CypherX Interactive Spheres Hosting LLC

Platform Security for Roblox experiences

AXIOM Anticheat.

A server-authoritative protection layer for Roblox. AXIOM treats the client as untrusted, re-validates the state that matters, and scores what's left against how your players actually behave.

Enquire about licensing How it works

Design principles

Built on three assumptions.

AXIOM exists because our own games needed it. Every design decision follows from what actually breaks live Roblox experiences.

ASSUMPTION 01

The client is hostile

Anything running on a player's machine can be read, patched or replayed. AXIOM never trusts a client-reported result — it recomputes the ones that carry value.

ASSUMPTION 02

Signatures go stale

Known-exploit lists lag behind the people writing exploits. Behavioural baselines catch the shape of cheating even when the specific tool is new.

ASSUMPTION 03

False positives cost players

A wrongly banned player is a lost player. Detections are graduated and every action carries the evidence that caused it, so appeals can be answered honestly.

How it works

Four stages, one frame.

Every guarded action passes the same pipeline before the server commits it.

Intercept

Guarded remotes and state transitions are wrapped. Nothing reaches game logic unchecked.

Validate

Hard rules first — physics bounds, rate limits, ownership, payload shape and signing.

Score

What passes is compared to the player's own baseline and the server population's.

Respond

Clear, warn, throttle, rollback, isolate or ban — per detection class, with the evidence attached.

axiom · configuration
-- ServerScriptService/AxiomBootstrap.server.luau
local Axiom = require(ServerStorage.Axiom)

Axiom:Init({
  mode      = "enforce",  -- observe | enforce
  telemetry = true,
  appeals   = true,
})

-- physics
Axiom:Watch("Movement", {
  maxStudsPerSecond = 42,
  maxVerticalDelta  = 18,
  toleranceFrames   = 3,
  onViolation       = Axiom.Action.Rollback,
})

-- economy
Axiom:Watch("Economy", {
  validate = function(player, delta)
    return delta <= Ledger:Earned(player)
  end,
  -- contain first, confirm, then ban
  onViolation = Axiom.Action.Isolate,
  onConfirmed = Axiom.Action.Ban,
})

-- remotes
Axiom:Guard(ReplicatedStorage.Remotes, {
  rateLimit = { calls = 12, perSeconds = 1 },
  schema    = true,
})

Drop-in, then tune

AXIOM ships as a server module. Start in observe mode to collect a fortnight of baselines without touching a single player, review what it would have done, then flip to enforce when the thresholds match your game.

  • No client dependency. Nothing to install on the player's side, nothing to bypass.
  • Budgeted. Detection work is bounded per frame so it never becomes the lag source.
  • Composable. Watchers are per-system; adopt movement first, economy later.
  • Moderator tooling. A review queue with replayable evidence, not just a ban list.

Containment

We don't always ban on first detection.

A ban is a loud, permanent answer to a question you might still be getting wrong. When AXIOM flags suspicious activity, the player is quietly moved into an isolated instance instead of a public server — and everything they do there stops at the door.

What the player sees

Nothing. The isolated instance looks and plays like a normal server, so there's no obvious moment that tips them off and no reason to switch tactics or start a new account.

What actually happens

  • Nothing is saved. No data, no progress, no rewards, no economy changes — the instance writes to nothing.
  • Everything resets on rejoin. The moment they leave and enter a public server, none of it carried over.
  • The real game is untouched. Other players never share a server with a live exploit, and the economy never sees it.
  • We get evidence. Behaviour keeps generating signal, which is what turns a suspicion into a confirmed case.

Bans are still used — for confirmed, serious violations. Containment is the safer first step that earns us the confidence to take one.

Public server Isolated instance
Look and feel Normal Identical
Player data Saved Never written
Progress Persists Discarded
Rewards and drops Granted Void
Economy effects Applied Contained
On rejoin Continues Resets
Detection A watcher flags behaviour it can't clear.
Isolation Quietly routed to a non-persisting instance.
Confirmed Evidence holds up — enforcement follows.
Cleared False alarm — returned, nothing lost.

A cleared player loses nothing, because nothing they did in isolation was ever going to count.

Coverage

What AXIOM watches.

Detection classes are modular. Enable what your title needs and leave the rest dormant.

Movement & physics

Speed, flight, noclip, teleport and gravity manipulation, checked against the server's own simulation bounds.

Economy integrity

Currency and item grants reconciled against a server-side ledger. Duplication and injection fail closed.

Combat validation

Reach, fire rate, line of sight and damage magnitude re-derived on the server before a hit lands.

Remote abuse

Rate limiting, schema validation and argument signing on every guarded RemoteEvent and RemoteFunction.

Behavioural anomalies

Per-player baselines across session length, input cadence and progression rate. Outliers surface for review.

Account & alt patterns

Repeat-offender correlation and ban-evasion signals, weighted so shared households aren't punished.

Live enforcement log

Movement · 128 studs/s, 3.0× baseline ceilingBlocked
Remote · 240 calls/s on RequestRewardBlocked
Remote · unsigned payload on PurchaseItemBlocked
Economy · credit spike, 3σ from player baselineFlagged
Session · repeat flags — routed to non-persisting instanceIsolated
Combat · reach 21 studs vs 14 permittedBlocked
Combat · hit registered within toleranceCleared

Illustrative sample. Live dashboards are available to licensed studios.

FAQ

Questions we get asked.

Is AXIOM available to studios outside CypherX?
AXIOM was built for our own titles and is hardened there first. We licence it selectively to studios whose games are a good fit. Get in touch with your experience link, concurrent player range and the exploit classes hurting you most, and we'll tell you honestly whether it helps.
Does it need a client-side component?
No. AXIOM is entirely server-side. There is nothing on the player's machine to detect, patch or bypass, and no impact on load times. Optional client hints can improve accuracy for some detections, but nothing depends on them being honest.
What does it cost in server performance?
Detection work is budgeted per frame, and the expensive checks are sampled rather than exhaustive. If the budget is exceeded, AXIOM degrades to hard-rule validation only — it will never become the reason your server drops frames.
How are false positives handled?
Enforcement is graduated per detection class: most anomalies warn, throttle or isolate long before they ever ban. Containment is deliberately reversible — a wrongly flagged player loses nothing, because nothing done in an isolated instance was ever going to be saved. Every action is written to an audit log with the triggering evidence, and the optional appeals flow lets moderators review a replayable case rather than a bare verdict.
What happens to a player who gets flagged?
Usually not a ban. They're moved into an isolated instance that looks and plays like a normal server but persists nothing — no data, no progress, no rewards, no economy changes. That keeps the real game clean while we confirm or rule out the detection. Bans are reserved for confirmed, serious violations. Full detail here.
How long does onboarding take?
The module drops in within a day. We recommend running two weeks in observe mode to build baselines and review what enforcement would have done before switching it on.

Talk to us about AXIOM.

Tell us about your experience and what you're seeing. We'll come back with a straight answer.

Start a conversation See it in production