Bit2Watt is a newly disclosed cyber-physical denial-of-service (DoS) attack where threat actors use legitimate, rented cloud GPUs to destabilize a data center’s underlying power grid. Disclosed by researchers at Zhejiang University (Zhouhao Ji, Kaikai Pan, and Wenyuan Xu) and accepted to CHES 2026, the vulnerability bypasses traditional IT security entirely. Instead of exploiting software bugs or breaching grid-control systems, attackers intentionally toggle intensive GPU workloads to inject high-frequency electrical oscillations that physically stress and degrade local power infrastructure.
How a Legal Customer Becomes a Weapon
The mechanism rests on a basic physical fact: a GPU’s power draw tracks what it’s computing – heavy compute pulls more current, idle cycles pull less. Bit2Watt turns that relationship into a weapon by rapidly toggling thousands of GPUs between compute-saturating and near-idle states, in a repeating pattern fast enough to inject high-frequency current fluctuations directly into a facility’s electrical system.
The researchers describe two concrete methods for doing this. The first, a Synthetic Workload Modulation Attack, uses custom CUDA code that switches GPUs between full load and near-idle on a controlled schedule. The second, an LLM Training Modulation Attack, hides the same toggling behavior inside an ordinary-looking deep learning training job by manipulating batch sizes or auxiliary operations rather than running an obviously suspicious workload – making it harder to distinguish from routine training traffic.
Both approaches produce the same physical effect: oscillations well outside what the grid is designed to absorb. The paper reports that GPU loads under this attack can hit modulation frequencies exceeding 6,000 Hz, compared with just a few hertz from conventional household loads like air conditioners. That gap matters because grid infrastructure – especially systems with heavy renewable penetration – is engineered to tolerate slow, predictable swings in demand, not deliberate, high-frequency pulses.
The Numbers Behind the Warning
Rather than stopping at theory, the researchers validated the attack through impedance-based analysis, power system simulations, and real-world experiments on GPUs and grid-connected solar inverters. In a modeled scenario – a 1-megawatt local power system where 90% of supply comes from distributed energy resources like rooftop solar – coordinating an attack across roughly 1,000 GPUs pushed current total harmonic distortion to 46.8% and drove the system’s damping ratio to -0.27, a negative value signaling the system moving toward instability rather than settling back to normal.
It’s worth being precise about what that does and doesn’t mean. These figures come from a synchronized, worst-case model built for the research, not a documented real-world blackout – no production data center has reported an incident matching this description. But the underlying physics isn’t hypothetical: large, fast-modulating GPU clusters already stress local grids during ordinary AI training runs. Separate research published by Microsoft, OpenAI, and Nvidia in 2025 on stabilizing AI-training power documented that synchronized swings from large training jobs, when their frequency aligns with a utility’s critical frequencies, can physically damage grid infrastructure – and that tens of thousands of GPUs can simultaneously spike or drop power draw when jobs start, stop, or pause for checkpointing, creating swings of tens of megawatts within seconds. Bit2Watt’s contribution is showing that this same behavior can be deliberately engineered and aimed, not just triggered by accident.
Why This Is Hard to Catch
What makes Bit2Watt distinct from typical infrastructure attacks is that it involves no break-in at any point – no compromised sensors, no malware on a control system, no stolen operator credentials. On paper, the attacker is a legitimate paying customer running a workload – the exact thing cloud providers are built to sell. The paper notes that this risk is difficult to catch under routine cloud- and facility-side monitoring, because it operates inside legitimate, authorized execution paths and shows up mainly in high-frequency electrical signatures that standard telemetry isn’t built to capture. Traditional workload monitoring watches for suspicious code, unusual API calls, or abnormal resource requests – not for the electrical rhythm of how power is being drawn.
Several industry trends inadvertently make the attack easier to pull off: inexpensive, on-demand GPU rental; schedulers that intentionally cluster GPUs together in the same racks for performance reasons; and shared timing infrastructure across cloud tenants. These practices exist for good operational reasons, but together they make it easier for an attacker to concentrate and synchronize a modulation attack across a large GPU footprint.
Not Just a Data Center Problem
Follow-on modeling extended the risk beyond a single facility. Using an IEEE 118-bus transmission-scale grid model – a standard benchmark grid used in power systems research – the team found that past certain thresholds, the grid can split into separate zones of oscillation, meaning a disturbance seeded inside one data center’s electrical connection could ripple into wider-area instability rather than staying contained on-site. That reframes Bit2Watt from a data center’s problem to a grid operator’s problem, particularly in regions where AI data centers already represent a large, concentrated share of local demand.
This lands amid growing scrutiny of the relationship between AI infrastructure and power grids. Regulators have separately signaled concern about AI data centers as a source of grid reliability risk under normal operating conditions, before any adversarial behavior is factored in. Utilities are already rethinking capacity planning and clean power sourcing around this demand; Bit2Watt adds an adversarial dimension to a conversation that was already underway.
What This Means in Practice
Bit2Watt isn’t a single organization’s problem to fix – instead it spans three separate stakeholders, each with a different exposure and a different lever to pull. Cloud providers own the infrastructure where the attack originates and are best placed to detect it early. Enterprise customers share the same physical infrastructure as any attacker, whether they realize it or not, and as a result carry due-diligence responsibility of their own. Grid operators sit downstream of both, absorbing the consequences of a disturbance they had no part in causing. So each group needs a different starting point for what to actually do about it.
Cloud Providers: Make Electrical Monitoring a Security Control
For cloud providers and data center operators: Workload-level electrical monitoring becomes a security control, not just an operations metric. The paper’s proposed mitigations point in two directions – identifying anomalous high-frequency power modulation patterns at the workload-scheduling level, and adding energy buffering systems capable of physically absorbing fast oscillations before they reach the grid interface. Providers running large shared GPU clusters, especially those backed by solar or other renewable generation, are the highest-priority candidates for this kind of monitoring.
Enterprise customers: Ask Vendors About Electrical Isolation, Not Just Network Isolation
This is a reminder that shared infrastructure carries shared risk, even when your own workloads are entirely legitimate. When assessing a cloud or GPU-as-a-service provider, it’s worth asking what workload-isolation and electrical-anomaly monitoring they have in place – the same way security-conscious buyers already ask about network isolation and data residency.
Grid Operators: Coordinate With Compute Tenants Before It’s Reactive
Instability in one facility can propagate into wider-area oscillations, which argues for closer coordination between utilities and the large compute tenants on their grid, including visibility into planned large-scale training runs that could already cause the kind of fast power swings this research describes.
Conclusion
Bit2Watt is a research disclosure rather than a documented attack in the wild, but it sits at the intersection of two trends that aren’t going away: AI compute demand keeps concentrating in fewer, larger facilities, and those facilities are increasingly tied to grids that are themselves growing more sensitive to rapid load changes. That combination is a structural risk unlikely to go away on its own until it’s addressed directly.
