But really, if HID becomes suspect too, then why do you even need kernel level anti-cheat, if all you can do is behavioral detection?

If you're in the kernel you at least have raw access to the USB controller and input events, thus can try pick out real mouses from fake ones.

	▲	pona-a 19 hours ago \| parent [-]
		If the point of those events is to be registered by the game program, you already have all the data you need, otherwise you're building a keylogger. The most the kernel can try to tell you is what's plugged in, but the cheater can easily make the fake HID interposed between the real keyboard and USB.