Bit2Watt Attack: Cloud Tenants Could Destabilize Power Grids Using Legitimate GPU Workloads

A new attack technique called Bit2Watt, detailed by researchers from Zhejiang University in a paper accepted to CHES 2026, demonstrates how a cloud tenant with ordinary GPU access can manipulate power draw to destabilize electrical grids without exploiting any software vulnerability. The attack works by toggling GPU compute loads between high-intensity and idle states, creating power oscillations at frequencies that can interfere with grid stability.

Two methods are described: SWMA uses a custom CUDA kernel to produce power components from 1.5 kHz to 6 kHz, while LTMA embeds modulation inside legitimate LLM training runs, making it harder to detect. In a simulated worst-case scenario with 1,000 GPUs modulating in lockstep on a 1 MW local grid, current total harmonic distortion reached 46.8%, far exceeding the 13% guideline from IEC 61000-3-12. A further simulation on a 9,241-bus European transmission network showed a localized disturbance cascading to shed about 81% of load.

The attack builds on prior research from Microsoft, OpenAI, and NVIDIA (August 2025) that warned synchronized power swings from large AI training jobs could cause physical damage to grid infrastructure. Bit2Watt weaponizes this accidental effect deliberately. The paper also describes Watt2Bit, a feedback loop where harmonic-driven heating can cause denial of service, and a covert channel using electromagnetic emissions to exfiltrate data.

No product bug exists to patch; the exposure is architectural. Defenses include batteries, supercapacitors, harmonic filtering on the power side, and anomaly detection on GPU utilization and training schedules on the compute side. Standard telemetry samples too slowly to catch the modulation, which runs at kilohertz frequencies.