Bit2Watt attack shows how malicious cloud tenants could destabilize power grids using GPU workloads

Malicious cloud customers can bring down the power grid

AI datacenters wreak havoc on the power grid under normal circumstances, so what happens if a bad actor controls all the GPUs and wants to cause harm? Cybersecurity researchers in China have devised a way for malicious tenants to attack their infrastructure provider, potentially causing blackouts or damaging equipment. The attack, dubbed Bit2Watt, imagines an adversary masquerading as a legitimate cloud tenant to launch GPU workloads that have the potential to damage datacenters and supporting electrical systems. It's intended to demonstrate the need to extend cybersecurity defenses to datacenter workload scheduling. The researchers, Zhouhao Ji, Kaikai Pan, and Wenyuan Xu, from Zhejiang University in Hangzhou, China, describe their technique in a preprint paper titled "Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures." AI training workloads represent a known challenge for datacenter operators. As Microsoft, Nvidia, and OpenAI noted in a 2025 research paper arguing the need for power stabilization during AI training, the transition from GPU computation to GPU data synchronization causes large power swings to occur. And if the frequency spectrum of these power swings is "harmonized with critical frequencies of utilities, [that] can cause physical damage to the power grid infrastructure." Meta's paper on the training of Llama 3 also cites the risk AI training poses to the power grid. It says, "During training, tens of thousands of GPUs may increase or decrease power consumption at the same time, for example, due to all GPUs waiting for checkpointing or collective communications to finish, or the startup or shutdown of the entire training job. When this happens, it can result in instant fluctuations of power consumption across the datacenter on the order of tens of megawatts, stretching the limits of the power grid." Bit2Watt weaponizes this scenario by proposing that an adversary could use malicious GPU workloads to destabilize the datacenters and electrical infrastructure. "Our results indicate that GPU loads can reach modulation frequencies exceeding 6,000 Hz, compared with only a few hertz observed in conventional household loads such as air conditioners," the Zhejiang University authors state in their paper. "Such high-frequency modulations can substantially induce voltage excursions, harmonic distortion, and damping degradation." The authors claim an attack on a 1-MW local power grid consisting mainly of distributed energy resources like photovoltaics could use 1,000 GPUs to create a total harmonic distortion of 46.8 percent, which would squander nearly half the electrical current on non-productive work and would throw off about 20 percent more heat than normal. "This not only threatens the availability of the computing equipment but also produces a negative damping ratio of -0.27, introducing an unstable mode into the system," the authors contend. "Once the protections are triggered and computing loads are shed, it can trigger cascading failures, potentially leading to blackouts exceeding 80 percent in large-scale power systems." The attack is relatively covert, the authors argue, because it can be launched within authorized workload execution paths and would likely be missed by cloud-provider monitoring frameworks. Thus, they propose that infrastructure providers coordinate defenses across the cyber and physical layers to look for malicious computation patterns. They also emphasize the need for local energy buffering systems to handle power demand spikes. Bit2Watt also potentially opens the door for a side-channel attack called Watt2Bit. The researchers note that the electrical and thermal stress on hardware from a malicious workload creates denial of service events and enables the covert exfiltration of data via power modulation. As a proof of concept, they showed they could recover a 50-bit test sequence using frequency-shift keying (FSK) encoding. "These findings underscore a fundamental shift: as power and computing infrastructures converge, security must be addressed across domains, requiring coordinated defenses that consider workload behavior, power electronics, and grid dynamics," the authors conclude. ®

Bit2Watt: a cloud tenant could destabilise the power grid

Chinese researchers say a cloud customer needs no hack, no malware, and no stolen password to put a power grid under strain. Just a rented GPU and a workload built to misbehave. The catch is that the scariest numbers come from a simulation, not a real attack. AI data centres already strain the grid just by running. A new paper asks a darker question: what if a tenant tried to break it on purpose? Three researchers at Zhejiang University set out the idea in a preprint called Bit2Watt, accepted to a leading hardware-security conference. As The Register reported, it imagines a paying customer as the attacker. How it works The trick rests on a simple fact. A GPU's power draw follows whatever it is computing. Load it hard and the current spikes. Let it idle and the current drops. Flip between those states on a schedule and you get a controllable power wobble at the wall socket. The researchers pushed it past 6,000 times a second, far faster than the gentle sway of a household load like an air conditioner. They show two ways to do it. One uses a purpose-built workload that a provider might learn to spot. The other, harder to catch, hides the pattern inside a real AI training run, where it blends into normal noise. Neither needs special access, because a tenant already controls its own jobs. The scary number, and the asterisk Alone, one GPU does little. The danger, the paper argues, is in bulk. It models 1,000 GPUs pulsing in perfect lockstep on a small grid mostly fed by solar and batteries. In that worst case, the simulated grid turns unstable, wasting nearly half its current and running hot. Pushed onto a model of the European transmission network, a small local disturbance cascades until it sheds about 81% of the load. Here is the asterisk. As reporting on cloud attacks often has to stress, that figure is a property of one simulation stacked with worst-case assumptions, not a forecast. The whole attack hinges on getting a real fleet of cloud GPUs to pulse in perfect sync, which the authors admit is still unsolved. No live system was attacked. Grounded in real physics What keeps this from being pure theory is that the physics is on record. In 2025, Microsoft, OpenAI, and Nvidia warned that the synchronised power swings of large training jobs can damage grid infrastructure when their rhythm lines up with a utility's. Meta flagged the same risk while training Llama 3. The grid has already had a fright by accident. In July 2024, a fault near data-centre-heavy Northern Virginia knocked about 1,500 megawatts of load off the grid at once. Regulators said there was no crisis, then set up a task force to study the danger as these power-hungry sites multiply. The loop back, and no bug to patch The researchers also sketch a feedback attack they call Watt2Bit. The same electrical stress that rattles the grid can overheat the servers, tripping their protection and knocking them offline. A power problem becomes a denial of service. The awkward part is that there is no bug to patch. Standard monitoring samples power far too slowly to catch the fast flicker. The deeper issue is the design itself. Volatile GPU loads now sit on a grid full of solar inverters, and nothing watches across the two. As the data centre and the grid it leans on grow more entangled, they stay run by different firms, watched by different tools. That seam, the paper implies, has no clear owner. Fixes exist on each side, but tying them together is still to come, even as the AI build-out races ahead.

Experts warn hackers could shut down entire power grids by hijacking cloud accounts

* Zhejiang University researchers warned GPU workloads could destabilize local grids and cause blackouts * Attackers could exploit ~1,000 GPUs to drain current and generate excess heat in systems * Theoretical attack dubbed Bit2Watt; mitigations include detecting malicious patterns and energy buffering systems Whenever an AI data center thinks really, really hard, it can increase its power consumption so much to trigger disruptions and possibly even blackouts and gear malfunctions. So, is it possible for a malicious actor to trigger this scenario deliberately, in order to cause physical harm? Multiple researchers from the Zhejiang University in Hangzhou, China, wrote a research paper titled "Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures." In it, they claim that a malicious cloud tenant is, in theory, capable of launching GPU workloads so intensive that they cause physical damage. Suggesting mitigations "Our results indicate that GPU loads can reach modulation frequencies exceeding 6,000 Hz, compared with only a few hertz observed in conventional household loads such as air conditioners," the team wrote in its research paper. "Such high-frequency modulations can substantially induce voltage excursions, harmonic distortion, and damping degradation." An attacker could use around 1,000 GPUs to target a one-megawatt local power grid consisting primarily of distributed energy sources (such as solar panels), making it lose almost half of the electrical current, while generating around 20% more heat than usual. "This not only threatens the availability of the computing equipment but also produces a negative damping ratio of -0.27, introducing an unstable mode into the system," the paper adds. "Once the protections are triggered and computing loads are shed, it can trigger cascading failures, potentially leading to blackouts exceeding 80 percent in large-scale power systems." AI data centers creating huge energy consumption swings is no news, and it's a challenge some of the brightest minds of today are trying to solve. Luckily, the attack is (still) purely theoretical, and the researchers published the paper to warn about potential misuse. They also suggested mitigations - defenders could look for malicious computational patterns, while operators should create energy buffering systems for unusual spikes in demand. Via The Register Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.