The VAE That Wouldn't Vary: Posterior Collapse in Sequential VAEs for Behavioral Anomaly Detection in Online Gaming

Khania Clark (Drury University), Layden Halcomb (Drury University), Tyler Sillanpaa (Drury University), Dr. Chris Branton (Drury University), Dr. Padmavathi Iyer (Drury University)

Anomaly detection has emerged as a powerful alternative to traditional signature-based threat identification, enabling systems to flag deviations from learned normal behavior rather than relying on predefined patterns. This project explores the application of machine learning-based anomaly detection to a concrete, real-world domain: aimbot detection in the competitive first-person shooter Counter-Strike 2 (CS2). Unlike signature-based methods, which require known threat profiles, anomaly detection operates on the premise that malicious behavior manifests as statistical deviation from a norm. We surveyed several approaches to this problem — including Isolation Forests, One-Class SVMs, k-NN, and autoencoder-based methods — before focusing our proof-of-concept on a Variational Autoencoder (VAE) with an LSTM decoder, trained on open-source CS2 demo data provided by Valve Corporation. Our goal was to generate a generative model of legitimate player aim behavior against which anomalous, aimbot-assisted behavior could be identified. Our experiments revealed a fundamental challenge: persistent posterior collapse. Throughout training, KL divergence rapidly converged toward zero, indicating that the latent space was not meaningfully utilized. The LSTM decoder proved expressive enough to reconstruct 300-tick aim sequences near-deterministically, effectively reducing the VAE to a standard autoencoder — memorizing dominant structural patterns rather than learning a rich generative distribution over human aim behavior. These findings align with recent literature suggesting that reconstruction-based models can be unreliable for anomaly detection, as low reconstruction error does not reliably correspond to normality, and extend this concern to the VAE setting: posterior collapse introduces similar failure modes when training on highly structured behavioral time-series data. This work does not suggest that VAEs are inherently ill-suited for generative modeling, but rather highlights the difficulty of learning meaningful latent representations in deterministic behavioral domains without additional architectural constraints or alternative training objectives.