Bit2Watt Attack Turns AI Data Centers Into Cyber-Physical Threats to Local Power Grids

Bit2Watt is a newly disclosed cyber‑physical attack class that weaponizes AI and GPU workloads in modern data centers to destabilize nearby power grids, turning compute infrastructure itself into a grid‑scale threat surface.

Measurements on NVIDIA accelerators show sub‑millisecond power ramps where a single Volta V100 or RTX‑series GPU swings from low-load phases to near‑TDP draw, and large facilities may host tens of thousands of such devices backed by substantial solar and battery capacity.

This architecture produces a converter‑dominated system whose stability is governed more by control loops and impedance interactions than by classical synchronous inertia, creating a subtle but exploitable attack surface.

Bit2Watt assumes a fully “legitimate” cloud tenant who controls large GPU allocations via normal AI or HPC jobs and never compromises grid‑side equipment, OT, or cloud control planes.

Instead, the adversary engineers workload‑driven power modulation, using GPUs as controllable excitation sources that inject fast, high‑frequency current fluctuations into the facility’s electrical interface.

Two concrete techniques are defined: a Synthetic Workload Modulation Attack (SWMA), implemented as CUDA kernels that toggle between compute‑saturating and near‑idle states under a host‑controlled schedule.

An LLM Training Modulation Attack (LTMA), which embeds modulation logic directly into standard deep‑learning training pipelines by manipulating batch sizes, auxiliary operations, or hyperparameters.

SWMA reaches modulation frequencies up to about 6 kHz on GPUs such as RTX 4090 and A100, while LTMA achieves lower but higher‑amplitude modulation that closely resembles normal training noise, making cloud‑side detection harder.

At the board level, GPU voltage regulator modules hold core voltage nearly constant, so workload‑driven power swings present upstream as rapid current changes a classic constant‑power load with negative incremental resistance.

In the impedance‑based model, a DER‑rich local grid is represented as a Thévénin source, inverter‑controlled current sources, and a GPU cluster modeled as a CPL plus workload‑controlled current sink at the point of common coupling.

Arxiv Researchers said that, the Bit2Watt work starts from a now-familiar reality: hyperscale AI data centers aggregate tens of megawatts of highly volatile GPU load, tightly coupled to inverter‑dominated, DER‑rich local grids through UPS, PDUs and switching power supplies.

High‑frequency current modulation from orchestrated GPU workloads excites resonant modes in DER control loops and grid filters, dramatically degrading power quality (voltage excursions and harmonics) and eroding damping margins in weak‑grid conditions.

Bit2Watt Attack Turns AI Data Centers

Experiments and impedance scanning on PV inverters show distinct high‑frequency resonance peaks, while real‑world measurements on a ~100‑GPU cluster empirically confirm constant‑power behavior and negative resistance effects under deliberate voltage sags and swells.

The authors extend the threat into a closed‑loop risk they term Watt2Bit: grid‑side disturbances propagate back into the data center, stressing power‑delivery equipment and GPUs themselves.

Elevated harmonics and crest factors raise RMS currents and thermal stress in UPS, SPS and VRMs, in turn triggering over‑temperature and over‑current protections that can abruptly shed compute loads and induce denial‑of‑service across AI clusters.

Beyond availability, the same modulation machinery can be used as a covert exfiltration channel, encoding information in attack frequency or amplitude and decoding it from EMI or power traces observed at the electrical interface, effectively turning watt‑level disturbances into bit‑level side‑channel leakage.

Simulation of a 1 MW local power system roughly representative of a data‑center‑dense region like Northern Virginia shows that coordinated manipulation of hundreds to a thousand GPUs can push the system past standard power‑quality and stability thresholds, especially at high DER penetration.

Under 90% DER penetration, total current harmonic distortion reaches about 46.8% with 1,000 GPUs synchronized, far above IEC 61000‑3‑12 guidance.

At the same time, the damping ratio crosses zero and becomes negative, indicating onset of oscillatory instability.

Follow‑on studies on the IEEE 118‑bus transmission‑scale model reveal frequency bifurcation into coherent areas once these thresholds are breached, illustrating that a localized AI data center can seed wider‑area oscillations.

Practically, the work underscores that cheap, on‑demand GPU rentals, topology‑aware schedulers that co‑locate GPUs in the same racks, and cloud‑time synchronization services all inadvertently facilitate spatial and temporal aggregation of attack power.

𝗔𝗜 𝗦𝗢𝗖 𝘃𝘀 𝗠𝗗𝗥 𝘃𝘀 𝗠𝗦𝗦𝗣 Which is Best in 2026? Compare costs, Automation, and response: Download Free Guide