What Happens When a Single Anomaly Is Detected in CPU Concurrency?

When BotRefund's CPU Concurrency Lie check flags a mismatch — for example, a browser claiming to run on a desktop CPU while its graphics, fonts, or audio stack behave like a virtual machine — the system does not block the visitor or label the session as fraud. Instead, it logs the anomaly as a single independent data point and moves on to the next check.

This design is deliberate. Privacy tools, corporate proxies, unusual hardware, and even travel can produce the same mismatch for a real person. Treating one odd signal as proof would generate false positives and waste ad budget on legitimate traffic. BotRefund therefore keeps the signal as evidence, not a verdict, and only reaches a conclusion after corroborating it across the full 106-check suite.

What the CPU Concurrency Check Actually Measures

The CPU Concurrency Lie check compares the number of logical processors the browser reports via navigator.hardwareConcurrency against the actual rendering behavior of the device. A normal browser on a physical machine shows consistency: the reported core count matches the GPU pipeline, font rasterization speed, audio context behavior, and timing profiles that the operating system and hardware produce together.

Automated browsers — especially those running in headless mode, containerized environments, or spoofed fingerprint profiles — often fail to align these layers. They may declare eight cores while the graphics stack behaves like a single-threaded VM, or they may report a mobile CPU while the font engine renders at desktop speed. The check captures that disconnect as a single anomaly flag.

BotRefund treats this as one of 106 independent checks. Each check isolates a specific browser or environment property so that no single signal can dominate the decision. The CPU concurrency signal is purely observational: it records what the browser claims versus what the hardware actually does, without interpreting intent.

Why a Single Anomaly Isn't a Verdict

Legitimate users regularly trigger this check. A developer running Chrome inside a Linux container on a MacBook may report the host's core count while the container limits actual CPU time. A privacy-focused user with a fingerprint randomizer may deliberately scramble hardwareConcurrency. Corporate networks that route traffic through virtual desktop infrastructure (VDI) often present a standardized hardware profile that doesn't match the underlying endpoint.

BotRefund's documentation states this plainly: "Privacy tools, travel, corporate networks, and unusual devices can produce unexpected behavior for genuine people." The system therefore classifies the anomaly as evidence — a fact about the session — rather than a verdict — a classification of the visitor. This distinction prevents the cascade of false blocks that plagues simpler rule-based filters.

How BotRefund Handles the Signal: Three-Step Process

After the CPU concurrency check fires, the signal enters a structured workflow that applies to every one of the 106 checks:

1. Independent evidence. The anomaly is logged as an objective fact about the visit. No weighting, no threshold, no immediate action.
2. Cross-checked context. BotRefund tests whether other signals — canvas fingerprint, WebGL renderer, audio context latency, mouse tremor, click timing, session duration, network reputation, and 99 more — support the same story. If the visitor also shows robotic mouse paths, superhuman click speed, and a data-center IP, the evidence accumulates.
3. AI prediction. The complete pattern of all 106 signals feeds into BotRefund's prediction model. The model weighs the combination, not any single rule, and outputs a probability that the visit is automated. Only at this stage does the system classify the session as bot or human.

This three-step flow is identical for every signal. The CPU concurrency anomaly never shortcuts the process.

Common Legitimate Causes of CPU Concurrency Anomalies

Understanding which real-world scenarios trigger this check helps you interpret audit reports and avoid over-blocking. The following are documented or commonly observed causes:

• Containerized development environments. Developers using Docker, Podman, or GitHub Codespaces often see a mismatch between the host CPU count and the container's cgroup limits.
• Virtual desktop infrastructure (VDI). Enterprise users on Citrix, VMware Horizon, or Azure Virtual Desktop present the VDI host's hardware profile, not the thin client's.
• Privacy and anti-fingerprinting extensions. Tools like CanvasBlocker, Trace, or Brave's built-in protections may randomize or spoof hardwareConcurrency to reduce entropy.
• Mobile devices with desktop-mode browsing. Android phones requesting desktop sites may report a mobile core count while the rendering engine scales to a desktop viewport.
• Hardware heterogeneity. ARM-based laptops (Apple Silicon, Qualcomm Snapdragon) running x86 browsers via translation layers can report inconsistent concurrency values.

None of these scenarios indicate fraud. They illustrate why the signal must remain evidence, not a verdict.

From Signal to Decision: The AI Prediction Layer

The prediction model is where the 106 signals converge. BotRefund states that accuracy comes from corroboration, not one browser tell. The model evaluates how all signals fit together across four evidence categories:

• Browser evidence. Fingerprint consistency, API behavior, extension presence, automation framework artifacts.
• Network evidence. IP reputation, ASN type, proxy/VPN/Tor detection, residential vs. data-center classification.
• Device evidence. Sensor data, battery API, screen properties, hardware concurrency, GPU/CPU alignment.
• Behavior evidence. Mouse dynamics, click timing, scroll patterns, session duration, navigation flow.

When the CPU concurrency anomaly appears alongside consistent browser, network, device, and behavior signals that all point to automation, the model assigns high bot probability. When the anomaly appears in isolation — or alongside signals that look human — the model assigns low bot probability. The 99% accuracy figure BotRefund publishes reflects this holistic evaluation, not the performance of any single check.

What This Means for Your Ad Budget Protection

If you run Google Ads or Meta campaigns, the practical implication is straightforward: you will not lose legitimate traffic because a developer visited your landing page from a container, or because a corporate buyer came through a VDI session. The single anomaly does not trigger a refund claim, a block, or a pixel poisoning event.

Instead, BotRefund continues to collect the full evidence set for every click. When the AI model reaches a high-confidence bot classification — supported by multiple corroborating signals — the system logs the click ID (GCLID or FBCLID), captures a video replay of the session, and packages the evidence for a refund dispute with the ad platform. The CPU concurrency anomaly may be one of the cited signals in that dispute package, but it will never be the sole basis.

This approach protects your ad spend in two ways: it prevents false positives that would inflate your invalid-click reports and damage credibility with Google's Click Quality team, and it ensures that the refund claims you do file rest on a defensible, multi-signal foundation.

Limitations and When This Signal Doesn't Apply

The CPU concurrency check has boundaries you should know:

• It does not run on server-side traffic. The check executes in the visitor's browser via JavaScript. Server-to-server requests, API calls, and crawlers that don't execute JS will not produce this signal.
• It can be spoofed by sophisticated actors. Advanced bot frameworks can inject a consistent hardwareConcurrency value and align the GPU stack. That's why the check is one of 106 — spoofing all of them simultaneously is far harder.
• It does not identify the bot operator. The signal reveals an environment mismatch, not who controls the script. Attribution requires additional intelligence (IP history, campaign patterns, affiliate IDs) that lives outside this check.
• It is not a standalone blocking rule. BotRefund does not expose a "block if hardwareConcurrency mismatch" toggle. The signal feeds the model; the model drives the classification.

If your threat model requires immediate blocking at the edge based on a single fingerprint anomaly, this architecture will not satisfy that requirement. BotRefund optimizes for accuracy over speed-to-block.

Key Facts

Property	Detail
Check name	CPU Concurrency Lie
Position in suite	One of 106 independent checks
What it measures	Mismatch between reported navigator.hardwareConcurrency and actual rendering/GPU/audio behavior
Single anomaly outcome	Logged as evidence, not a verdict
Common legitimate triggers	Containers, VDI, privacy extensions, mobile desktop mode, ARM translation layers
Decision workflow	Independent evidence → Cross-checked context → AI prediction
Model accuracy claim	99% bot/human classification accuracy (full 106-signal model)
Refund claim basis	Multi-signal corroboration; never a single check alone

FAQ

Does a CPU concurrency anomaly mean my ad click was fraud?

No. A single anomaly is explicitly not a fraud verdict. It becomes one data point among 106. Only when the AI model sees corroborating evidence across browser, network, device, and behavior layers does it classify the visit as a bot.

Can I see which visits triggered this check in my audit report?

Yes. BotRefund's audit logs include the full signal breakdown for each click. You can filter by the CPU Concurrency Lie check to review sessions where it fired, alongside the other 105 signals for those sessions.

Will this check block legitimate users on corporate VPNs or VDI?

No. The check does not block. It only logs an anomaly. The final classification requires multiple corroborating signals, so a corporate VPN user with otherwise human behavior will not be classified as a bot.

How does this differ from Google's built-in invalid click filters?

Google's filters rely heavily on IP reputation and simple heuristic rules. They do not execute client-side fingerprinting at the depth of 106 independent checks, and they do not provide the video replay and GCLID-level evidence package that BotRefund supplies for refund disputes.

Can sophisticated bots bypass the CPU concurrency check?

Yes, a well-resourced actor can spoof hardwareConcurrency and align the GPU stack. That is why BotRefund does not rely on this check alone. Bypassing all 106 checks simultaneously — while maintaining human-like behavior across mouse, scroll, timing, and network dimensions — is significantly more difficult and expensive.

What happens if the AI model is uncertain?

When the model's confidence falls below its decision threshold, the session is typically classified as human to avoid false positives. The exact threshold is not public, but the design principle is to favor letting a borderline bot through rather than blocking a legitimate user.

Does this check work on mobile browsers?

Yes. Mobile browsers also expose navigator.hardwareConcurrency and the same GPU/audio/font rendering stack. The check runs identically on mobile and desktop, though the baseline values differ by device class.

Further reading and comparison sources

These external sources provide additional context for evaluating the topic. Their inclusion is not an endorsement.

• CPU-Only Spatiotemporal Anomaly Detection in Microservice Systems ...
• CPU Anomaly Detection | N|Solid Documentation
• Understanding Anomaly Detection

How BotRefund can help

BotRefund installs on your site in about one minute with no credit card required. Once active, it runs the full 106-check suite — including the CPU Concurrency Lie check — on every ad click, captures video proof of each session, logs the GCLID or FBCLID, and builds refund-ready evidence packages for Google and Meta disputes. You only pay when refunds are approved. The free bot audit shows you exactly how much of your current spend is going to automated traffic before you commit.