# Workload Identification with Physical Side Channels for AI Governance

arXiv: https://arxiv.org/abs/2609.00309 · HTML: https://mlsanity.com/paper/2609.00309/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 12 of its 21 references that are in the map.
- First posted on arXiv 31 Aug 2026.

## Builds on (most cited first, 12 of 12)

- [Open Problems in Technical AI Governance](https://mlsanity.com/paper/2407.14981/) (2024)
- [What does it take to catch a Chinchilla? Verifying Rules on Large-Scale Neural Network Training via Compute Monitoring](https://mlsanity.com/paper/2303.11341/) (2023)
- [MoEcho: Exploiting Side-Channel Attacks to Compromise User Privacy in Mixture-of-Experts LLMs](https://mlsanity.com/paper/2508.15036/) (2025)
- [Verifying International Agreements on AI: Six Layers of Verification for Rules on Large-Scale AI Development and Deployment](https://mlsanity.com/paper/2507.15916/) (2025)
- [Mechanisms to Verify International Agreements About AI Development](https://mlsanity.com/paper/2506.15867/) (2025)
- [Can one hear the shape of a neural network?: Snooping the GPU via Magnetic Side Channel](https://mlsanity.com/paper/2109.07395/) (2021)
- [Hardware-Enabled Mechanisms for Verifying Responsible AI Development](https://mlsanity.com/paper/2505.03742/) (2025)
- [Expert Selections In MoE Models Reveal (Almost) As Much As Text](https://mlsanity.com/paper/2602.04105/) (2026)
- [Flexible Hardware-Enabled Guarantees for AI Compute](https://mlsanity.com/paper/2506.15093/) (2025)
- [Detecting Hidden ML Training With Zero-Overhead Telemetry](https://mlsanity.com/paper/2606.19262/) (2026)
- [Kraken: Higher-order EM Side-Channel Attacks on DNNs in Near and Far Field](https://mlsanity.com/paper/2603.02891/) (2026)
- [Measurement of Generative AI Workload Power Profiles for Whole-Facility Data Center Infrastructure Planning](https://mlsanity.com/paper/2604.07345/) (2026)

## Abstract (arXiv)

AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. Here, we show that an external observer can identify the class of the workload running on an NVIDIA H200 from its power draw. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. We recorded 930 five-second traces at ~ 10 MHz, covering seventeen open LLM families and twenty-five non-AI workloads. Over this corpus we separate training from inference and from non-AI computation with an accuracy of 97% and a macro-averaged F1 score of 0.955, evaluated on model families unseen during training. AI workload spectral content predominantly lies below ~ 20kHz and training is particularly recognizable through the memory-bound optimizer update. The GPU operator is then treated as adversarial and able to reshape the physical computation itself. Four evasion strategies are tested to disguise training as inference, producing an additional 680 adversarial traces. A detector hardened against evasion strategies, with the tested strategy held out, catches training ≥ 99% of the time for three of the four strategies. The fourth, diluted low-rank adaptation (LoRA), is detected 48--88% of the time with a hardened classifier, rising to ≥ 98% with an additional rescue rule. While these attacks are not a comprehensive evaluation against adversarial behaviour, they offer initial insights beyond genuine activities and a dataset for developing and testing stronger evasion mechanisms.