Ilmu Komputer & AI editorial
Open AccessOA2026
Workload Identification with Physical Side Channels for AI Governance
External power-draw analysis distinguishes training, inference, and non-AI GPU workloads on NVIDIA H200 with 97% accuracy, and resists adversarial evasion.
Simone Gargiulo; Gabriel Kulp· 2026· DOI 10.48550/arXiv.2609.00309
The core problem
AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. This work asks whether an external observer can identify the class of workload running on an NVIDIA H200 from its power draw alone. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. The authors frame the GPU operator as potentially adversarial, able to reshape the physical computation itself, and test evasion strategies that disguise training as inference. The contribution is a dataset, a classifier, and an initial adversarial evaluation for developing stronger evasion mechanisms.
Innovation
Over the corpus, the classifier separates training from inference and from non-AI computation with an accuracy of and a macro-averaged score of , evaluated on model families unseen during training. This indicates that the physical side channel generalizes across LLM families rather than encoding family-specific artifacts. The spectral signature is concentrated below kHz, and the memory-bound optimizer update is a particularly distinctive marker of training. Against adversarial evasion, a detector hardened against evasion strategies, with the tested strategy held out, catches training of the time for three of the four strategies. The fourth strategy, diluted low-rank adaptation (LoRA), is detected -- of the time with a hardened classifier, rising to with an additional rescue rule. These numbers are initial insights rather than a comprehensive evaluation against adversarial behaviour.
AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. This work asks whether an external observer can identify the class of workload running on an NVIDIA H200 from its power draw alone. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. The authors frame the GPU operator as potentially adversarial, able to reshape the physical computation itself, and test evasion strategies that disguise training as inference. The contribution is a dataset, a classifier, and an initial adversarial evaluation for developing stronger evasion mechanisms.
The authors recorded five-second traces at MHz, covering seventeen open LLM families and twenty-five non-AI workloads. Power draw was sampled externally, avoiding reliance on on-chip telemetry. The corpus was split so that model families unseen during training were used for evaluation, testing generalization rather than memorization. Classification separated training from inference and from non-AI computation. Spectral analysis showed that AI workload content predominantly lies below kHz, with training particularly recognizable through the memory-bound optimizer update. To probe adversarial robustness, the GPU operator was treated as able to reshape the physical computation. Four evasion strategies were tested to disguise training as inference, producing an additional 680 adversarial traces. A detector was then hardened against evasion strategies, with the tested strategy held out during hardening.
Why it matters
The results suggest that physical side channels can provide a verification primitive that does not depend on operator cooperation, complementing or replacing spoofable on-chip telemetry. The high accuracy on unseen model families supports the claim that the signal reflects the computational structure of training and inference, not incidental model identity. The memory-bound optimizer update is a plausible mechanism: optimizer steps impose a characteristic memory-access and power pattern that inference lacks. The adversarial evaluation is deliberately limited. Four evasion strategies are tested, and the diluted LoRA case shows that a determined operator can reduce detection to -- without a rescue rule. The authors position the released dataset as a resource for developing and testing stronger evasion mechanisms, implying an ongoing arms race between verifiers and operators. For AI governance, the practical implication is that compute verification may be feasible with external instrumentation, but policy design should assume adversaries will attempt to reshape physical signatures. The taxonomy candidates for this work span Architecture, Cybersecurity, Network, and Cryptography, reflecting its position at the intersection of hardware measurement, adversarial machine learning, and verification policy.
Who should read this
CS practitioners and researchers
Opening member content…