"Our results indicate that GPU loads can reach modulation frequencies exceeding 6,000 Hz, compared with only a few hertz observed in conventional household loads such as air conditioners," the Zhejiang University authors state in their paper.
Bit2Watt: a new cyber‑physical attack outlined by Zhejiang University researchers
Researchers Zhouhao Ji, Kaikai Pan, and Wenyuan Xu of Zhejiang University in Hangzhou describe a technique they call Bit2Watt in a preprint titled "Bit2Watt: A Cyber-Physical Vulnerability Exploiting GPU Workloads Across Power and Computing Infrastructures." The paper frames Bit2Watt as a scenario in which a malicious cloud tenant—operating within normal, authorized workload execution paths—uses GPU workloads to intentionally modulate power draw in ways that harm datacenter and grid stability.
How GPU workloads translate into harmful power swings
The authors build on prior observations about AI training behavior. They cite a 2025 research paper by Microsoft, Nvidia, and OpenAI arguing for "power stabilization during AI training," which warned that the transition from GPU computation to GPU data synchronization causes large power swings. The Zhejiang team and Meta’s Llama 3 paper note that tens of thousands of GPUs acting in concert—for example when waiting for checkpointing or during collective communications—can cause instantaneous, large changes in datacenter power consumption on the order of tens of megawatts.
Bit2Watt weaponizes those dynamics: by orchestrating GPU activity patterns, an adversary can create high-frequency modulation in datacenter draw that is unlike conventional household loads and that can interact with utility-system dynamics.
Measured and modeled impacts on datacenters and local grids
According to the preprint, GPU-induced modulations can exceed 6,000 Hz—orders of magnitude higher than the "few hertz" typical of appliances such as air conditioners. The researchers claim that on a 1‑megawatt local power grid dominated by distributed energy resources (including photovoltaics), a coordinated workload run on roughly 1,000 GPUs could produce a total harmonic distortion (THD) of 46.8 percent. They say that level of distortion would dissipate nearly half the electrical current into non‑productive harmonics and increase heat by about 20 percent.
The authors further contend that the electrical effects could produce a negative damping ratio of −0.27, introducing an unstable mode into the system. In their modeling, once protections trip and computing loads are shed, cascading failures could follow—potentially producing blackouts "exceeding 80 percent in large-scale power systems," the paper asserts.
Watt2Bit: a side channel that turns power stress into data exfiltration
Bit2Watt also opens the door to a covert channel the authors call Watt2Bit. They argue that electrical and thermal stress from malicious workloads can not only create denial‑of‑service conditions but also enable covert exfiltration of data via power modulation. As a proof of concept, the Zhejiang team reports recovering a 50‑bit test sequence using frequency‑shift keying (FSK) encoding carried in power variations.
What this means for datacenter operators, utilities, and cloud providers
- Datacenter operators and security teams: The authors recommend extending cybersecurity defenses to include workload scheduling and detection of malicious computation patterns that could be authorized but harmful to the power plane.
- Utilities and grid operators: The paper highlights how distributed energy resources and local grids can be sensitive to high‑frequency harmonics; the researchers emphasize coordinated attention to power electronics and grid dynamics when assessing new loads like large GPU fleets.
- Cloud infrastructure providers: The Zhejiang team urges coordination across cyber and physical layers and advocates for local energy buffering systems to absorb demand spikes and blunt rapid power modulation.
The Zhejiang University paper ends with a clear prescription: as computing and power systems converge, defenses must be coordinated across domains to account for workload behavior, power electronics, and grid dynamics. The authors demonstrate both a destructive pathway—harm that could damage hardware or trigger cascading outages—and an information‑leak pathway via Watt2Bit. Whether cloud providers, utilities, and regulators will adopt the specific cross‑layer monitoring and buffering measures the paper recommends is the practical question the research leaves on the table.
