Researchers outline GPU workload attack that could stress power grids

Researchers at Zhejiang University in Hangzhou have described Bit2Watt, a proposed attack in which a malicious cloud customer uses GPU workloads to stress a provider’s data center and the electrical systems supporting it. The work matters for cloud and AI infrastructure operators because it shifts a known reliability problem, rapid power swings during AI training, into an adversarial model involving ordinary tenant access.

The technique is laid out by Zhouhao Ji, Kaikai Pan and Wenyuan Xu in a preprint titled “Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures.” The researchers frame the attacker as a legitimate-looking tenant running jobs through permitted cloud execution paths, rather than someone who first compromises management systems or physical equipment.

Large GPU clusters already create operational problems for power systems. A 2025 paper by Microsoft, Nvidia and OpenAI said AI training can produce major swings when GPUs move between computation and data synchronization, and warned that certain frequency patterns can interact badly with utility infrastructure. Meta also described the issue in its Llama 3 training paper, saying tens of thousands of GPUs can change power draw at once during checkpointing, collective communications, startup or shutdown, producing data center fluctuations measured in tens of megawatts.

Bit2Watt takes that behavior and treats it as an attack surface. According to the Zhejiang University researchers, GPU loads can be modulated at frequencies above 6,000 Hz, far beyond the few-hertz patterns associated with typical household loads such as air conditioners. The paper says those higher-frequency changes can drive voltage deviations, harmonic distortion and reduced damping in the connected power system.

The numbers in the preprint are specific, though they come from the researchers’ scenario rather than a disclosed incident at a cloud provider. In a modeled 1-MW local grid made up mainly of distributed energy resources, including photovoltaics, the authors say an attacker using 1,000 GPUs could produce total harmonic distortion of 46.8 percent. They say that level would divert nearly half of electrical current into non-productive work and generate about 20 percent more heat than normal.

The authors also report a negative damping ratio of -0.27 in that scenario, which they describe as introducing an unstable mode into the system. If protective systems respond by shedding computing loads, the paper says the result could be cascading failures and, in large-scale power systems, blackouts affecting more than 80 percent of the system.

The cloud security angle is that the proposed attack may not look like a conventional intrusion. The researchers argue that because Bit2Watt runs through authorized workload mechanisms, provider monitoring tools focused on software abuse or resource accounting may miss the physical impact of the computation pattern. Their recommendation is for infrastructure operators to tie workload scheduling and monitoring more closely to power-system telemetry, rather than treating compute and facilities as separate control problems.

The paper also calls for local energy buffering to absorb demand spikes. That is an operational expense question for AI infrastructure companies already dealing with grid interconnection constraints, generator procurement and increasingly dense GPU deployments.

Bit2Watt is paired with a related side-channel concept the researchers call Watt2Bit. They say malicious workload-induced electrical and thermal stress can create denial-of-service conditions and can also carry data through power modulation. In a proof of concept, the researchers report recovering a 50-bit test sequence using frequency-shift keying encoding.

The broader signal for cloud providers is that AI workload scheduling is becoming part of the security boundary. The paper does not name an affected cloud provider or report a live attack. It does argue that as compute clusters and power infrastructure become more tightly coupled, defenses need to account for workload behavior, power electronics and grid dynamics at the same time.

This story draws on original reporting from The Register.