On-chip telemetry from timing, memory and performance counters

How it works

Three families of signals are proposed.

Built-in counters and management telemetry. RAND notes that GPUs already have on-device counters for floating-point operations, instructions executed, NVLink and PCIe bandwidth, memory accesses and power. These can be reported per streaming multiprocessor or for the whole chip ⁴. O'Gara et al. list such counters as possible meters for compute accounting and licensing ⁵. Rahman and Tajdari train a classifier to spot training workloads from nine standard NVIDIA Management Library (NVML) counters sampled once a second. They describe these signals as content-agnostic ³.

Timing and memory challenges. Monfared et al. have a challenger send puzzles to the GPU and time the answers ¹:

• memory-hard proof-of-work puzzles probe parallel effort;
• verifiable delay functions probe sequential execution;
• matrix-multiplication puzzles probe the tensor cores;
• a residency test checks whether challenge data stayed in the GPU's own memory.

Co-running workloads compete for the same units, so contention shows up as shifts in the timing distributions ¹. Gloria Z, author of a June 2026 MIRI Technical Governance Fellowship post, similarly suggests memory-residency and random challenges ⁶. These force an operator to keep false accounts consistent across every signal ⁶. Timed challenge-response in general is covered in Timed challenge-response and memory-occupation challenges.

New memory-side hardware. Guaranteeable Memory would place an open-source "guarantee chiplet" beneath the HBM stacks. The chiplet would observe memory traffic and attest to memory snapshots, GPU instructions, or random subsets of claimed computations ². This connects to the guarantee processors of Hardware-enabled guarantees (flexHEG) and guarantee processors.

AI Security Forum sketches an auditable hardware block to log every kernel sent to a GPU's streaming multiprocessors ¹². It would need GPU-vendor cooperation or a new chip design, with completeness and overhead still open questions ¹².

RAND's working paper proposes protecting compute meters against resets and physical manipulation with redundant components and checks for inconsistent counter readings ⁴. AI Security Forum includes that research direction as a project sketch ¹⁰.

What it establishes

These signals give statistical indicators of utilisation and workload type. Examples are whether a GPU is training ³ and whether data is resident in its memory ¹. They bear most directly on whether compute runs inference, not training. For whether declared hardware is idle, Monfared et al. present their timing measurements as heuristic indicators of usage ¹.

They cannot establish:

• Correct execution. Monfared et al. state that their measurements are "not designed to deliver cryptographic proof of correct execution" ¹.
• Which device answered. The timing challenges do not identify the individual GPU ¹.
• The content of the computation. The counters do not access model weights or training data ³.
• That all activity was declared. Gloria Z treats telemetry as one partial answer to resource accounting, and judges that it "seems extremely difficult to verify the completeness of workload declarations" ⁶.

Rahman and Tajdari treat counter telemetry as one layer of monitoring ³, and Monfared et al. offer their measurements as a complementary signal for anomaly detection ¹. Telemetry could be combined with other mechanisms:

• TEE attestation covers one declared deployment, not everything the chip does ⁶. Gloria Z suggests comparing counters with the declared workloads ⁶.
• Workload classification infers the workload type from telemetry. Rahman and Tajdari's classifier outputs a probability that a workload is training, and disguised workloads partly evade it even when the readings are authentic ³.
• Timed challenges trust only challenge generation, timing and verification in Monfared et al.'s design ¹. The authors design the probes for a setting in which host and GPU firmware may be modified. Their experiments test co-running language models on T4 and H100 GPUs without modified firmware, and they call the measurements heuristic indicators of usage ¹.

Threat model

The schemes trust different parts of the stack:

• Rahman and Tajdari's NVML classifier assumes the counters are genuine. They list the protections this would need: a tamper-resistant read path, an authenticated channel and secure boot of the monitoring software. They model two evaders: a cloud tenant with user-space control, and a hardware operator who controls the full software stack ³.
• In Monfared et al.'s timing challenges, the most adversarial case lets the host and GPU firmware be modified, virtualized or colluding. Only challenge generation, timing and verification are trusted, and the challenges run on the GPU being measured ¹.
• Guaranteeable Memory aims not to rely on any other component, including the main accelerator die ².

Confidentiality is only partial. The telemetry signals used to classify workloads are content-agnostic ³. Hardware performance counters are a known side channel ⁶, and NVIDIA disables the counters its profiling tools use in full confidential-computing mode because they could provide an avenue for side-channel attacks ⁷, which puts this mechanism in tension with TEE remote attestation for AI workloads.