- What: Researchers at Zhejiang University published Bit2Watt at CHES 2026, showing that ordinary cloud GPU workloads can be shaped to oscillate a data center's power draw at kilohertz frequencies with no exploit or elevated privileges.
- Impact: In simulation, 1,000 synchronized GPUs on a 1 MW distributed-energy grid produced 46.8% current THD and a -0.27 damping ratio, an unstable mode where the grid amplifies rather than absorbs the disturbance.
- Fix / mitigation: No patch exists because no product flaw was disclosed; mitigation falls to providers instrumenting rack-level power telemetry, flagging periodic sub-millisecond load oscillation, and enforcing per-tenant power ramp limits.
- Who's at risk: Cloud and colocation operators running dense GPU fleets, utilities serving data-center-heavy feeders, and any facility where a large share of local supply comes from inverter-based distributed energy resources.
A cloud tenant with nothing more than a normal GPU reservation can drive a data center's power draw up and down fast enough to threaten the grid feeding it. No exploit, no malware on control systems, no stolen operator credentials. That is the claim behind Bit2Watt, described by three Zhejiang University researchers in a paper accepted to CHES 2026, the IACR's hardware-security conference.
The evidence splits cleanly in two, and the distinction matters. The power modulation was measured on real hardware. The grid destabilization was simulated. Nothing in production was attacked, and no vulnerability was disclosed in any commercial product. What the researchers demonstrated is that the input side of the attack is trivially available to any paying customer.
Why Compute Becomes Current
A GPU's power draw tracks whatever it is computing. Saturate the tensor cores and current spikes. Drop to idle and it collapses. Toggle between those states on a schedule and you have a controllable oscillation at the wall socket. The researchers frame the question bluntly: can purely computational actions, executed as legitimate workloads, be weaponized to destabilize power infrastructure?
The frequency band is what makes this different from ordinary load variation. A household air conditioner cycling on and off swings load at a handful of hertz. Bit2Watt operates three orders of magnitude higher, in territory where grid resonances and power-electronics control loops live.
Two Methods, One Hard to Catch
SWMA is the loud one. It uploads a purpose-built CUDA kernel that flips between high-intensity compute and near-idle. A host-side controller sets the switching schedule and toggles the mode through a single unified-memory flag allocated with cudaMallocManaged. Standard tooling, nothing exotic. Across tested GPUs it produced power components from roughly 1.5 kHz up to 6 kHz, peaking on an RTX 4090, and it held on data-center silicon including the A100 and Tesla V100 rather than just gaming cards.
LTMA is the one operators should care about. Instead of a synthetic kernel, it buries the modulation inside a real LLM training run, adjusting hyperparameters and inserting auxiliary operations so the compute load rises and falls without breaking training. Control is looser, bounded by how fast the training loop iterates, and frequencies run lower at roughly 1.2 to 3 kHz. But amplitude is larger and the signal blends into normal training noise.
- SWMA: custom CUDA kernel with a tight polling loop, 1.5-6 kHz, fingerprintable by a provider that looks for it
- LTMA: modulation hidden in legitimate LLM training, 1.2-3 kHz, higher amplitude, indistinguishable from normal training behavior
- Neither requires elevated privileges, since a tenant already controls their own training scripts and job schedules
- Both are workload design problems, not software vulnerabilities, so there is nothing to patch
The Simulated Blast Radius
Single-GPU numbers only bite in bulk. The paper models the bulk case at its most aggressive: a simulated 1 MW local grid, 90% powered by distributed energy resources such as rooftop solar and batteries, with 1,000 GPUs modulating in perfect lockstep. Current total harmonic distortion hit 46.8%, well above the 13% guideline the paper benchmarks against from IEC 61000-3-12. The damping ratio fell to -0.27, a negative value marking an unstable mode where the grid amplifies a disturbance instead of damping it out.
The paper pushes further onto a 9,241-bus model resembling the European transmission network, where a localized disturbance worth 2% of system load cascades across 13 stages and sheds about 81% of load. Treat that figure as a property of one specific simulation stacking worst-case assumptions, not a forecast.
Perfect synchronization across 1,000 GPUs is the optimistic case for the attacker, and the researchers concede that aligning power transitions across a real cloud fleet is an open problem. In their own 2 kHz model, timing jitter with a standard deviation of just 100 microseconds cut aggregate amplitude by roughly 20%. A working attack would need physically clustered GPUs, tight synchronization, modulation that survives the facility's power-conditioning stages, and a grid whose resonances happen to amplify the chosen frequency. Those conditions are not guaranteed to line up, and the paper does not claim they typically do.
The Physics Is Already on Record
What keeps Bit2Watt out of the purely academic pile is that the underlying effect was documented by vendors before anyone weaponized it. In August 2025, Microsoft, OpenAI, and NVIDIA published a joint paper on stabilizing AI-training power, warning that synchronized swings from large training jobs can, when their frequency aligns with a utility's critical frequencies, cause physical damage to power grid infrastructure. Bit2Watt takes that accidental effect and asks what a tenant could do with it deliberately.
The grid has also already absorbed a scare from data centers behaving badly by accident. In July 2024, a transmission fault in a data-center-dense part of Northern Virginia caused roughly 1,500 MW of data-center load to drop off the grid at once when facility protection systems cut over to backup power. NERC said the disturbance posed no reliability risk at the time, though operators had to correct voltage, and warned the danger grows as these loads scale. Its technical committee stood up a Large Loads Task Force later in 2024. Nobody attacked anything. The point is that a load that size can disappear in an instant, faster than operators can plan for, and the risk climbs as fleets grow.
What Defenders Can Actually Do
There is no CVE and no vendor advisory, which means the response is architectural rather than a patch cycle. The researchers also describe the reverse coupling they call Watt2Bit, where harmonic-driven heating and elevated current can trip thermal or overcurrent protection back on the compute side, meaning a facility running this workload risks its own uptime.
- Instrument rack-level and PDU-level power telemetry at sampling rates high enough to see kilohertz components, since facility monitoring built for thermal trending will miss this entirely
- Alert on sustained periodic power oscillation from a single tenant or rack, particularly narrowband energy in the 1-6 kHz range
- Enforce per-tenant power ramp limits and slew-rate caps at the scheduler or DCIM layer rather than relying on average consumption quotas
- Review power-conditioning and filtering between GPU racks and the utility interconnect, since that stage determines how much of any modulation actually reaches the grid
- Engage the serving utility on local resonance characteristics, especially on feeders with a high share of inverter-based distributed energy resources
- Treat the July 2024 Virginia event and the NERC Large Loads Task Force output as the baseline scenario, whether the trigger is malicious or a protection scheme doing its job
The honest read: Bit2Watt is a credible measurement paired with an aggressive simulation, and the gap between them is synchronization at scale, which nobody has demonstrated. That gap is a research problem, not a physical law. Operators building out dense GPU capacity should assume it narrows.
Questions about your exposure?
RedEye Security provides assessments for organizations that need to understand their real risk.
Talk to us