Bit2Watt: The GPU Attack That Can Destabilize the Power Grid Without Malware or Exploits

Researchers at Zhejiang University have disclosed a new class of cyber-physical attack called Bit2Watt that inverts the traditional grid-attack model. Instead of compromising sensors, stealing credentials, or planting malware, a malicious cloud tenant simply runs legitimate GPU workloads to destabilize the electrical grid feeding the data center . The preprint, authored by Zhouhao Ji, Kaikai Pan, and Wenyuan Xu, is accepted to CHES 2026, the IACR's leading hardware-security conference .

Here is what the research reveals and why grid regulators are already treating it as a serious emerging threat.

How Bit2Watt Works: A GPU's Power Draw as a Weapon

A GPU's electrical power draw directly follows its compute load: heavy computation draws high current; idling draws low current. A malicious cloud tenant simply toggles between these states using legitimate GPU workloads. This creates controllable power oscillations at the wall socket that propagate through the facility's power infrastructure into the local grid .

The attack requires no malware, no privilege escalation, and no intrusion into grid control systems—the tenant already has the right to run GPU jobs .

Two Attack Techniques and Lab Results

Technique	Approach	Max modulation frequency
SWMA (Synthetic Workload Modulation Attack)	Custom CUDA kernels that rapidly flip GPU between compute-intensive and idle states	Up to 6,000 Hz on Nvidia GPUs
LTMA (LLM Training Modulation Attack)	Manipulating the training loop of a legitimate large language model to create periodic power fluctuations	Lower frequency, but harder to distinguish from normal AI training

SWMA produced the fastest oscillations (6,000+ Hz), while LTMA achieved modulation within the range of legitimate LLM training patterns . Both techniques demonstrate that a cloud tenant can produce power swings far faster than the gentle sway of a household appliance like an air conditioner .

Worst-Case Simulation Results

The researchers modeled the impact at two scales:

• 1,000 synchronized GPUs on a 1 MW local system: Power oscillations drove total harmonic distortion above 10%, causing unstable voltage in 3 of 5 IEEE benchmark distribution feeders and triggering protection relay tripping . The attack had a >80% probability of causing cascading failures and blackouts in the local distribution network .

• Scaled to a European transmission network model: Synchronized power oscillations at resonant frequencies could propagate as inter-area oscillations across wide-area transmission corridors, threatening continental-scale stability .

Regulators Were Already Alarmed by AI Data Center Load Volatility

The Bit2Watt attack arrives as grid regulators have been issuing increasingly urgent warnings about the reliability risks of AI data centers.

The North American Electric Reliability Corporation (NERC) has documented that AI training campuses at gigawatt scale can drop 1,000+ MW in under a second when protection systems trip—faster than conventional grid safeguards can respond . In May 2026, NERC issued a rare Level 3 "Essential Actions" Alert—its highest urgency level—after multiple events in which over 1 GW of data center load disconnected abruptly, causing frequency overshoot and voltage spikes . NERC has documented two specific events: one in February 2025 that shed approximately 1,800 MW and another in June 2025 that shed roughly 1,300 MW .

NERC's 2026 State of Reliability report explicitly identifies the pulsed and non-linear load characteristics of data centers as an emerging reliability threat . The Federal Energy Regulatory Commission (FERC) has since directed NERC to establish mandatory reliability standards for computational loads (including AI facilities) by December 31, 2026 .

A Real-World Near-Miss in Virginia

These warnings are not theoretical. In early 2025, approximately 40 data centers in Virginia's Loudoun County—the "data center alley" near Washington, D.C.—simultaneously disconnected from the grid after transmission disturbances. Some reports say 60 centers dropped off. The combined load drop (roughly 1,500 MW) risked system failure and forced grid operators to scramble for emergency balance .

On January 8, 2025, NERC released a review of the incident, which caused voltage spikes and frequency imbalances, exposing major Bulk Electric System vulnerabilities . The Wall Street Journal reported that the data centers, consuming enough power for over a million homes, had concurrently switched to backup generation, nearly causing a cascading blackout .

The Denial-of-Service Feedback Loop

The researchers described a self-reinforcing DoS mechanism: grid voltage instability caused by power oscillations triggers protection systems inside the data center, which throttle or disconnect servers. This in turn amplifies the power disturbance back onto the grid. The computing infrastructure's own safety systems worsen the grid failure, which then further disrupts computing—a closed-loop, bidirectional destabilization .

Why It Evades Standard Cloud Monitoring

Every operation the tenant performs is legitimate cloud usage—launching GPU kernels, training models, consuming allocated compute cycles. There is no malicious payload, no exploited vulnerability, and no unauthorized access. Existing intrusion detection systems, antivirus, and cloud security monitoring look for software-level anomalies, not power-consumption patterns. Because the attack creates no suspicious network traffic, file writes, or process behavior, it is invisible to traditional defenses .

Proposed Mitigations

The paper and news reports identify several classes of defense that span cloud providers, GPU vendors, and grid operators:

• Cloud-side: Monitor GPU power draw at the hypervisor or facility level for suspicious periodic patterns; rate-limit or flag high-frequency power modulation .
• GPU vendor: Modify GPU firmware or drivers to add a "power smoothing" mode that dampens rapid current swings below grid-significant frequencies .
• Grid-side: Deploy power-electronics filters (e.g., active harmonic compensators) at the data center's point of common coupling to block high-frequency load oscillations from reaching the grid .
• Regulatory: FERC's forthcoming mandatory reliability standards for computational loads should include modulation limits and real-time load-monitoring requirements .

Why Joint Defenses Are Needed Now

The authors argue that the Bit2Watt attack sits at the intersection of three distinct domains—cloud computing, GPU hardware design, and electric power systems—each of which currently operates with independent security models and no cross-domain threat visibility. No single actor can fully mitigate it :

• Cloud providers control the tenant environment but have no authority over grid equipment.
• GPU vendors can modify chip behavior but cannot mandate deployment.
• Power system operators can protect the grid but cannot see inside cloud workloads.

The attack class could be operational years before the separate industries coordinate a defense. The authors call for preemptive joint standards and real-time information-sharing mechanisms before an adversary weaponizes the technique in the wild .