Original title: You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers
Santosh Gokul Narayanan, Giovanni Paladino, Chuqi Zhang, Sangho Lee +2 · September 2026
To stop cheating in competitive video games, companies often install anti-cheat software deep inside your operating system at the kernel level. This privileged mode gives the software extreme access, raising serious privacy concerns because users cannot verify what it does. Researchers built Tirith to protect user privacy without making anti-cheat worse. Tirith runs games inside Protected Virtual Machines, which are isolated digital environments that keep the game safe from untrusted computer administrators. To watch for cheats outside this isolated box, like bad drivers, Tirith uses a virtualization monitorA small, privileged layer that creates and runs virtual machines; Tirith uses it as a trusted observer of the outside system. that both players and game creators trust. Because normal virtual machines struggle to run games well, the team added a security-focused Library OSAn operating system designed as a library, so a program gets only the system services it needs, which can be more secure and lighter than a full OS. kernel and a graphics sharing pipeline. Tirith matches the protection of traditional kernel-level anti-cheats against common cheats, keeps graphics performance near-native, and ensures user privacy is respected on personal computers.
You rent a flat and the landlord wants to make sure you are not damaging it. The usual arrangement gives the landlord a master key to every room so they can check anytime; it works, but it means they can also read your private mail. Here the game sits in the sealed flat, and a neutral warden — trusted by you and the landlord — watches only the shared hallway, so safety no longer depends on handing over the master key.
Competitive gamers must often install kernel-level anti-cheats that run with the highest system privileges, meaning a game company gets code that can inspect anything on the PC. This design removes that need entirely: the game is isolated inside a protected virtual machine and a mutually trusted monitor watches for cheating. Players regain control over their own machines without weakening cheat detection.
The abstract doesn't say how Tirith performs in a deployed game or against advanced cheating techniques; it only claims parity with current anti-cheats for 'common' cheating mechanisms. It also calls out that existing VM software stacks are not designed for games and create major security/performance problems, so the proposed Library OS and graphics pipeline still need validation.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers — Santosh Gokul Narayanan, Giovanni Paladino, Chuqi Zhang et al.
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.