# A Cloud Tenant With GPU Access Can Now Threaten the Power Grid — No Exploit Required
The scariest grid attacks in security research have always involved getting into something: a compromised SCADA system, stolen operator credentials, malware smuggled onto an industrial controller. The implicit assumption was that destabilizing a power grid required first breaking into the systems that run it.
Three researchers from Zhejiang University just challenged that assumption in a paper accepted at CHES 2026. Their technique, Bit2Watt, needs none of that. No credentials. No privilege escalation. No malware. Just a cloud GPU rental and a workload engineered to misbehave on a schedule.
## The Physics Behind It
The core insight is almost embarrassingly simple once you say it out loud: a GPU's power draw is a direct function of what it's computing. Saturate the tensor cores and current spikes. Drop to near-idle and it collapses. Toggle between those states fast enough and you're not just drawing power erratically — you're generating a controllable oscillation at the wall socket.
The researchers quantified it across real hardware. On an RTX 4090, their synthetic workload produced power components from roughly 1.5 kHz up to 6 kHz — orders of magnitude above the handful of hertz a swinging household load like a central air system produces. The same effect held on data-center-class hardware: the A100, Tesla V100. This isn't a quirk of consumer GPUs.
## Two Methods, One Harder to Catch
The paper describes two attack variants with meaningfully different detection profiles.
The first, SWMA, uploads a purpose-built CUDA kernel that flips between high-intensity compute and near-idle via a single unified-memory flag allocated with cudaMallocManaged — standard tooling, nothing exotic. A host-side controller sets the switching schedule. The power oscillation is precise and reproducible. It's also the one that's easier to fingerprint: the synthetic kernel and its tight polling loop look unusual in profiling data, and a cloud provider watching workload telemetry could learn to flag it.
The second method, LTMA, is the one that should make operators uneasy. Instead of a synthetic kernel, it buries the modulation inside a legitimate LLM training run. Hyperparameters are adjusted. Auxiliary operations are inserted. The compute load rises and falls without breaking the training itself. The power signal is noisier — frequencies run from roughly 1.2 to 3 kHz, with looser control bounded by training loop iteration speed — but it reaches larger amplitude and blends into normal training noise. That noise is the point. A security team watching GPU telemetry would see something that looks like a large language model training run, because it is one.
Neither method requires elevated privileges. A cloud tenant already controls their own training scripts and job schedules. That access is the attack surface.
## The Bulk Problem — and the Honest Caveat
A single GPU oscillating at 6 kHz is not bringing down a grid. The researchers are clear on this. The threat only materializes at scale, and the paper's most dramatic numbers come from a simulation: 1,000 GPUs switching in lockstep on a modeled 1 MW local grid with 90% distributed energy resources feeding it.
In that worst-case scenario, current total harmonic distortion hit 46.8%, more than three times the 13% IEC 61000-3-12 guideline. The damping ratio fell to -0.27 — negative values mark an unstable mode, where the grid amplifies rather than absorbs a disturbance. The researchers extended the model to a 9,241-bus network meant to resemble the European transmission grid; a localized disturbance representing 2% of system load cascaded through 13 stages and shed roughly 81% of load in simulation.
That 81% number will travel. It should come with its asterisks.
The paper is honest about the load-bearing assumption in its threat model: coordinating 1,000 cloud GPUs to switch in lockstep is still an open problem. Timing jitter with a standard deviation of just 100 microseconds cut aggregate amplitude by around 20% in their 2 kHz model. Real cloud infrastructure has more jitter than that, and cloud schedulers are not built to synchronize arbitrary workloads with microsecond precision. Attackers would also need either a single massive cloud account — expensive and fingerprintable — or some coordination mechanism across tenants, which reintroduces the kind of infrastructure footprint a sophisticated attacker might prefer to avoid.
The cascade simulation is also a property of the model, not a forecast. Real grids have reactive power compensation, frequency response reserves, and operators who notice when something is wrong. The 81% figure represents a simulation run to completion under worst-case assumptions, not a prediction of what happens when someone rents a thousand H100s.
## Why This Paper Matters Regardless
Even with every caveat applied, the research points at a structural problem that isn't going away. Data centers are increasingly feeding off and feeding into grids that are themselves becoming less stable — more distributed generation, more variable renewable sources, less mechanical inertia. The grid was not designed with the assumption that a single commercial tenant could be colocated with thousands of high-density compute nodes sharing a common interconnect.
The LTMA variant in particular illustrates a detection challenge that has no clean solution today. Power-draw monitoring at the hypervisor level might catch SWMA's synthetic kernel. It will not trivially catch a training job that is genuinely training a model while also modulating power as a side effect. The research doesn't just describe an attack — it describes a class of attack: legitimate-looking compute workloads that have physical infrastructure effects.
---
## HackWire Analysis
What Bit2Watt actually represents is a convergence of two trends that security researchers have been watching in isolation: the physical footprint of AI compute, and the increasing brittleness of grid infrastructure as it absorbs more distributed energy resources.
The power grid was engineered around loads with predictable behavior — motors, lighting, HVAC. Data centers were already unusual in their density and their rapid ramp capacity. The AI buildout of the past three years has made that worse by orders of magnitude: a single hyperscale cluster can draw hundreds of megawatts, and the training workloads running on it can swing dramatically in ways that grid operators have no visibility into.
Traditional critical infrastructure attacks have been nation-state territory precisely because they required compromising industrial control systems — a high-skill, high-risk operation. Bit2Watt doesn't change that threat model completely, because the lockstep coordination problem is real and the detection risk for large-scale attempts is non-trivial. But it demonstrates that the attack surface now includes the compute layer, not just the control layer.
The comparison to watch is Stuxnet in reverse. Stuxnet used software to cause physical effects by commanding hardware to misbehave invisibly. Bit2Watt uses software to cause physical effects by commanding hardware to do exactly what it's told to do — but with the wrong timing. The defense against Stuxnet was network segmentation and control-system hardening. The defense against Bit2Watt is harder to articulate, because the compute is supposed to be doing exactly what it's doing.
Defenders at cloud providers should be looking at power telemetry as a security signal, not just an ops metric. Grid operators in markets with large data-center concentration — Northern Virginia, the Netherlands, Singapore — should be having conversations with those tenants about synchronized-load scenarios. And IEC standards for harmonic distortion were not written with AI training workloads in mind. That's a gap worth closing before someone runs this test at scale.
— HackWire Editorial
---
## Related Coverage