Bit2Watt: How a Cloud Tenant Can Rock the Power Grid Using GPUs

Three researchers from Zhejiang University have described, in a paper accepted at the CHES 2026 hardware security conference, an attack they call Bit2Watt. The gist is that a cloud-service tenant, armed with nothing more than legitimate access to graphics cards, can swing a data center's power consumption so sharply that it poses a threat to the electrical grid feeding it. No vulnerabilities, no malicious code, no stolen credentials — just a compute workload engineered to behave “badly.”

The mechanics are simple: a GPU's power draw follows whatever it is computing. Load up the tensor cores and the current spikes; put the card into idle and it drops. By toggling between these states on a schedule, you can produce controllable power oscillations right at the outlet.

Two approaches

The first method, SWMA, loads a purpose-written CUDA kernel that switches between intensive computation and near-idle via a single unified-memory flag. On the cards tested — including the RTX 4090 and the data-center A100 and Tesla V100 — this produced power components ranging from 1.5 to 6 kHz, orders of magnitude above the sparse hertz generated by a household air conditioner. That said, the telltale kernel with its tight polling loop is something the provider could, in theory, learn to recognize.

The second method, LTMA, is more troubling. The modulation hides inside genuine language-model training: hyperparameter tuning and auxiliary operations make the workload oscillate without breaking the training run. The frequencies are lower (1.2–3 kHz), but the amplitude is larger, and the process itself blends into the ordinary “noise” of training. Neither method requires elevated privileges — the tenant already controls their own scripts.

What the simulation shows

A single card is dangerous only in bulk. In the worst-case scenario, the authors modeled a 1 MW local grid, 90% powered by distributed sources (rooftop panels, batteries), where 1,000 GPUs modulate their power in sync. The total harmonic distortion of the current reached 46.8% against the IEC norm of 13%, and the damping coefficient went negative — the grid begins to amplify the disturbance instead of suppressing it. On a model of the European transmission grid with 9,241 nodes, a local disturbance cascaded into shedding roughly 81% of the load.

The authors are candid in their caveat: this is a property of a specific simulation, not a forecast. The key assumption — perfect synchrony across thousands of cards — remains an open problem; even 100 microseconds of jitter cut the amplitude by about 20%.

Why there is nothing to patch

The feedback loop exists too. “Watt2Bit” shows how overheating and elevated current can trip thermal or overcurrent protection and cut power to the servers — a denial of service. And the same modulation serves as a covert channel: encoding bits with two frequencies, the team picked up the electromagnetic emission with a near-field antenna and recovered a 50-bit test sequence without errors.

The main problem is not visibility (standard PDU and NVML telemetry is simply too slow) but the architecture itself: the tight coupling of a volatile GPU workload to a grid saturated with inverters. There is nothing to patch. The compute side and the power side are handled by different companies with different tools, and neither watches the other. It is precisely on this seam that Bit2Watt lives — and it has no owner yet.

All the physical experiments were run on controlled testbeds, the grid damage was obtained in simulation, and no real system was attacked. But the physics is already on record: back in August 2025, Microsoft, OpenAI, and NVIDIA warned that the synchronized power surges of large training runs could damage grid infrastructure. Bit2Watt merely turns that side effect into a question: what if you did it on purpose?

Source: The Hacker News