GPU coherence: catching a spoofed graphics card

Anti-detect browsers sell one promise: a fresh, believable device for every account. Part of that is the graphics card. The GPU model a page can read is a strong signal, so these tools rewrite it, and a farm of accounts can each claim a different, ordinary laptop.

One model, several read paths

A browser exposes the GPU model through more than one interface. WebGL reports it on the page. A worker can create its own offscreen canvas and ask again, in a separate context. Where it is available, WebGPU describes the adapter through a third interface. On most machines all three describe the same hardware.

Spoofing tools usually patch the most common path. Patching every path consistently, including the one inside a worker, is harder, and that is where a rewritten GPU tends to show.

What the check does

The GPU coherence check compares the GPU model across these independent read paths (WebGL, a worker's offscreen canvas and WebGPU) and flags a browser that reports different models through them. It shipped in July 2026 and is part of the SDK's default collection.

A real machine with two graphics chips can report two models, so a mismatch is evidence to weigh, not proof on its own.

What it does not do

It does not identify a device, and it does not link two browsers. A spoofing tool that rewrites every read path consistently passes it. It is one piece of evidence among many, which is how every signal in a verdict should be read.

The research behind it

DRAWNAPART (NDSS 2022) showed how much identity lives in graphics hardware: by timing short WebGL programs on a GPU's execution units, its authors told apart devices of the same model. That line of research is why we treat the graphics stack as evidence worth checking for consistency. We describe it here as research. The check above is the part that ships.