of the many ways Machine Learning helps identify and prioritize issues for our team, allowing Team Ricochet to develop new prevention strategies, detection techniques, and mitigations.

Say Hello to Splat

Often when a cheater appears in a match they are immediately kicked from the experience. Sometimes, as we’ve discussed in the past, we issue mitigations to minimize their impact privately to keep them in the game so we can absorb all the information we can about the account and the machine used to cheat. Cloaking, Damage Shield and more will return in Modern Warfare III multiplayer and continue to exist in Call of Duty: Warzone.

While we hesitate to call it an in-game Mitigation – because it’s immediately obvious when it happens – we have developed a new trick for cheaters going forward in Call of Duty: Warzone: We call it Splat.

With Splat, if a cheater is discovered, we may randomly, and for fun, disable their parachute sending them careening into the ground after they deploy.

But what if we catch them after they’ve deployed? Well, Splat can also adjust player velocity, which transforms a bunny hop into a 10,000-foot drop taking them out instantly. This is one of many new tricks we’ve developed – and we’ll talk about more in the future.

Like all mitigations, Splat won’t randomly turn on for a player that isn’t verified to be cheating. Player reporting won’t turn it on, and the game can’t accidentally activate it.

As important as it is for us to continue to fight on behalf of all our players – which includes us – we know that part of the confidence you have in our systems is when you can see them working to protect your experience in real-time. Visuals are important to our players and that’s why a few months ago we added the RICOCHET Anti-Cheat logo to the kill feed, so players could see the system protecting them in real-time. Mitigations do this too.

While it’s fun to annoy cheaters that make it into games, our aim is to prevent them from ever getting near a match. Prevention is key to the continued evolution of RICOCHET: Anti-Cheat.

Anti-Cheat Prevention Systems

Cheaters are always looking for easy ways to get into the game, and stealing accounts is one of the ways they do this. Securing your account by enabling 2FA is important, as is making sure you are not reusing passwords for your Activision ID that you would for other apps or websites. Reusing passwords on other apps or websites in connection with your email can open the door to your account being stolen.

In 2023, our teams were able to identify over 110,000 player accounts on the dark web that were parsed from reused email and password combinations. We have since reset these accounts, returning them to their original owners to prevent these accounts from falling into the wrong hands.

Learn how you can enable 2FA on your Activision ID

In the lead up to Modern Warfare III’s launch, #TeamRICOCHET has banned over 80,000 accounts across Call of Duty: Warzone and Modern Warfare II, barring these accounts from accessing Modern Warfare III. 

Another important piece of this prevention puzzle is our game code obfuscation and encryption. To play Call of Duty, we send each player the game code (via the game executable) to experience the game. When we send out the game executable, which contains detailed instructions for how our game works, we are essentially sending out copies of our house keys. Imagine trying to keep a bad guy who has copies of your keys from breaking into your home.

To make it harder to unlock the front door, the RICOCHET Anti-Cheat teams are constantly working on new obfuscation techniques to make the game code harder for bad actors to analyze. We then encrypt (or digitally lock) the entire Call of Duty executable, so it is much harder to tamper with. This makes it more difficult for the cheat developers to analyze and modify our code and remove our protections.

This is the ebb and flow of anti-cheat security.

When we take steps to stop cheaters, they readjust their process and look for new opportunities. The nature of multiplayer games, where our systems (the server) exchanges information with your computer (the clients) to make the multiplayer action happen, is how cheating can occur. Our anti-cheat efforts tackle each touchpoint of this trust process, from client to server-side systems and enhancing those process with Machine Learning to combat unfair play.

How We Use Player Reporting

A common misconception we see is that spam reporting will result in actions being taken against accounts. For clarity, whether one player reports another once or multiple times, our system only considers the first report (throttling any additional reports from that player).

Reporting is critical but, must be used in combination with other factors before an account is actioned on. An account, for example, cannot be banned due only to reporting but if that account has also triggered other (and multiple) detections, a report can raise a red flag.

A reminder that spam reporting may be considered in violation of the updated Security and Enforcement Policy regarding “Malicious Reporting,” established earlier this year.

As players of our own game – and other online multiplayer experiences – we too are disrupted by cheating issues. Our team is dedicated to using all technologies, providing our team with more data and tools, developing new prevention and detection systems, and doing anything we can to make the lives of cheaters that make it into our games as annoying as possible.

It's a continuous battle, but it’s one we’re committed to.

© 2023 Activision Publishing, Inc. ACTIVISION, CALL OF DUTY, CALL OF DUTY WARZONE, MODERN WARFARE, and RICOCHET Anti-Cheat are trademarks of Activision Publishing, Inc. All other trademarks and trade names are the property of their respective owners.

For more information, please visit www.callofduty.com and www.youtube.com/callofduty, and follow @Activision and @CallofDuty on X, Instagram, and Facebook. For Call of Duty Updates, follow @CODUpdates on X.