Hardware performance throttling and licensing

How it works

Two families of throttling are proposed.

Licensing. Several designs gate performance on a license:

• RAND's offline licensing. A renewable license temporarily authorizes certain hardware features. Once the license is used up, the GPU refuses the relevant operations or runs them "at a much lower rate" ².
• O'Gara et al. They describe licenses as cryptographic keys that unlock "a specified amount of computational work". Throttling could limit one capability, such as memory transfers, or all of them, and meters would track the licensed quantities. They cite Intel On Demand, which unlocks chip features by license, as a commercial precedent ³.
• CNAS. Its proposed security module would enforce up-to-date operating licenses, among other checks ⁴.
• flexHEG. Devices would periodically need a license that sets a minimum firmware version ⁶. A guarantee processor could also block operations that would take a training run past a threshold ⁵.

Microarchitectural throttles. Ma et al. add knobs that reduce L2 cache capacity, add L2 latency, cap L2 bandwidth or limit access to shared-memory ports. None of these knobs is visible to software ¹. A trigger switches them on. It might come from an on-chip classifier or from an external trusted authority, provided the trigger path stays in the throttle's trust domain ¹.

Existing GPUs already throttle their clocks when power or thermal limits are exceeded, and users can set clock speeds through NVIDIA tools ².

What it establishes

Throttling enforces a limit. It does not by itself produce evidence for a verifier. A verifier could rely on a cap only if the throttle state were attested (TEE remote attestation for AI workloads) and, for licenses denominated in work, securely metered (On-chip telemetry from timing, memory and performance counters) ³. With both in place, a cap could support claims about capacity (Compute stock is at most a declared amount) or about compute used in a license period (A training run stayed within declared limits).

Ma et al. find that memory-side knobs hit LLM kernels selectively, while disabling compute cores slows nearly every workload ¹. The throttle does not detect intent. The authors call detection of misaligned behaviour "an active and orthogonal research problem" ¹.

Threat model

The sources assume adversaries of different strength:

• Ma et al. The adversary may be an autonomous AI agent, a malicious human, or both. It may have broad operating-system access but cannot alter the on-chip hardware ¹.
• RAND considers actors up to states, with physical and non-physical attacks. It concludes that anti-tamper protection can raise costs and reveal tampering but is not insurmountable ².
• CNAS judges that existing on-chip features must be hardened before they can be relied on in adversarial settings ⁴.

O'Gara et al. ask which quantities should be metered and how to do so securely ³.

Evidence

• Ma et al. They simulate an NVIDIA A100 in AccelSim on GEMM and attention kernels shaped like those of recent large models. Performance fell by up to 80% at one-eighth of resource availability, and settled 5–80K cycles after a throttle was applied. Each mechanism needs fewer than about 10K flip-flops. The paper announces no code or hardware release ¹.
• Licensing designs. RAND and O'Gara et al. present designs and open questions, not prototypes ^{2 3}.
• Development effort. CNAS estimates that adequate hardware security for on-chip mechanisms, particularly tamper evidence and tamper-proofing, could take as little as 18 months, and up to 4 years, of technical effort by leading firms ⁴.

Limitations

The weaknesses the sources recognize are:

• the security of the trigger or license path ^{1 3};
• physical, firmware and supply-chain attacks on the enforcing hardware ²;
• sensitivity that varies by architecture, including non-monotonic L2 behaviour ¹;
• workloads adapting to the throttle ¹.

Evaluation on newer architectures is left open ¹. Secure boot and voltage-glitching risks for license-checking firmware are discussed under Hardware-enabled guarantees (flexHEG) and guarantee processors ⁶.