A paper from Zhejiang University describes how to disturb a power grid without touching any of its hardware. The attacker needs no vulnerability and no access to a substation, PLC or SCADA system. They rent GPUs from a cloud provider, pay the bill, and vary how hard those GPUs work.
The paper is called Bit2Watt, it was accepted to CHES 2026, and it has been circulating widely since 20 July. We read the paper. The figures being repeated are strong, but the conditions attached to them have not always survived the retelling.
What it actually is
| Layer | What the attacker touches | What they do not need |
|---|---|---|
| Compute | A rented GPU instance, used as any tenant would | No privilege escalation, no root |
| Software | User-level CUDA, or a normal training pipeline | No vulnerability, no CVE, no malware |
| Power | The draw of their own legitimate workload | No access to substations, PLCs or SCADA |
This is what makes it awkward. The paper describes an adversary operating "entirely within the cyber layer as a legal tenant" — there is no intrusion to detect, because nothing is intruded upon.
The mechanism is simple: a GPU's power draw tracks its workload. A program that cycles between heavy use and idle at a chosen frequency turns a rack into a signal generator on the supply. Do that in enough places at once and the paper argues you get harmonic distortion and reduced damping in the local power system — the two things power engineers watch to judge whether a network is stable.
The awkward part is not the physics but the adversary's position. As the authors put it, they act "entirely within the cyber layer as a legal tenant". There is no intrusion to detect because nothing is intruded upon, and no CVE to patch because nothing is broken.
What was measured, and what was modelled
The widely-quoted numbers come from the simulation, not the 8 kW test bench.
| Physically measured | Simulated | Gap | |
|---|---|---|---|
| GPUs | 6 (three workstations) | 1,000 | 167× |
| System size | ~8 kW test bench | 1 MW local grid | 125× |
| Method | Grid simulator, PV inverter, UPS, household loads | Simulink model, RTX 3090 as reference | — |
| Result observed | DC-bus ripple 0.45% → 2.82%; 3rd and 5th harmonics rise at the UPS | THD 46.80%, damping −0.27 | — |
Computed from the paper's own figures. Both halves are real work; they are not the same claim, and the widely-quoted numbers come from the right-hand column.
The physical work is a roughly 8 kW test bench — a grid simulator, a PV simulator, a grid-tied inverter, a storage battery, household loads and three workstations with six GPUs. On that rig the researchers measured the DC-bus ripple ratio rise from 0.45% to 2.82%, which they note exceeds the suggested limit, and saw third and fifth harmonics increase sharply at the UPS stage.
The 1,000-GPU figures are a Simulink simulation of a 1 MW local system, with an RTX 3090 as the reference model. That is 167 times the GPUs and 125 times the power of anything that was plugged in. Both are legitimate research, but they are not the same claim.
The condition that keeps getting dropped
| DER penetration | Current THD | Note |
|---|---|---|
| 10% | 19.60% | Still high, and closer to a grid you might actually meet |
| 90% | 46.80% | The figure that travels — an extreme, not a typical, condition |
Both from the same simulation at 1,000 manipulated GPUs. The headline number is 2.39× the low-penetration case, and the condition it depends on is usually dropped in the retelling.
The 46.80% distortion figure requires 90% DER penetration — that is, a local system where nine tenths of supply comes from distributed renewables such as rooftop solar. At 10% penetration the same simulation gives 19.60%.
The damping result also depends on high DER penetration. At 90% it falls from 0.46 with 200 manipulated GPUs to −0.27 with 1,000, which the paper calls "a transition from a well-damped to an unstable regime". A negative damping ratio is what matters, as it means oscillations grow rather than decay.
The worst-case simulation also assumes every GPU modulates at an identical frequency and phase. The authors are explicit that "device-level heterogeneity, phase dispersion, and communication delays across individual GPU units are not explicitly modeled", and describe their results as "a conservative bound on realistic system behavior".
Two methods, and one of them is quieter
| Method | How it works | Modulation band | Detectability |
|---|---|---|---|
| SWMA | A purpose-built CUDA program switching between high and low load | 1.5 – 6 kHz | The louder of the two |
| LTMA | Modulation logic embedded inside a normal LLM training pipeline | 1.2 – 3 kHz | Paper: "consistently harder to detect than SWMA" |
The 1.5–6 kHz range widely attributed to Bit2Watt is SWMA only. The stealthier method tops out at half that ceiling — a distinction that matters if you are trying to detect it.
The frequency range quoted almost everywhere — 1.5 kHz to 6 kHz — belongs to SWMA, the purpose-built CUDA program. LTMA, which hides the modulation inside an ordinary LLM training pipeline, runs at 1.2 to 3 kHz with larger amplitudes, and the paper states it is "consistently harder to detect than SWMA under the same detector family".
A detector would likely be built for the louder SWMA method, while the quieter LTMA variant runs at half the top frequency and looks like a normal training job — which is what a GPU tenant is supposed to be running.
The number that should worry people
| Duration | At $0.39/GPU/hour | At $2.99/GPU/hour |
|---|---|---|
| 5 minutes | $32 | $249 |
| 10 minutes | $65 | $498 |
| 30 minutes | $195 | $1,495 |
Our arithmetic on the paper's stated rental range and its note that the attack needs "an execution time of only a few minutes". Cost is the part of this that should worry people most.
The paper prices its own attack. High-performance GPU rental runs "from $0.39/hour to $2.99/hour", and it notes an execution time of "only a few minutes" is enough to degrade power quality and stability.
Run those together and the compute behind the worst-case simulation costs between $65 and $498 for ten minutes. Whatever else is uncertain here, the economics are not the barrier.
Why this lands differently in this region
Two things we have covered recently intersect here. Data-centre capacity is being contracted at scale — a single Hut 8 lease covers 352 MW of IT capacity supported by 500 MW of utility supply — and the models being deployed into it are enormous, with Kimi K3 alone needing twenty H100s just to hold its weights.
For teams that track this kind of activity, ThreatBook's Flocks and SafeSkill cover detection and exposure assessment, and HFish is its open-source honeypot framework.
Bit2Watt's severity scales with two ratios: GPU load to total system load, and inverter-based renewables to total supply. Singapore and Malaysia are adding both at once. This is not a prediction. It is the reason the paper's variables are worth tracking locally, rather than filing away as a foreign curiosity.
The caveats that matter
- No outage was demonstrated, and the authors do not claim one. We looked specifically for a disclaimer to that effect and there is no limitations section; what the paper states is that "all experiments were conducted in controlled environments" and that no production systems were attacked.
- The 81% figure is load loss in a model. It comes from a simulation on a modified 9,241-bus European transmission network, where a disturbance representing 2% of system load cascades over 13 stages and disconnects 1,238 lines. That is a 40-fold amplification inside a model, not a grid that went dark.
- Our cost table is our arithmetic on the paper's stated rental range, not a figure the authors publish.
- This is a preprint with a conference acceptance, posted 7 July 2026 and accepted to CHES 2026. It has not been independently reproduced that we can find.
- We have not tested any of it. Every figure here is the authors' or our arithmetic on theirs.
Key takeaways
- The attack needs no access. A paying cloud tenant modulating their own GPU load — no CVE, no privilege escalation, no grid-side device.
- Six GPUs were measured; 1,000 were simulated. A 167× gap between the bench and the headline.
- The worst-case numbers need 90% renewable penetration. At 10% the same model gives 19.60% distortion instead of 46.80%.
- The stealthy variant is the slower one. LTMA hides in a training pipeline at 1.2–3 kHz; the 1.5–6 kHz range belongs to SWMA.
- Cost is not the barrier. Ten minutes of 1,000 rented GPUs is $65 to $498 at the paper's own quoted rates.
View author profile → · Editorial policy
