Polyhacks are completely randomised by each individual user then protected with Enigma or VMProtect. This makes each and every hack completely and utterly unique on a signature level. VAC3 only uses signature scanning to detect cheats, They find a cheat, they search for that signature and flag that person for a ban. Since each user has a completely different signature, a ban wave can't really happen. Yes its not 100% undetectable, if someones individual signature gets upload because they don't recompile each day, then they may end up flagged for a ban but it is extremely hard for VAC to do one of there famous "Ban Waves".