A cloud tenant using nothing but ordinary GPU access can push a data center’s power draw up and down fast enough to threaten the grid it runs on, with no exploit and no break-in.
That is the claim behind Bit2Watt, described by three Zhejiang University researchers in a paper accepted to CHES 2026, the IACR’s hardware-security conference, and the evidence splits in two: they measured the power modulation on real GPUs and simulated the grid destabilization it could cause.
The technique inverts the usual grid-attack model: no compromised sensors, no malware on control systems, no stolen operator credentials, just a workload built to misbehave on purpose.
It works because a GPU’s power draw follows whatever it is computing. Saturate the tensor cores and current spikes; drop to idle, and it collapses. Toggle between those states on a schedule and you get a controllable power oscillation at the wall socket.
The authors frame it as a blunt question: can “purely computational actions, executed as legitimate workloads, be weaponized to destabilize power infrastructure”? The rest of the paper is their answer.
Two Ways In
The first method, which they call SWMA, uploads a purpose-built CUDA kernel that flips between a high-intensity compute mode and a near-idle one. A host-side controller sets the switching schedule and toggles the mode through a single unified-memory flag allocated with cudaMallocManaged, standard tooling rather than anything exotic.
Across the tested GPUs, the synthetic workload produced power components from about 1.5 kHz up to 6 kHz, peaking on an RTX 4090, well above the handful of hertz a swinging household load like an air conditioner produces.
It held on data-center GPUs like the A100 and Tesla V100, not just gaming cards. The custom kernel and its tight polling loop are the sort of thing a provider could learn to fingerprint.
The second, LTMA, is the one that should worry operators. Rather than a synthetic kernel, it buries the modulation inside a real LLM training run, adjusting hyperparameters and inserting auxiliary operations to make the compute load rise and fall without breaking the training.
The control is looser than SWMA’s, bounded by how fast the training loop iterates, and the frequencies run lower, roughly 1.2 to 3 kHz. But it reaches larger amplitude and blends into normal training noise, which is exactly what makes it the harder one to flag. Neither method needs elevated privileges, because a tenant already controls their own training scripts and job schedules.
Those are single-GPU figures, and they only bite in bulk. The paper models the bulk case at its most dangerous: a simulated 1 MW local grid, 90% powered by distributed energy resources (the rooftop solar and batteries increasingly feeding local grids), with 1,000 GPUs modulating in perfect lockstep.
In that worst-case simulation, current total harmonic distortion (THD) hit 46.8%, well above the 13% guideline the paper benchmarks it against from IEC 61000-3-12. The damping ratio fell to -0.27, a negative value that marks an unstable mode, where the grid amplifies a disturbance instead of damping it out.
The paper pushes the model further still, onto a 9,241-bus grid meant to resemble the European transmission network, where a localized disturbance worth 2% of system load cascades across 13 stages and sheds about 81% of load. That number stacks worst-case assumptions on one specific model, and it is a property of the simulation, not a forecast of anything real.
That lockstep is the load-bearing assumption, and the optimistic one for the attacker: the paper concedes that aligning power transitions across a real fleet of cloud GPUs is still an open problem. In its own 2 kHz model, timing jitter with a standard deviation of 100 microseconds cut the aggregate amplitude by about 20%, and the paper does not claim that figure reflects a typical cloud.
A real attack would need several things to line up at once: enough physically clustered GPUs, tight synchronization across them, modulation that survives the data center’s power-conditioning stages, and a grid whose resonances happen to amplify the chosen frequency.
The physical experiments ran in controlled testbeds, and the grid-scale damage came from simulation, with no production systems attacked and no security flaw disclosed in any specific commercial product.
The Hacker News has reached out to the Zhejiang University researchers for comment on how far the attack scales in a real cloud environment and will update this story with any response.
What keeps it from being purely academic is that the physics is already on record. In August 2025, Microsoft, OpenAI, and NVIDIA published their own paper on stabilizing AI-training power, warning that the synchronized swings of large training jobs can, when their frequency lines up with a utility’s critical frequencies, “cause physical damage to the power grid infrastructure.”
Bit2Watt takes that accidental effect and asks what a tenant could do with it deliberately.
The grid has also had a scare from data centers behaving badly by accident. In July 2024, a transmission fault in a data-center-dense part of Northern Virginia caused roughly 1,500 MW of data-center load to drop off the grid at once, when the facilities’ own protection systems cut them over to backup power.
NERC, which oversees North American grid reliability, said the disturbance posed no reliability risk at the time, though operators did have to correct voltage. It warned that the danger grows as these loads scale, and its technical committee set up a Large Loads Task Force later in 2024 to study them.
No one attacked anything; the data centers protected themselves. The point is not that the grid nearly failed, but that a load that size can drop in an instant, faster than operators can plan for, and the risk climbs as these fleets grow.
The loop closes with what the authors call Watt2Bit, the disturbance feeding back into the computing side. The paper’s analysis shows how harmonic-driven heating and elevated current could trip thermal or overcurrent protection and shut GPU servers down, turning a power-quality problem into a denial of service.
Stranger still, the same modulation doubles as a covert channel. Encoding bits as two frequencies, 2 kHz for a 1 and 200 Hz for a 0, the team captured the electromagnetic emissions on a near-field antenna wired to a software-defined radio and recovered a 50-bit test sequence with zero errors.
It is a close cousin of PowerHammer, the air-gap data-exfiltration attack THN covered in 2018, with one distinction: PowerHammer read data conducted along the power line, tapped anywhere from the outlet to the building’s electrical panel, while Bit2Watt’s channel needs an antenna catching near-field EMI right at the hardware.
Neither reaches out over the internet; both need a physical foothold near the power or the machine.
No Bug to Patch
Standard telemetry barely catches it. Rack PDU counters sample once a second, NVIDIA’s NVML telemetry at 450 Hz, and even the fastest common interfaces, RAPL and server BMCs, top out near 1 kHz, while the modulation runs several times higher.
A lightweight detector the researchers built on power and NVML data performed poorly; adding GPU profiling features improved it, and dedicated EMI sensing worked best. LTMA was consistently harder to spot than SWMA. Those results come from a research-grade detector, not the proprietary systems a large cloud provider might run, so they do not prove a hyperscaler would miss it.
The bigger problem is not visibility. There is no product bug to patch, because the exposure is the architecture itself: the tight coupling between volatile GPU load and an inverter-heavy grid, which no conventional monitoring watches across.
The paper offers defenses for both sides at once: batteries, supercapacitors, and harmonic filtering on the power side; anomaly detection on GPU utilization and training schedules on the compute side. It frames a single system that ties the two together as future work.
The compute side and the grid side are run by different companies, monitored by different tools, and neither is built to watch the other. That seam is where Bit2Watt lives, and right now it has no owner.
