External power probes can reliably tell when a GPU is training large models: 5-second Rogowski traces from an NVIDIA H200 separate training, inference and non‑AI activity with ~97% accuracy and robust detection against multiple evasion tactics; diluted LoRA remains the most challenging but is largely detectable after a targeted rescue rule.
Citation observations
Cumulative provider counts captured on specific dates; providers are never combined.
No provider observation is available for this paper.
Missing data, not a zero citation count.
AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. Here, we show that an external observer can identify the class of the workload running on an NVIDIA H200 from its power draw. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. We recorded $930$ five-second traces at $\sim 10$ MHz, covering seventeen open LLM families and twenty-five non-AI workloads. Over this corpus we separate training from inference and from non-AI computation with an accuracy of $97\%$ and a macro-averaged F1 score of $0.955$, evaluated on model families unseen during training. AI workload spectral content predominantly lies below $\sim 20$kHz and training is particularly recognizable through the memory-bound optimizer update. The GPU operator is then treated as adversarial and able to reshape the physical computation itself. Four evasion strategies are tested to disguise training as inference, producing an additional 680 adversarial traces. A detector hardened against evasion strategies, with the tested strategy held out, catches training $\geq 99\%$ of the time for three of the four strategies. The fourth, diluted low-rank adaptation (LoRA), is detected $48$--$88\%$ of the time with a hardened classifier, rising to $\geq 98\%$ with an additional rescue rule. While these attacks are not a comprehensive evaluation against adversarial behaviour, they offer initial insights beyond genuine activities and a dataset for developing and testing stronger evasion mechanisms.
Summary
Main Finding
An external, auditor-owned current probe on a GPU’s auxiliary power line (a Rogowski coil) can identify whether an NVIDIA H200 is performing LLM training, inference, or non-AI computation from 5-second, 10 MHz current traces. A two-stage random-forest detector using ~30 mostly frequency-domain features separates training from inference and non-AI workloads with ≈97% accuracy and a macro F1 ≈0.955 on model families unseen during training. Physical side channels are harder to spoof than on-chip telemetry (NVML) because evasion requires restructuring the computation itself; however, some adversarial strategies (notably diluted LoRA) can reduce detectability, at the cost of substantial training throughput penalties.
Key Points
-
Measurement channel and advantage
- Auditor-owned Rogowski probe clamped to the GPU auxiliary power draw; AC-coupled (34 Hz–30 MHz).
- Bypasses operator-controlled on-chip telemetry, preventing simple spoofing/replay of NVML counters.
- Relevant workload spectral content concentrated below ~20 kHz, enabling detection with much shorter windows (5 s) than prior NVML studies.
-
Dataset and scope
- 1610 traces total: 930 genuine (17 LLM families × inference + 3 training modes) and 680 adversarial (4 evasion strategies × 17 families).
- 17 open LLM families (4B–21B, dense and MoE) and 25 non-AI workloads.
- Each trace: independent run, fresh model load, 5 s at nominal 10 MHz.
-
Classifier and performance
- Two-stage random-forest classifier using 30 amplitude-invariant features (mainly spectral).
- Cross-validated on held-out model families: overall capability to separate training vs inference vs non-AI with ≈97% accuracy, macro F1 ≈0.955.
- Detection robust to heavy decimation of sampling rate (most signal is low-frequency).
-
Adversarial strategies and resilience
- Four tested evasion strategies: chunked optimizer updates, dilution (interleaving inference decoys), throttling, and diluted LoRA (interleaving tiny LoRA updates among inference).
- Throughput penalties imposed by these strategies: 28.1%–69.3% reduction in training token/sec relative to honest fine-tune.
- Hardened detector (trained on three of four strategies) raises detection rates substantially; diluted LoRA remains the hardest:
- Diluted LoRA detection: genuine detector 30–74%; hardened 48–88% across families.
- Introducing a frequency-gated “rescue rule” targeting optimizer-update spectral dips raises diluted LoRA detection to 90–100% (genuine) and 98–100% (hardened).
-
Mechanistic insight
- Training is particularly recognizable due to the optimizer update phase, memory-bound and spectrally distinct (a low-frequency “dip” relative to forward/backward passes).
- Evasion thus requires changing the timing/structure of optimizer updates, which degrades training throughput.
-
Limitations
- Experiments on a single GPU model (NVIDIA H200 NVL); cross-hardware generalization not yet established.
- Adversarial space explored is limited; stronger evasion strategies may exist.
- External probe deployment requires physical access and regulatory framework.
Data & Methods
-
Hardware and probe
- GPU: NVIDIA H200 NVL (Amodo Design hosting).
- Probe: Rogowski AC current probe (RCP-XS series), clamped around positive conductors of PCIe auxiliary power.
- Bandwidth: 34 Hz–30 MHz (no DC response); probe output digitized with PicoScope.
-
Acquisition
- Sampling: nominal 10 MHz; acquisition windows: 5 s.
- Initial 100 MHz check confirmed most energy <1 MHz; main dataset at 10 MHz.
-
Corpus
- Genuine: 930 traces (17 model families × inference + three training modes (full fine-tune, LoRA, gradient accumulation) × 10 captures per config).
- Non-AI: 25 workloads including idle baseline.
- Adversarial: 680 traces (17 families × 4 evasion strategies × 10 captures).
-
Classifier and features
- Two-stage detection: (1) ML vs non-ML, (2) training vs inference for ML traces.
- Model: random forest (two-stage), using 30 features predominantly in frequency domain, amplitude-invariant.
- Evaluation: five-fold grouped cross-validation grouped by model family; averaged across 4 splits × 2 seeds; leave-one-strategy-out and leave-one-model-family-out experiments for hardening analysis.
-
Evasion strategies tested
- Chunked optimizer: split optimizer update into smaller pieces.
- Dilution: interleave decoy inference with real training steps.
- Throttling: slow the execution (idle windows).
- Diluted LoRA: interleave small LoRA updates with inference to minimize optimizer-update footprint.
- Each strategy measured for throughput penalty (tokens/sec vs baseline).
-
Released artifacts
- Authors released the recorded traces (Hugging Face dataset), enabling follow-up work.
Implications for AI Economics
-
Enforcement and compliance costs
- Deploying auditor-owned probes requires on-site physical access, tamper-resistant deployment, and ongoing monitoring—raising enforcement capex and opex. Regulators must budget for instrumentation, secure presence/chain-of-custody, and possibly staffed facilities.
- However, the probe provides a higher-integrity verification signal than operator-reported NVML telemetry, potentially lowering the risk premium regulators or counterparties assign to undetectable non-compliance.
-
Incentives and deterrence
- Detection capability changes the economics of clandestine training. Evasion strategies impose substantial throughput penalties (28–69% slower), increasing the marginal cost of training clandestinely (longer wall-clock time, higher energy and facility costs).
- Economic trade-off for an operator considering evasion: expected value of hidden model development versus added cost of slowed training plus increased detection risk. Regulators can calibrate penalties such that evasion is uneconomic.
-
Market and strategic effects
- Firms may internalize detection risk by shifting development to jurisdictions or architectures where probes are infeasible, altering global investment flows and competitive dynamics.
- Requirement for attested/independent monitoring could favor larger incumbents able to absorb monitoring costs, potentially raising barriers to entry and affecting innovation dynamics.
-
Design of policy instruments
- Optimal enforcement mixes: pairing tamper-resistant on-chip telemetry (low-cost, privacy-preserving) with selective independent physical probes (high-integrity, higher-cost) can be cost-effective—use telemetry for routine monitoring, probes for audits or high-risk facilities.
- Economists should evaluate sampling strategies (which sites, how often) to minimize expected detection costs while controlling total monitoring budget—e.g., randomized audits impose uncertain detection risk that can deter non-compliance at lower total cost.
-
Quantifying the compliance-evasion trade-off
- The measurable throughput penalties for evasion provide inputs for cost-benefit models: additional compute hours and energy × price per token/hour translate into dollars per evasion attempt. These can be compared against expected gains from clandestine model capabilities to assess likely compliance behavior.
- The dataset and detection performance enable calibration of detection probabilities; enforcement models (e.g., auditing game-theoretic frameworks) can incorporate these empirical detection curves.
-
Privacy and competition considerations with economic impact
- External probes might leak commercially sensitive information (model identity, workload patterns). Policymakers must balance verification effectiveness with protecting trade secrets—regulatory design (access rules, data minimization, sworn auditors) affects compliance costs and firms’ willingness to accept monitoring.
- Requiring independent probes may necessitate compensation or protections for firms, influencing the political economy of monitoring mandates.
-
Future economic research directions
- Estimate per-site monitoring cost (instrumentation + staffing + legal/regulatory compliance) and compare to economic damages from unverified large-scale training.
- Model firm responses: investment in stealthy/hard-to-monitor architectures, relocation, or operational changes (e.g., paying the cost of evasion vs. paying fines).
- Social welfare analysis: balance between reduced systemic AI risk (via better verification) and potential reduced competition/innovation from monitoring costs or relocation.
Overall, this work provides empirically grounded parameters (detection probabilities, evasion cost in throughput) that can be plugged into economic models of regulation, enforcement budgeting, and firm behavior to design more incentive-compatible and cost-effective AI governance mechanisms.
Assessment
Claims (9)
| Claim | Direction | Outcome | Confidence & Evidence | Details |
|---|---|---|---|---|
| An external current probe can distinguish training, inference, and non-AI computation on an NVIDIA H200 with 97% accuracy and a macro-averaged F1 score of 0.955, including evaluation on model families unseen during training. Governance And Regulation | positive | Classification accuracy and macro-averaged F1 for identifying training, inference, and non-AI GPU workloads |
Reading fidelity
high
Study strength
medium
|
n=930
97% accuracy; macro-averaged F1 = 0.955
|
| The relevant AI workload spectral content is predominantly below approximately 20 kHz. Other | positive | Frequency distribution of GPU power-side-channel signals |
Reading fidelity
high
Study strength
medium
|
n=930
Predominantly below ∼20 kHz
|
| Training is especially recognizable because the optimizer-update phase produces a distinctive memory-bound spectral signature. Governance And Regulation | positive | Recognizability of training from the physical power signal |
Reading fidelity
high
Study strength
medium
|
n=930
|
| When the detector is hardened against three evasion strategies and tested on the fourth unseen strategy, it detects training at 100% for chunked optimizer updates and throttling, 99–100% for dilution, and 48–88% for diluted LoRA. Governance And Regulation | positive | Training detection rate under adversarial workload-execution strategies |
Reading fidelity
high
Study strength
medium
|
n=680
100% for chunked optimizer and throttling; 99–100% for dilution; 48–88% for diluted LoRA
|
| A frequency-gated rescue rule targeting the optimizer-update signature raises diluted-LoRA training detection to 98–100% for the hardened detector. Governance And Regulation | positive | Detection rate of training disguised with diluted LoRA |
Reading fidelity
high
Study strength
medium
|
n=680
98–100% detection with the hardened detector
|
| The four tested evasion strategies reduce real training throughput by between 28.1% and 69.3% relative to honest full fine-tuning. Organizational Efficiency | negative | Real training throughput, measured in training tokens per second |
Reading fidelity
high
Study strength
medium
|
n=4
28.1% to 69.3% throughput lost
|
| The genuine corpus contains 930 traces covering 17 open LLM families, while the adversarial corpus adds 680 traces covering four evasion strategies across the same 17 families. Other | positive | Coverage and size of the workload-trace dataset |
Reading fidelity
high
Study strength
high
|
n=1610
930 genuine and 680 adversarial recordings
|
| The study's generalization across devices and hardware architectures remains unestablished because the corpus was collected on a single NVIDIA H200 NVL. Governance And Regulation | mixed | External validity of workload detection across GPU devices and architectures |
Reading fidelity
high
Study strength
high
|
n=1
|
| Unlike operator-controlled NVML telemetry, an auditor-owned external probe can in principle provide a signal that does not depend on the operator's cooperation, although it requires physical access and tamper-resistant readout mechanisms. Governance And Regulation | positive | Independence and tamper resistance of compute-workload verification signals |
Reading fidelity
high
Study strength
medium
|
n=1
|