Source-linked AI summary
Workload Identification with Physical Side Channels for AI Governance
Simone Gargiulo, Gabriel Kulp
TL;DR
AI governance needs ways to verify GPU workloads without trusting operator-controlled telemetry. This paper uses an auditor-owned current probe on an NVIDIA H200 and evaluates workload classification under honest and adversarial execution. Hardened detection catches at least 99% of three held-out evasion strategies, while diluted LoRA reaches at least 98% with a rescue rule.
Problem
AI compute verification requires identifying GPU activity without relying on operator self-report, while software-controlled telemetry can be forged or replayed.
Method
The paper records auxiliary-power current from an NVIDIA H200 using an external probe and classifies genuine and adversarial workloads with a two-stage detector.
Results
≥99%: hardened detection catches three of four held-out evasion strategies; diluted LoRA reaches ≥98% with a frequency-gated rescue rule.
Takeaways & Limitations
An auditor-owned physical side channel can add a detection layer whose evasion requires substantial workload modification rather than merely falsifying telemetry.
Takeaways & Limitations
The study uses one NVIDIA H200 NVL and a limited set of evasion strategies, so broader hardware and adversarial generalization remains to be established.
Abstract
from arXiv · showhide
AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. Here, we show that an external observer can identify the class of the workload running on an NVIDIA H200 from its power draw. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. We recorded $930$ five-second traces at $\sim 10$ MHz, covering seventeen open LLM families and twenty-five non-AI workloads. Over this corpus we separate training from inference and from non-AI computation with an accuracy of $97\%$ and a macro-averaged F1 score of $0.955$, evaluated on model families unseen during training. AI workload spectral content predominantly lies below $\sim 20$kHz and training is particularly recognizable through the memory-bound optimizer update. The GPU operator is then treated as adversarial and able to reshape the physical computation itself. Four evasion strategies are tested to disguise training as inference, producing an additional 680 adversarial traces. A detector hardened against evasion strategies, with the tested strategy held out, catches training $\geq 99\%$ of the time for three of the four strategies. The fourth, diluted low-rank adaptation (LoRA), is detected $48$--$88\%$ of the time with a hardened classifier, rising to $\geq 98\%$ with an additional rescue rule. While these attacks are not a comprehensive evaluation against adversarial behaviour, they offer initial insights beyond genuine activities and a dataset for developing and testing stronger evasion mechanisms.
1 Introduction
AI governance requires verifiers to identify what computation a GPU performs without relying on operator self-report. This work studies an auditor-owned current probe as a physical alternative to software-controlled telemetry, including under adversarial workload manipulation.
- GPU workload identification is an increasingly important measurement problem for regulating large-scale AI training.
- On-chip NVML telemetry can separate workloads for non-adversarial operators, but software-controlled readings can be forged or replayed.
- An external probe measures current at MHz-range resolution, bypassing operator control while trading telemetry’s multiple signals for a single high-resolution channel.
- The study records 1,610 traces, including 930 genuine and 680 adversarial traces, across seventeen model families and twenty-five non-AI workloads.
2 Measurement and corpus
The corpus measures aggregate auxiliary-power current from an NVIDIA H200 NVL during repeated workload execution. It covers diverse LLM families and training configurations using high-rate, fixed-window recordings.
- A Rogowski probe measures aggregate GPU current from the PCIe auxiliary supply at a nominal 10 MHz sampling rate in 5 s windows.The probe is AC-coupled with a specified 34 Hz–30 MHz bandwidth.
- The genuine dataset contains 930 traces from seventeen model families spanning 4B–21B parameters, dense and mixture-of-experts architectures, inference, and three training configurations.The training configurations are full fine-tuning, LoRA, and gradient accumulation.
- Each training configuration contributes 170 recordings, with ten independent captures for each model family.
3 Results
The detector uses staged, frequency-focused features to distinguish ML activity and then training, while experiments test honest and adversarial workloads under grouped evaluation. Training is especially recognizable through the memory-bound optimizer update, and hardening substantially improves detection of held-out evasion strategies.
- Detection setup: A two-stage random forest uses 30 predominantly frequency-domain features that do not depend on absolute signal amplitude.
- Detection setup: The classifier first separates ML-related activity from other workloads, then distinguishes training, using grouped cross-validation by model family.Accuracy and macro-averaged F1 are reported, with results averaged across independent splits and seeds.
- Adversarial evaluation: 28.1%–69.3%: evasion strategies reduce training throughput by reshaping the training pattern through chunking, decoy inference, throttling, or diluted LoRA.
- Physical signature: Training is most distinguishable through the optimizer update, a memory-transfer-limited phase absent from inference that produces a distinct spectral signature.
- Adversarial evaluation: 80–100% to ≥99%: hardening improves detection for dilution strategies, while diluted LoRA rises from 30–74% to 48–88%.The hardened unseen-strategy detector trains on three strategies and tests on the fourth.
- Adversarial evaluation: 90–100% and 98–100%: a frequency-gated rescue rule raises diluted LoRA detection for the genuine and hardened detectors, respectively.The rule targets a brief, deep low-frequency spectral dip left by the optimizer update.
4 Discussion
The physical probe detects diluted LoRA more effectively over shorter recordings than the cited on-chip comparison, but deployment requires physical access and introduces hardware and adversarial-scope limitations. Generalization beyond one H200 NVL and beyond four evasion strategies remains unresolved.
- Comparison: 48–88% and ≥98%: diluted LoRA detection reaches these rates with the hardened detector alone and with the rescue rule, respectively, using 5 s recordings.The comparison study reported 42.6% on its hardest white-box LoRA-with-dilution case using 15–60 s windows.
- Deployment trade-offs: The external probe requires physical access and likely continuous on-site monitoring, unlike zero-overhead telemetry.Its advantage is that evasion requires substantial modification of workload execution rather than merely falsifying reports.
- Limitations: The study uses one NVIDIA H200 NVL, so generalization across devices and hardware architectures remains to be established.
- Limitations: The adversarial corpus covers only a limited set of evasion strategies, with diluted LoRA hardest to detect because its optimizer-update footprint is shorter.
A Appendix
The appendix reports throughput penalties for evasion strategies and summarizes where training and inference spectral power resides. Most spectral power lies below 20 kHz, with the clearest phase separation below 200 Hz.
- Throughput penalty: Positive throughput-penalty values indicate slower training relative to honest full fine-tuning; +69.3% means 30.7% of the honest token rate.LoRA’s penalty comes from decoy inference interleaved with training updates.
- Spectral content: Almost all spectral power lies below 20 kHz, while training and inference separate most clearly below 200 Hz.The high-frequency bands above 20 kHz contribute only small shares of total power.
- Spectral content: The spectral comparison uses normalized median power shares across recordings, with separate columns for training and inference phases.Fractions are normalized within each recording so each phase sums to 100%.
A.1 Diluted LoRA rescue rule
The diluted-LoRA rescue rule detects a brief optimizer-update signature that can be averaged away by whole-recording features. It uses a low-frequency, deep-dip criterion calibrated on genuine recordings and evaluates its false-alarm trade-off out of fold.
- Diluted LoRA rescue rule: Diluted LoRA occupies only about 1% of the acquisition window with its optimizer update, causing whole-recording random-forest features to average away the training footprint.The rescue rule instead targets the short event directly.
- Detector and data: The two-stage detector uses 30 amplitude-independent features from frequency and time domains, including RMS-current envelope features over 2 ms frames.The genuine corpus contains 930 recordings spanning 93 labels and four workload configurations per model family.
- Dip detection: The rescue rule computes deep_dip from 0.5 ms RMS-current frames relative to a 20 ms rolling mean, making memory-bound optimizer updates produce larger values.Forward and backward passes are relatively flat, whereas an optimizer update creates a deeper local dip.
- Dip detection: A dip is accepted as an optimizer-update signature only when its centered 20 ms window has more than 50% of spectral power below 10 kHz.This spectral gate separates optimizer-update dips from idle or throttled GPU behavior.
- Calibration: The threshold τ is calibrated on genuine recordings as the smallest value that adds no in-sample false alarms, with separate values for each classifier setting.Diluted LoRA traces typically have a median deep_dip of approximately 0.68.
- Calibration: Out-of-fold calibration increases the false-alarm rate by +0.6, +2.5, and +1.4 percentage points for the genuine, unseen-strategy, and unseen-model detectors.This tests generalization beyond calibration recordings rather than relying only on the in-sample guarantee.