Hidden Power Attacks on GPUs Could Cripple AI Data Centers, and Two Engineers Are Racing to Stop Them

Inside the humming halls of modern AI data centers, the most dangerous adversary may not be a hacker breaching a firewall or a malicious actor stealing model weights. It may be a piece of software that does nothing more than draw power in exactly the wrong pattern. At George Mason University, two assistant professors are investigating this unsettling possibility: that the shared microarchitecture of graphics processing units, the workhorses of artificial intelligence, can be manipulated to destabilize entire server racks and push multi-tenant infrastructure toward failure. Md Tanvir Arafin, of the Department of Cyber Security Engineering, and Khaled Khasawneh, of the Department of Electrical and Computer Engineering, both in the College of Engineering and Computing, have received funding for a project titled GAIA: GPU Microarchitecture-Based Power Attacks and Countermeasures for AI Data Centers.

The premise behind the research is deceptively simple, and that is precisely what makes it alarming. Modern GPU servers are almost never run at their nominal power ratings. Instead, operators deliberately oversubscribe power, provisioning less electrical capacity than the theoretical maximum of all installed hardware, because workloads rarely peak simultaneously. This practice saves enormous sums on power delivery infrastructure, cooling, and utility contracts. But it also creates a fragile equilibrium: the system only remains stable as long as the aggregate power draw of co-located applications stays within carefully modeled bounds. If an adversary can deliberately violate those bounds, the safety margin that makes oversubscription economical becomes an attack surface.

Arafin and Khasawneh are designing exactly such violations, in a controlled research setting, to understand how bad the problem could get. Their approach involves what they describe as benign-looking microarchitectural attacks: code that appears to be an ordinary workload but secretly forces co-located applications to draw more power than expected, or produces targeted power fluctuations timed to coincide with the activity of neighboring tenants. The word benign-looking is doing heavy lifting here. Because the malicious instructions live within the normal instruction set and microarchitectural behavior of the GPU, they do not require privileged access, unusual system calls, or any outward sign of compromise. To a scheduler, a security scanner, or a power monitoring dashboard, the attacking process looks like any other tenant doing legitimate computation.

The mechanism relies on the intimate hardware sharing that defines modern GPU computing. In multi-tenant GPU environments, several virtual machines or containers may execute concurrently on the same physical device, sharing compute units, caches, memory controllers, and, crucially, the same power delivery network. Every instruction a tenant executes contributes to the total current drawn by the chip. By carefully selecting instruction sequences known to be power-hungry, such as certain patterns of memory accesses, arithmetic intensity spikes, or rapid transitions between idle and active execution states, an attacker can inflate the aggregate power consumption of the shared device. When several such processes run together, or when one process synchronizes its spikes with the natural demand of a neighbor, the combined draw can exceed the provisioned capacity.

The consequences of exceeding that capacity are not theoretical. Processors and accelerators protect themselves through voltage regulation and emergency frequency throttling, but these mechanisms assume power excursions are accidental and statistically rare. A deliberate, sustained, or precisely timed attack can trigger voltage droop events severe enough to cause computational errors, force emergency shutdowns of individual GPUs, or cascade into rack-level power management interventions. In the worst case, repeated targeted fluctuations could push power distribution units toward protective tripping, interrupting every tenant on the affected hardware. For data centers whose business model depends on guaranteed uptime and service level agreements, even brief unplanned outages translate into substantial financial and reputational damage. The researchers describe this as exploiting power oversubscription to push multi-tenant GPU servers toward instability and failure.

What elevates this work beyond a conventional denial-of-service study is the microarchitectural lens. Power side channels have been studied for years as a means of leaking secrets, inferring what a neighbor is computing from its electrical signature. The GAIA project inverts that framing: instead of passively reading power behavior to extract information, the attacker actively writes to the shared power domain, using instruction-level manipulation as the writing instrument. This turns an observation channel into an actuation channel, and actuation is far more dangerous. A passive eavesdropper threatens confidentiality; an active power manipulator threatens availability and, through induced faults, potentially integrity as well, since voltage instability is a known precursor to computational errors that fault-injection research has long exploited.

Defending against such attacks is genuinely difficult, and the second half of the GAIA project addresses that challenge head on. Arafin and Khasawneh are developing and evaluating defense mechanisms built on hardware-software monitoring and load-balancing services. Two of their primary tools are performance counters and filler kernels. Performance counters are hardware registers that modern processors expose to software, tallying events such as instruction retire rates, cache misses, memory traffic, and stall cycles. Because different instruction mixes leave distinct fingerprints in these counters, a monitoring layer can learn the microarchitectural signature of normal workloads and flag execution patterns consistent with deliberate power inflation, even when the attacking code carries no obvious malicious payload.

Filler kernels serve a complementary, more active role. Rather than merely watching for anomalies, these are benign computational workloads that the defense can inject into the execution stream to reshape the power profile of the device. By filling idle cycles with controlled, predictable work, or by smoothing out the demand curve of the aggregate workload, filler kernels can prevent the sharp power transitions on which targeted fluctuation attacks depend. In effect, the defense fights microarchitectural manipulation with microarchitectural counter-manipulation, using the same fine-grained hardware control that makes the attacks possible to instead keep the power envelope stable. Combined with load-balancing services that redistribute work across devices when one GPU shows suspicious demand patterns, this creates a layered posture in which detection and mitigation reinforce each other.

The team is also building a prototype of a monitoring pipeline designed to flag anomalous power-driven load before grid-level disruption occurs. The phrase before grid-level disruption is significant. Data center power management typically operates at coarse timescales, with rack-level and facility-level telemetry sampled too slowly to catch instruction-level manipulation in the act. A pipeline that correlates fine-grained microarchitectural telemetry with power measurements at the device level could give operators the early warning they currently lack, identifying a misbehaving tenant while the situation is still a performance anomaly rather than an outage. Bridging that gap between the nanosecond world of on-chip events and the second-scale world of facility monitoring is one of the central engineering problems the project must solve.

The work is supported by a $100,000 award from the Virginia Innovation Partnership Corporation, with funding that began in August 2026 and runs through late July 2027. That timeline reflects the urgency of the problem it addresses. As AI training and inference workloads concentrate ever more densely onto shared GPU infrastructure, and as power, not silicon area, becomes the binding constraint on data center growth, the security of the power domain is shifting from an afterthought to a first-class concern. The GAIA project’s contribution is to make the threat concrete and testable, to demonstrate in a rigorous research setting how benign-looking code can weaponize shared electricity, and to show that the same hardware counters and scheduling mechanisms already present in every modern GPU can be repurposed as the foundation of a defense. If the researchers succeed, the result will be a blueprint that cloud providers and accelerator designers can use to keep the power grid inside the data center as trustworthy as the data flowing through it.

Subject of Research: GPU microarchitecture-based power attacks and countermeasures for AI data center security

Article Title: Arafin & Khasawneh studying GPU microarchitecture-based power attacks & countermeasures for AI data center

Article References: Arafin & Khasawneh studying GPU microarchitecture-based power attacks & countermeasures for AI data center. (n.d.). Original publication

Image Credits: AI Generated

DOI: Not provided

Keywords: GPU security, microarchitectural attacks, power side channels, AI data centers, power oversubscription, performance counters, filler kernels, multi-tenant computing, hardware security, denial of service, George Mason University, Virginia Innovation Partnership Corporation