Workload Identification with Physical Side Channels for AI Governance
cs.CR · cs.AI · cs.CY · cs.LG
Quick verdict
Claims 97% GPU workload ID from an external current probe (one H200); adversarial results strong but single-GPU corpus, 4 evasion arms and no measurement-layer attacks temper it.
Summary
This paper asks whether an auditor-owned current probe can identify what an NVIDIA H200 GPU is running from its auxiliary power draw, as a tamper-resistant complement to spoofable on-chip NVML telemetry for AI-governance verification. A Rogowski probe clamped on the PCIe auxiliary power lines recorded 5-second traces at ~10 MHz: 930 genuine traces covering seventeen open LLM families (4B–21B, dense and MoE) under inference and three training regimes plus twenty-five non-AI workloads, and 680 adversarial traces covering four evasion strategies that disguise training as inference (chunked optimizer, dilution, throttling, diluted LoRA). A two-stage random forest with thirty amplitude-independent features separates training, inference and non-AI computation at 97% accuracy and 0.955 macro-F1 under grouped cross-validation on model families unseen in training; spectral analysis shows AI signatures below ~20 kHz, and a frequency-gated dip rule lifts hardest-case diluted LoRA detection from 48–88% to 98–100% with hardening. Main limitations: all data come from a single GPU, only four evasion strategies are tested, and manipulation of the measurement chain or frontier-scale models are out of scope.
Review complete
Assessment at a glance
5
risk flags identified
● high 1
● medium 2
● low 2
4 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- An auditor-owned current probe on the GPU auxiliary power supply can separate training, inference and non-AI computation on an NVIDIA H200 at 97% accuracy (macro-F1 0.955), evaluated on model families unseen during training.
- Under a leave-one-strategy-out hardened detector, three of four tested evasion strategies are caught ≥99% of the time on 5-second traces; the hardest (diluted LoRA) is caught 48–88% of the time, rising to ≥98% with an additional frequency-gated rescue rule.
- The memory-bound optimizer update — a quiet, low-frequency spectral dip — is the dominant training signature, and the bulk of AI workload spectral power lies below ~20 kHz.
- Because the channel is external and physically observable, evading it requires restructuring the computation itself (at a measured 28.1–69.3% throughput penalty), unlike NVML telemetry which can be spoofed or replayed at zero physical cost.
Strengths
Purpose-built corpus with confound-aware design
930 genuine traces span 17 LLM families (4B–21B, dense and MoE) × {inference, full FT, LoRA, gradient accumulation} at 10 recordings per label, plus 25 non-ML kernels (Table 5); every trace is an independent run with a fresh model load, and evaluation uses five-fold CV grouped by model family, averaged over four splits and two seeds — family identity is explicitly not allowed to leak.
Adversarial evaluation with honest reporting of the hardest case
Four evasion strategies reshape the physical computation; the leave-one-strategy-out hardened detector reaches ≥99% on three but only 48–88% on diluted LoRA (Table 1) — the failure mode is foregrounded rather than hidden, and throughput penalties (28.1–69.3%, Table 2) make evasion costs concrete.
Rescue rule held to a false-alarm constraint and re-validated out-of-fold
Mechanistic grounding of the signal
Weaknesses
Single-GPU evidence for a governance-scale claim
Narrow and non-comparable adversarial evaluation
Measurement-layer attacks absent from the threat model
Abstract accuracy figure does not match Table 3 at the stated rate
Single-tenant, loop-only corpus limits false-alarm evidence
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper addresses a concrete AI-governance verification gap: existing compute-monitoring proposals read operator-controlled NVML counters (Rahman & Tajdari 2026), which can be spoofed or replayed. The authors propose an auditor-owned physical channel — a Rogowski current probe on the PCIe auxiliary power supply of an NVIDIA H200 NVL — and ask whether workload class (training / inference / non-AI) is identifiable from 5-second traces sampled at ~10 MHz, including when the operator actively disguises training as inference. Claims are scoped honestly in places: the abstract concedes the four attacks are 'not intended to provide a comprehensive evaluation', and §4 lists the single-GPU and strategy-coverage limits explicitly. The governance framing, however, implies a cross-device, cross-datacenter deployment story the evidence does not yet reach.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 4 strengths & 5 weaknesses, analyzed in detail
- 5 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
How can AI training on a GPU be detected without the operator's cooperation?
The paper clamps a Rogowski current probe around the GPU's PCIe auxiliary power cables and records the current draw at ~10 MHz. Workload-specific patterns in that draw — especially the quiet, low-frequency optimizer update that only happens during training — let a two-stage random forest classify the workload as training, inference or non-AI, independently of any software telemetry the operator could fake.
How accurate is the GPU workload detector in this study?
On a single NVIDIA H200, using 5-second traces and cross-validation over model families never seen during training, it separates training from inference and non-AI workloads at 97% accuracy (macro-F1 0.955). Against four evasion attacks that disguise training as inference, a hardened detector catches three attacks at least 99% of the time; the hardest, diluted LoRA, is caught 48–88% of the time, rising to ≥98% with an extra rescue rule.
What is diluted LoRA and why is it hard to detect?
It is an evasion strategy that interleaves small LoRA parameter updates with genuine-looking inference traffic, so the tell-tale optimizer update occupies only about 1% of the recording window. The paper counters it with a 'rescue rule' that relabels inference-classified traces as training when a brief, deep, low-frequency power dip — the optimizer-update footprint — is detected.
What is the cost of disguising GPU training as inference?
All four tested evasion strategies slow real training down. Relative to an honest full fine-tune, throughput losses range from about 28% to 69% depending on the strategy and model (e.g., diluted LoRA on Qwen3-4B costs +69.3%, chunked optimizer on GPT-OSS-20B +28.1%), so disguise trades detectability for training speed.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.