A cloud tenant, leveraging nothing more than ordinary GPU access, can rapidly fluctuate a data center's power draw, potentially threatening the stability of the electrical grid it operates on. This alarming claim underpins **Bit2Watt**, a concept detailed by three **Zhejiang University** researchers in a paper accepted to **CHES 2026**, the **IACR's** hardware-security conference. The evidence for **Bit2Watt** is twofold: direct measurement of power modulation on real GPUs and simulations illustrating the resulting grid destabilization. This technique starkly contrasts typical grid-attack models, which often involve compromised sensors, malware, or stolen credentials. Instead, **Bit2Watt** exploits the inherent relationship between a GPU's computational load and its power consumption. By toggling between high-intensity compute states and near-idle states on a precise schedule, a controllable power oscillation can be generated at the wall socket. The authors frame this as a critical question: can "purely computational actions, executed as legitimate workloads, be weaponized to destabilize power infrastructure"? Their research provides a compelling answer. ## Two Methods of Modulation The researchers developed two primary methods for achieving this power modulation: ### SWMA: Synthetic Workload Modulation Attack **SWMA** involves uploading a custom-built **CUDA** kernel that rapidly switches between a high-intensity compute mode and a near-idle one. A host-side controller dictates the switching schedule, toggling the mode via a single unified-memory flag allocated with `cudaMallocManaged` – standard tooling, not an exotic exploit. Across various tested GPUs, including the **RTX 4090**, **A100**, and **Tesla V100**, this synthetic workload produced power components ranging from approximately 1.5 kHz to 6 kHz. These frequencies are significantly higher than the few hertz produced by typical household loads like air conditioners. While effective, the custom kernel and its tight polling loop could potentially be fingerprinted by cloud providers. ### LTMA: Legitimate Training Modulation Attack **LTMA** presents a more concerning scenario for operators. This method embeds the power modulation within a genuine Large Language Model (**LLM**) training run. By adjusting hyperparameters and inserting auxiliary operations, the compute load is made to rise and fall without disrupting the training process itself. While **LTMA's** control is looser and its frequencies lower (roughly 1.2 to 3 kHz) compared to **SWMA**, it achieves larger amplitudes and, crucially, blends seamlessly into normal training noise. This camouflage makes it significantly harder to detect. Neither method requires elevated privileges, as a tenant already controls their own training scripts and job schedules. ## Grid-Scale Implications These single-GPU figures become critical when scaled up. The paper models a worst-case scenario: a simulated 1 MW local grid, 90% powered by distributed energy resources (such as rooftop solar and batteries), with 1,000 GPUs modulating in perfect lockstep.  In this simulation, current total harmonic distortion (**THD**) reached 46.8%, far exceeding the 13% guideline from **IEC 61000-3-12**. More critically, the damping ratio plummeted to -0.27, indicating an unstable mode where the grid amplifies disturbances instead of mitigating them. The researchers extended their model to a 9,241-bus grid resembling the European transmission network. Here, a localized disturbance equivalent to 2% of system load cascaded across 13 stages, resulting in an estimated 81% load shedding. It's important to note that this figure is a product of specific worst-case simulation assumptions, not a direct forecast. However, the concept of perfect lockstep synchronization across a real fleet of cloud GPUs remains an open challenge. The paper acknowledges that timing jitter with a standard deviation of 100 microseconds, even in a 2 kHz model, reduced aggregate amplitude by approximately 20%. A real-world attack would necessitate several conditions aligning: a sufficient cluster of physically proximate GPUs, precise synchronization, modulation that bypasses data center power conditioning, and a grid whose resonances amplify the chosen frequency. It is crucial to emphasize that the physical experiments were conducted in controlled testbeds, and the grid-scale damage was derived from simulation. No production systems were attacked, and no security flaw was disclosed in any specific commercial product.  ## Not Just Academic: Real-World Precedents While **Bit2Watt** is a research concept, its underlying physics has real-world parallels. In August 2025, **Microsoft**, **OpenAI**, and **NVIDIA** published their own paper on stabilizing AI-training power. They warned that the synchronized power swings of large training jobs, when aligned with a utility's critical frequencies, could "cause physical damage to the power grid infrastructure." **Bit2Watt** essentially takes this accidental effect and explores its deliberate weaponization. The grid has also experienced accidental disturbances from data centers. In July 2024, a transmission fault in a data-center-dense area of Northern Virginia led to approximately 1,500 MW of data center load dropping off the grid simultaneously as facilities switched to backup power. **NERC**, the entity overseeing North American grid reliability, stated that while this particular incident posed no immediate reliability risk, the danger escalates as these large loads grow. ## Watt2Bit and Covert Channels The research also explores **Watt2Bit**, the feedback loop where power disturbances affect computing. The analysis indicates that harmonic-driven heating and elevated current could trip thermal or overcurrent protection, leading to GPU server shutdowns and effectively a denial-of-service attack. Even more remarkably, the same power modulation can function as a covert channel. By encoding bits as two distinct frequencies (2 kHz for a '1' and 200 Hz for a '0'), the researchers successfully captured electromagnetic emissions with a near-field antenna wired to a software-defined radio, recovering a 50-bit test sequence with zero errors. This technique is akin to **PowerHammer**, an air-gap data-exfiltration attack previously covered by Ghost Protocol. The key distinction is that **PowerHammer** utilized data conducted along the power line, while **Bit2Watt's** channel requires an antenna to capture near-field electromagnetic interference directly at the hardware. Both methods, however, necessitate a physical foothold near the power infrastructure or the machine itself. ## No Simple Patch Detecting such modulation with standard telemetry is challenging. Rack PDU counters typically sample once per second, **NVIDIA's NVML** telemetry at 450 Hz, and even the fastest common interfaces like **RAPL** and server **BMCs** top out near 1 kHz. The modulation frequencies, however, run several times higher. A lightweight detector built by the researchers using power and **NVML** data performed poorly. Adding GPU profiling features improved detection, with dedicated EMI sensing proving most effective. **LTMA** was consistently harder to spot than **SWMA**. While these results come from a research-grade detector, they highlight the potential for hyperscalers to miss such activity. The fundamental challenge is not merely visibility. There is no specific product bug to patch because the vulnerability lies in the architecture itself: the intrinsic link between computation and power draw in modern GPUs. This necessitates a re-evaluation of how cloud infrastructure interacts with critical national infrastructure.