Workload classification infers what a chip is doing, such as training a model, serving it or running non-AI code.
It uses signals that do not require reading weights or data: software counters such as power and utilization, or power draw measured outside the chip. Two 2026 preprints report high accuracy on their own test sets: 98.2% from software counters across nine NVIDIA GPU models, and 97% from an external probe on one H200. In the hardest cases, unseen evasion strategies cut detection to 43–87% and 48–88% respectively; an added rule raised the second to at least 98%, with up to 2.5 percentage points more false alarms on held-out recordings.
The main obstacle is trust in the signal: operator-controlled software reads the counters, so they can be forged unless hardware protects the reading. An external probe avoids this in principle. Results cover single machines, and no independent evaluation exists.
Two preprints publish end-to-end results on current GPUs against stated, iterated adversaries; nobody independent has evaluated them.
Assessed use: telling training from inference and other work using genuine telemetry, including disguised workloads
On this page
How it works
Workload classification infers what a chip is doing from signals that do not reveal the content of the computation 1 2. Typical labels are training, inference and non-AI work 1 2. Ansari lists it among monitoring mechanisms 3. It uses cluster-level signals such as power and network bandwidth, and node-level signals such as accelerator utilization and memory bandwidth 3.
There are two main signal sources:
- Rahman and Tajdari use software telemetry from NVIDIA's NVML counters, including utilization, memory, power, temperature, clocks and PCIe traffic, sampled about once a second 1. They describe these as zero-overhead, content-agnostic signals that do not access weights, data or hyperparameters 1. A random-forest pipeline first separates ML from non-ML work, then training from inference 1.
- Gargiulo and Kulp read a physical side channel with a current probe clamped on a GPU's auxiliary power supply, and classify five-second power recordings sampled at 10 MHz 2. They argue that, unlike NVML telemetry, this channel can in principle be observed without the operator's cooperation 2.
AI Security Forum proposes using power, electromagnetic, acoustic and thermal sensors to cross-check workload claims 12. Its sketch calls for tamper-evident sensors and safeguards against data leakage and sabotage 12.
Where power is measured matters 4. Amodo Design describes each stage of data-centre power delivery, from the voltage regulator to the grid, as a low-pass filter: the further up the chain one measures, the less compute-level detail survives 4. Amodo argues that low-level power monitoring could be more expensive to spoof 4.
Similar methods have precedents outside AI governance 7 8. Gangwal et al. detected covert cryptocurrency mining from CPU hardware performance counters with 99.9–100% binary accuracy on two test systems 7. Chen et al.'s Reveal detects system anomalies in ML clusters from hardware signals that operators can read, without knowledge of user workloads 8.
What it establishes
The authors report that, on the hardware tested, classifiers separate training from inference and non-ML work with high accuracy 1 2. Rahman and Tajdari report 98.2% across their own corpus of NVML telemetry 1. Gargiulo and Kulp report 97% from external power traces on one H200, for model families unseen in training 2. Both figures fall for evasion strategies the classifier has not seen 1 2. The results support checks that hardware declared for inference or non-AI use is not training (This compute runs inference, not training) 1 2.
What it cannot show:
- The papers classify workload type only, not how much training occurred or which model was trained 1 2.
- Ansari's April 2026 feasibility taxonomy noted that power monitoring alone cannot separate AI training from other high-performance computing without other signals, and that no published study had quantified false-positive rates for power-based training detection 3.
- Power draw depends on more than workload type: Gregersen et al. found that changing only the input data can alter GPU power in matrix multiplication by nearly 40% 6. Measured draw can also differ from rated power: Latif et al. recorded a peak of about 8.4 kW on an 8-GPU H100 node during training, 18% below its rated 10.2 kW, with GPUs near full utilization 5.
The signals can also reveal more than the workload class. Gao et al. recovered the architectures of models running on general-purpose processors from software-read power measurements, with 99.75% accuracy by their Levenshtein-distance measure 9.
Threat model
Rahman and Tajdari consider two evaders 1:
- A cloud tenant who controls only user-space software.
- A hardware operator who controls the full stack and wants to hide unauthorized training from a regulator.
Their results depend on a tamper-resistant NVML read path and an authenticated telemetry channel, which they treat as minimum hardware-enabled guarantees (On-chip telemetry from timing, memory and performance counters) 1. In their fifth round they give the evader white-box access to the classifier, which they describe as a disaster scenario for governance 1. Gargiulo and Kulp treat the operator as adversarial and able to reshape the computation, but not able to control the external probe 2.