Researchers in China have identified a novel cyber-physical vulnerability, dubbed Bit2Watt, that could allow malicious cloud tenants to destabilize data centers and the broader electrical grid by manipulating GPU workloads. The attack, detailed in a preprint paper by Zhouhao Ji, Kaikai Pan, and Wenyuan Xu from Zhejiang University, highlights a potential pathway for adversaries to cause blackouts or damage equipment by exploiting the power demands of artificial intelligence (AI) training.
The core of the Bit2Watt attack involves a malicious actor masquerading as a legitimate cloud customer to launch specially crafted GPU workloads. These workloads are designed to induce rapid and significant power fluctuations within data centers. While AI training workloads are known to cause power swings, the researchers demonstrated that malicious GPU loads can achieve modulation frequencies exceeding 6,000 Hz, significantly higher than the few hertz observed in typical household loads. Such high-frequency modulations can lead to substantial voltage excursions, harmonic distortion, and damping degradation in the power system.
The researchers claim that an attack employing 1,000 GPUs on a 1-megawatt local power grid, particularly one reliant on distributed energy resources like photovoltaics, could generate a total harmonic distortion of 46.8 percent. This level of distortion would result in nearly half the electrical current being wasted on non-productive work and an approximate 20 percent increase in heat generation. Furthermore, the attack could produce a negative damping ratio of -0.27, introducing instability into the system. The authors warn that if protective measures are triggered and computing loads are shed, it could initiate cascading failures, potentially leading to blackouts affecting over 80 percent of large-scale power systems.
The attack is described as covert because it operates within authorized workload execution paths, making it difficult for current cloud provider monitoring frameworks to detect. The researchers emphasize the need for infrastructure providers to implement coordinated defenses across both cyber and physical layers, specifically looking for malicious computation patterns. They also recommend the use of local energy buffering systems to manage power demand spikes.
The findings align with observations from major technology companies regarding the power challenges posed by AI training. Microsoft, Nvidia, and OpenAI noted in a 2025 research paper that the transition between GPU computation and data synchronization causes large power swings. They cautioned that if the frequency spectrum of these swings harmonizes with critical utility frequencies, it could physically damage power grid infrastructure. Similarly, Meta's paper on training Llama 3 cited the risk of tens of thousands of GPUs simultaneously increasing or decreasing power consumption, leading to instantaneous fluctuations of tens of megawatts that can strain the power grid.
Beyond causing direct grid instability, the Bit2Watt research also points to a potential side-channel attack called Watt2Bit. The electrical and thermal stress induced by malicious workloads could create denial-of-service events and enable the covert exfiltration of data through power modulation. As a proof of concept, the researchers demonstrated the recovery of a 50-bit test sequence using frequency-shift keying (FSK) encoding.
The researchers conclude that the convergence of power and computing infrastructures necessitates a fundamental shift in security approaches. They advocate for coordinated defenses that comprehensively consider workload behavior, power electronics, and grid dynamics to address these emerging threats.
