Lyphere builds detection systems for the places where hardware and software lie about themselves — and the evidence that still holds up after the ban.
How detection works
A cheat can hide itself. Its behaviour cannot.
Rules across combat, movement, entities, integrity, identity, native calls and connection. Input timing and combo shape. Origin classification against a VPN, datacenter and Tor corpus. Hardware-token correlation that links accounts a player believes are separate.
A suspicion is not proof. We store the proof.
Every trigger writes a case: which signal fired, the values that fired it, when, and how long it is kept. Exportable and reviewable — because the moment a ban is disputed, a score is worth nothing and a record is worth everything.
No account is ended by a language model.
The model summarises and correlates; it does not decide. Thresholds, escalation and enforcement mode are set per rule, and anything terminal is confirmed by a person. Fewer false positives, and an operator who can explain every decision they made.
Product
Anti-cheat for FiveM servers. Rule engine, evidence store, cross-server ban context, self-hosted analysis.
Where this applies
Anti-cheat is the hardest school detection has: adversaries with kernel access who iterate daily. The discipline that survives there — signal, evidence, verdict — transfers to any field where systems are manipulated for advantage. We build each deployment to fit its field: its own signals, its own thresholds, its own evidence model.
The proving ground. Cheat developers ship like a software company — detection that survives here survives anywhere. This is where hoaxeye runs.
Multi-accounting, ban evasion, resold access. Hardware-token correlation links the accounts a user believes are separate — without trusting anything a spoofer can cheaply rewrite.
Scripts hold intervals no hand can hold. Input timing, action shape and session rhythm separate automation from people, even when every request looks legitimate on its own.
Fake engagement, review rings, marketplace manipulation. Coordinated inauthenticity leaves statistical traces no single account reveals — the pattern is the evidence.
Where manipulation happens
Rewriting what user space reports is cheap and widely tooled. A check that only reads the value a process hands it is checking the attacker's own answer.
A signed driver can reshape firmware tables, storage serials, GPU UUIDs and NIC identity into one coherent fake machine. Detection has to compare layers against each other instead of trusting any single one.
A CPU-enforced boundary the guest cannot see past. What stays observable is behaviour: timing, topology, and combinations a real machine would never report.
Legacy rings 1 and 2 go unused on modern operating systems — the boundaries that matter are −1, 0 and 3. Every layer above a manipulated one inherits the lie, which is why coherence across layers is the most durable signal there is.
Reverse engineering
Every rule we ship started as someone opening an artifact and finding out what it really does. That work does not stop at the software we defend — it runs on the software that attacks it, and on products we are asked to examine. Defects we find in someone else's code go to that vendor first.
Reading the shipped artifact instead of the changelog. Imports, control flow, and the structure a build keeps no matter how it is packed.
a signature that outlives a recompile
What a client and a server actually say to each other, against what the documentation claims they do. Field semantics, ordering, and trust placed in values the client controls.
the frame a real client never sends
What a process does while it runs: call sequence, allocation pattern, threads, timing. A build can lie about what it is; it has a much harder time lying about what it does.
behaviour that contradicts the binary
Where privilege, authentication and input validation are enforced — and where they were only assumed. The serious findings are rarely clever.
the check nobody ran
Most of this feeds our own detection. Some of it is done for other people's software — if you need something taken apart by someone who hands you the report and keeps nothing, talk to the engineer →
Language models in the loop
In our pipeline the model holds exactly one seat: it summarises cases and correlates evidence — it never decides. That seat has hard requirements: structured output that parses every time, context long enough for a full case, a price that survives thousands of cases, and a fabrication rate that never invents evidence. Rated for that seat only — not a general ranking.
Our seat rating, 0–5 — engineering judgment against the criteria above, not a benchmark.
Dependable structured output and room for any evidence bundle, at a price that survives case volume.
The economical seat for routine cases; complex cross-case correlation gets escalated to a larger model.
Mid-tier of the July 2026 family: reliable schema-bound output at case-volume prices.
Flagship reasoning earns its price on the hardest correlation work — not on every routine case.
Strong and well priced, but still labelled preview — an evidence chain wants a track record first.
Open weights keep evidence entirely in-house; the trade is serious GPU capacity and self-managed reliability.
Sparse experts with 17B active weights: economical to serve, but summaries of dense evidence drift. Seat-specific — fine elsewhere.
Priced for volume, but a summariser that can invent a detail is a liability at any price. A fabricated fact costs more than the tokens saved.
Who we are
Lyphere is a detection-engineering company. We come from low-level work — the layers where hardware and software can be made to lie — and from anti-cheat, the most adversarial school detection has. What it taught us: a detection system you cannot explain is a liability wearing a dashboard.
Research
When you cannot inspect a process, you still have timing, input and call sequence. What that leaves you with is statistical — and why that is a feature, not a compromise.
Serials, UUIDs and firmware tables can all be rewritten. Keeping them consistent with each other is much harder than faking any one of them, which is where detection gets its footing.
Server operators, studios and security teams. No sales team and no discovery call — you reach the engineer.