Powerful AI clusters are increasingly linking computing to energy, and IT specialists have shown how the usual GPU load can turn into an instrument of influence on a local power grid. The new model of the attack was called Bit2Watt. It does not require hacking into the data center, cloud platform or power grid management systems.
The alleged attacker leases a large pool of GPUs legally and triggers AI tasks or high-performance calculations. A specially tuned program quickly switches accelerators between intense work and almost complete downtime. As a result, energy consumption changes dramatically, and synchronized GPUs create controlled current fluctuations.
The authors described the two methods. The first uses a CUDA code that alternates the maximum and minimum load with a frequency of up to 6 kHz. The second embeds energy management in the usual training of the neural network through the size of data packets, additional operations and model parameters. This option works more slowly, but creates stronger fluctuations and better disguises itself as the normal operation of the AI cluster.
Measurements on the cluster of approximately 100 GPUs confirmed that sharp changes in the load are transmitted to the power system. Tests of solar inverters also revealed resonant frequencies at which fluctuations worsened the quality of electricity, increased harmonic distortions and reduced the stability of the network. The authors did not report a real attack on the current energy system.
In a simulation of a 1 MW local network, synchronous operation from several hundred to a thousand GPUs has deduced indicators beyond the permissible limits. With a share of distributed energy sources of 90% and the simultaneous load of 1000 accelerators, current distortion reached 46.8%. The model also showed the risk of increasing fluctuations that could affect a larger section of the power system.
The opposite effect of the authors called Watt2Bit. Outrages in the network can return to the data center, overheat power supplies and voltage converters, turn on hardware protection and stop computing. Theoretically, the same mechanism allows you to encode data in the frequency and amplitude of energy consumption, and then read the signal by electromagnetic interference or electrical measurements.
The alleged attacker leases a large pool of GPUs legally and triggers AI tasks or high-performance calculations. A specially tuned program quickly switches accelerators between intense work and almost complete downtime. As a result, energy consumption changes dramatically, and synchronized GPUs create controlled current fluctuations.
The authors described the two methods. The first uses a CUDA code that alternates the maximum and minimum load with a frequency of up to 6 kHz. The second embeds energy management in the usual training of the neural network through the size of data packets, additional operations and model parameters. This option works more slowly, but creates stronger fluctuations and better disguises itself as the normal operation of the AI cluster.
Measurements on the cluster of approximately 100 GPUs confirmed that sharp changes in the load are transmitted to the power system. Tests of solar inverters also revealed resonant frequencies at which fluctuations worsened the quality of electricity, increased harmonic distortions and reduced the stability of the network. The authors did not report a real attack on the current energy system.
In a simulation of a 1 MW local network, synchronous operation from several hundred to a thousand GPUs has deduced indicators beyond the permissible limits. With a share of distributed energy sources of 90% and the simultaneous load of 1000 accelerators, current distortion reached 46.8%. The model also showed the risk of increasing fluctuations that could affect a larger section of the power system.
The opposite effect of the authors called Watt2Bit. Outrages in the network can return to the data center, overheat power supplies and voltage converters, turn on hardware protection and stop computing. Theoretically, the same mechanism allows you to encode data in the frequency and amplitude of energy consumption, and then read the signal by electromagnetic interference or electrical measurements.
