Original title: Workload Identification with Physical Side Channels for AI Governance
Simone Gargiulo, Gabriel Kulp · August 2026
Regulators want to check if artificial intelligence labs follow safety rules. To do this, inspectors must know how computer chips called GPUs are being used. Software reports can be faked, but running tasks on hardware leaves physical clues. Researchers measured the electric power draw of an NVIDIA H200 chip from the outside, without relying on the operator. Different jobs create distinct electrical patterns. For instance, training an AI creates recognizable power shifts during memory updates. By analyzing these signals, the researchers accurately told the difference between training models, running finished models, and non-AI software. They also tested what happens if an operator actively tries to cheat by disguising training to look like regular model use. Even when operators used tricks to hide their work, a strengthened detector still caught the hidden training almost every time. This shows external physical monitoring could help verify how AI hardware runs.
Imagine listening to a car engine to tell if it is idling or accelerating. The sound is different, and you can tell without looking. Now suppose the driver could fake the engine sound. In this paper, the researchers show that a GPU's power consumption is like that engine sound: it reveals whether the GPU is training AI or doing something else, and it cannot be faked because it is a physical measurement.
Regulators need to verify that AI labs are complying with agreements on compute usage. Currently, they rely on software telemetry that can be faked. This work shows that measuring a GPU's power draw from outside can reliably tell whether it is training AI, running inference, or doing something else, providing a verifiable, independent check.
The abstract notes that the evasion strategies tested are not a comprehensive evaluation against adversarial behaviour. The detector's performance on diluted LoRA is lower without an additional rescue rule. The study is limited to the NVIDIA H200 GPU and power draw as the sole physical channel. It does not address other potential evasion methods or different hardware.
Ask anything about this paper. Answers come from its abstract, and say so when the abstract doesn't cover your question.
Workload Identification with Physical Side Channels for AI Governance — Simone Gargiulo, Gabriel Kulp
Abstract licence: CC0
Explanation generated by Synthesis from the abstract — it is not the original paper. This is a preprint, so it hasn't necessarily been peer reviewed.