Workload classification from telemetry and side channels

How it works

Workload classification infers what a chip is doing from signals that do not reveal the content of the computation ^{1 2}. Typical labels are training, inference and non-AI work ^{1 2}. Ansari lists it among monitoring mechanisms ³. It uses cluster-level signals such as power and network bandwidth, and node-level signals such as accelerator utilization and memory bandwidth ³.

There are two main signal sources:

• Software telemetry. Rahman and Tajdari use NVIDIA's NVML counters, including utilization, memory, power, temperature, clocks and PCIe traffic, sampled about once a second ¹. They describe these as zero-overhead, content-agnostic signals that do not access weights, data or hyperparameters ¹. A random-forest pipeline first separates ML from non-ML work, then training from inference ¹.
• Physical side channels. Gargiulo and Kulp clamp a current probe on a GPU's auxiliary power supply and classify five-second power recordings sampled at 10 MHz ². They argue that, unlike NVML telemetry, this channel can in principle be observed without the operator's cooperation ².

Where power is measured matters ⁴. Amodo Design describes each stage of data-centre power delivery, from the voltage regulator to the grid, as a low-pass filter: the further up the chain one measures, the less compute-level detail survives ⁴. Amodo argues that low-level power monitoring could be more expensive to spoof ⁴.

Similar methods have precedents outside AI governance ^{7 8}. Gangwal et al. detected covert cryptocurrency mining from CPU hardware performance counters with 99.9–100% binary accuracy on two test systems ⁷. Chen et al.'s Reveal detects system anomalies in ML clusters from hardware signals that operators can read, without knowledge of user workloads ⁸.

What it establishes

The authors report that, on the hardware tested, classifiers separate training from inference and non-ML work with high accuracy ^{1 2}. Rahman and Tajdari report 98.2% across their own corpus of NVML telemetry ¹. Gargiulo and Kulp report 97% from external power traces on one H200, for model families unseen in training ². Both figures fall for evasion strategies the classifier has not seen (see Evidence to date). The results support checks that hardware declared for inference or non-AI use is not training (This compute runs inference, not training) ^{1 2}.

What it cannot show:

• How much training, or of what. The papers classify workload type only, not how much training occurred or which model was trained ^{1 2}.
• AI training versus other heavy computing, from power alone. Ansari's April 2026 feasibility taxonomy noted that power monitoring alone cannot separate AI training from other high-performance computing without other signals, and that no published study had quantified false-positive rates for power-based training detection ³.
• Workload type from power level alone. Power draw depends on more than workload type: Gregersen et al. found that changing only the input data can alter GPU power in matrix multiplication by nearly 40% ⁶. Measured draw can also differ from rated power: Latif et al. recorded a peak of about 8.4 kW on an 8-GPU H100 node during training, 18% below its rated 10.2 kW, with GPUs near full utilization ⁵.

The signals can also reveal more than the workload class. Gao et al. recovered the architectures of models running on general-purpose processors from software-read power measurements, with 99.75% accuracy by their Levenshtein-distance measure ⁹.

Threat model

Rahman and Tajdari consider two evaders ¹:

• A cloud tenant who controls only user-space software.
• A hardware operator who controls the full stack and wants to hide unauthorized training from a regulator.

Their results depend on a tamper-resistant NVML read path and an authenticated telemetry channel, which they treat as minimum hardware-enabled guarantees (On-chip telemetry from timing, memory and performance counters) ¹. In their fifth round they give the evader white-box access to the classifier, which they describe as a disaster scenario for governance ¹. Gargiulo and Kulp treat the operator as adversarial and able to reshape the computation, but not able to control the external probe ².

Evidence

• Software telemetry. Rahman and Tajdari ran five rounds of monitor–evader iteration over 20 evasion strategy families on 9 GPU models spanning four architecture generations ¹. They report 98.2% accuracy across their corpus ¹. After hardening, strategies seen in training were always detected, but white-box strategies held out from training were detected only 43–87% of the time ¹.
• External power. Gargiulo and Kulp report 97% accuracy on held-out model families from a probe on one H200 NVL ². Their hardened detector caught three of four held-out evasion strategies at least 99% of the time, and diluted LoRA 48–88% of the time, or at least 98% with an added rule ². They release their 1,610 recordings and state that their attacks are not a comprehensive adversarial evaluation ².
• Earlier assessment. Before these papers, Ansari rated workload classification as deployable in cooperative settings and near-term in adversarial settings ³.

Limitations

• Forged or replayed telemetry. A privileged operator can forge or replay software-read counters unless hardware protects the read path ^{1 2}.
• Unseen evasion strategies. Detection falls to 43–87% for held-out white-box strategies on NVML telemetry ¹, and to 48–88% for diluted LoRA on external power before an added rule ². In Gargiulo and Kulp's tests the evasion strategies cost 28.1–69.3% of throughput ².
• Scale. Results are single-node and NVIDIA-only ¹, or from one H200 ².
• Power sampling. Yang and colleagues found that on A100 and H100 GPUs the built-in power reading, which nvidia-smi obtains through NVML, samples only 25% of runtime. The GPU can draw very different power in the other 75% without the reading showing it ¹⁰. They also found the reading's error to be within about ±5% in most cases, against the ±5 W that NVIDIA claims ¹⁰.
• Distributed training. Ansari reports that classification accuracy degrades when training is distributed across providers ³.
• Blurring categories. The training-inference distinction may lose governance value ³.
• Spoofed power monitoring. Amodo expects that power monitoring can likely be spoofed, but still sees value in it as a complement to other verification systems ⁴.