QuintAce Open-Source Superuser Detection System

How the detection system works

QuintAce has published the source code for AceGuardian, a tool designed to detect superusers in online poker, on GitHub. The system analyzes hand histories, identifies suspicious playing decisions, and estimates the likelihood that a player is exploiting an unfair advantage. The developers released the code under the MIT license, allowing poker rooms and independent researchers to use and improve the methodology.

The core idea is that access to opponents’ hole cards leaves traces in a player’s decisions. Even if their win rate appears normal, their behavior in individual hands may point to an unfair advantage.

AceGuardian works in several stages:

• 📊 Player pool analysis. The tool identifies players with unusual win rates and atypical playing styles over a selected period. Suspicious accounts are grouped to detect potential connections between them.
• 🔍 Behavioral analysis. The system monitors the frequency and success rate of specific actions, comparing a player's metrics against those of other players in the field.
• 🎯 Hand review. Decisions are analyzed based on the opponents' actual hole cards at each stage of the hand.
• ⚠️ Risk assessment. Each suspicious hand is assigned a score from 0 to 100, taking into account the type of decision, hand strength, pot size, and decision time.
• 🛡️ Expert review. The system generates a list of suspicious hands and accounts, which are then examined by security specialists.

The technical foundation comprises Python code, a data processing pipeline, tests for individual hands, a Bayesian range model, and an equity calculation engine. The tool analyzes completed hands where the participants' hole cards are known.

What the model looks for

One of the key signals is oracle folds — folding strong hands in situations where continuing would be profitable against an opponent’s estimated range, but becomes unprofitable when their actual hole cards are taken into account. The system checks whether a player makes such decisions with suspiciously high accuracy, as if they had access to information about their opponents’ hole cards.

The algorithm also evaluates:

• Low-equity bets. How successfully a player utilizes hands with a low probability of winning.
• Behavior against bluffs and value bets. For example, whether the player folds unusually often against strong hands or continues more frequently than normal against bluffs.
• Decision-making time. A very quick fold of a strong hand—in a situation where the opponent's actual cards make continuing unprofitable—can raise suspicions.
• Deviations from the norm. All metrics are compared against the behavior of other players under similar game conditions.

No single indicator proves fraud on its own. What matters is the combination of signals and the extent to which the player's behavior deviates from the norm.

Verification using a real case

AceGuardian tested the model using the case of Paul Gregg, a player who gained notoriety following the "Mesh Agent" scandal. According to published data, he played at the $25/$50 stakes for approximately ten weeks, completing 14 sessions and winning around $45,000. The sample analyzed comprised 757 hands, with about 95% played heads-up against the same opponent.

Standard statistics showed nothing anomalous: the player's win rate was higher than that of 81% of the 2,010 players in the sample. A fact that,  itself, didn’t indicate foul play.

An analysis of decision-making revealed a different story. The model's baseline version flagged 72 suspicious hands. In six out of seven categories of flagged behavior, the player fell within the extreme top 1% of the 193 comparable players competing in heads-up matches at the $25/$50 level.

The disparity between actions taken against value bets and bluffs was particularly striking: the player folded against value bets significantly more often than the sample median, yet folded less frequently when facing bluffs.

*A percentage point is the unit used to measure the difference between two percentage values.

In one hand, a player folded top pair on the turn in just four seconds. In another instance, he almost instantly folded two pair on the river when the opponent completed a straight. While such decisions can individually be attributed to good reads or an opponent’s mistake, they become more suspicious when combined with recurring statistical deviations.

Why open-source the code

The release allows poker rooms to run the system on their own hand histories, while researchers can study and validate the methodology. Players can also submit suspicious hands to QuintAce for analysis by emailing [email protected].

However, the tool is specifically designed to detect superusers. Detecting bots and collusion requires separate models. Even when suspicious patterns are identified, final decisions should be left to specialists rather than made automatically based on a single metric.

AceGuardian is encouraging the poker industry to share information about suspicious activity at online tables more actively. The team believes a more open approach will help poker rooms identify threats faster and enable players to better protect their funds.