{"id":"c8fb893c-9a8d-47cc-94c0-8d155fbc6c1f","arxiv_id":"2607.05993","paper_version":1,"verdict":"CONDITIONAL","confidence":"HIGH","novelty_score":7.0,"correctness_risk":"unknown","formal_verification":"none","parameter_count":5,"one_line_summary":"Coordinated GPU workload manipulation by unprivileged cloud tenants can induce high-frequency power modulations that destabilize inverter-dominated grids, causing harmonic distortion, negative damping, and potential cascading failures.","lead":"This paper shows that a cloud tenant running carefully timed GPU workloads can inject high-frequency power fluctuations into the electrical grid, potentially destabilizing power infrastructure in data centers with high renewable energy penetration. A smart generalist should read it because it identifies a new cross-domain security blind spot where legitimate computing access becomes a weapon against physical power systems.","discovery_kind":"unclear","skeptic_critique":{"model":"glm-5.2","headline":"The synchronized aggregation model is the load-bearing assumption; the paper's own jitter data (§5.3.2) shows fragility at 100 μs, but realistic cloud scheduling jitter (1–10 ms) would randomize phases at the claimed 2–6 kHz modulation frequencies, reducing aggregate amplitude by orders of magnitude","rationale":"The reader correctly identified the synchronized worst-case aggregation as the most load-bearing assumption. I agree and add two specific technical points that strengthen this concern. First, the paper's claim that asynchronization can be compensated by adding more devices (§5.3.2) is misleading because randomized phases scale as √N, not N—compensating a factor-k amplitude reduction requires k² more devices, which could mean millions of GPUs rather than thousands. Second, the simulation's single aggregated current source bypasses per-GPU SPS dynamics that the paper's own hardware data (Figure 11) shows provide the strongest high-frequency attenuation; 1,000 individual SPS units would compound this filtering before aggregation. Both points are grounded in the paper's own experimental evidence and text. The core cyber-physical insight—that GPU workload modulation can excite DER control-loop resonances—is genuinely novel and well-supported by the 8-kW hardware testbed validation (CPL/NIR behavior, impedance frequency response, spectral propagation through power stages). The impedance-based analytical framework is sound. The CONDITIONAL verdict is appropriate: the mechanism is real and important, but the severity claims (46.8% THD, -0.27 damping, 81% cascading loss) are not yet bounded under realistic synchronization and per-device power electronics conditions. The paper is honest about the synchronization limitation but the abstract and conclusion present the extreme numbers without adequate qualification. No data integrity issues, circular reasoning, or ad hominem concerns were identified.","tokens_in":22860,"tokens_out":7733,"duration_ms":736033,"concrete_test":"Re-run the 1-MW Simulink model from §5.1 with two modifications: (1) replace the single aggregated current source with N=1,000 individual GPU+SPS sub-circuits, each with independent Gaussian timing jitter σ_τ = 1 ms; (2) measure THD and damping ratio at 90% DER penetration. If THD falls below the 13% IEC 61000-3-12 threshold or the damping ratio remains positive, the headline severity claims require revision. As a cheaper proxy: re-run with the single source but with amplitude scaled by the analytically derived coherence factor for σ_τ = 1 ms at the chosen modulation frequency.","verdict_should_be":"UNCHANGED","load_bearing_attack":"All headline grid-impact results (46.8% THD, -0.27 damping ratio, 81% cascading load loss) derive from §5.1's synchronized worst-case aggregation, where 1,000 GPUs are modeled as a single ideal current source with perfect phase alignment. The paper acknowledges this is a 'conservative bound' but substantially underestimates the gap. At 2 kHz (period = 500 μs), §5.3.2 reports ~20% amplitude reduction at σ_τ = 100 μs. At 5 kHz (period = 200 μs), even 50 μs jitter is 25% of the period. Realistic cloud scheduling jitter—including OS scheduling non-determinism, CUDA kernel launch latency, VRM response variability, and network latency—plausibly falls in the 0.5–5 ms range, which would largely randomize phases at all claimed modulation frequencies. With randomized phases, aggregate amplitude scales as √N rather than N, so the effective modulation from 1,000 GPUs would be ~3% of the synchronized value, not 80%. The paper's claim that asynchronization 'can be compensated by increasing the number of victim devices' (§5.3.2) is misleading: compensating a factor-k reduction requires k² more devices, not k. Additionally, the simulation models 1,000 GPUs as a single current source, bypassing the per-GPU SPS dynamics that the paper's own hardware experiments (§5.2.1, Figure 11) show provide 'the strongest high-frequency attenuation.' Even with perfect synchronization, 1,000 individual SPS units would each filter high-frequency modulation locally before aggregation, potentially reducing the aggregate signal well below what the single-source simulation predicts. The core insight—that GPU power modulation can excite DER resonances—is well-supported by hardware validation; the severity scaling from 6 GPUs to 1,000 is not.","agreement_with_reader":"agree"},"referee_report":{"model":"glm-5.2","summary":"This paper introduces Bit2Watt, a cyber-physical vulnerability in which a legitimate but malicious cloud tenant manipulates GPU workloads to induce high-frequency power modulations (up to 6 kHz) that can destabilize local power infrastructure in high-DER-penetration scenarios. The paper proposes two attack methods (SWMA and LTMA), validates GPU power modulation on 6 GPU models, and validates the CPL/NIR behavior of GPU clusters and the frequency response of DER output impedance through hardware experiments. The grid impact is assessed via Simulink simulations, showing that 1,000 synchronized GPUs in a 1-MW system with 90% DERs can raise current THD to 46.8% and produce a negative damping ratio of -0.27. The paper also analyzes a Watt2Bit feedback path including DoS and EMI-based exfiltration.","tokens_in":23113,"tokens_out":1552,"duration_ms":271301,"significance":"The paper identifies a genuinely novel and timely attack surface at the intersection of GPU-accelerated computing and renewable-integrated power systems. The cross-domain threat model—operating entirely within legitimate tenant privileges—is well-motivated. Strengths include real-world GPU power modulation measurements across 6 architectures (Table 1), hardware testbed experiments validating CPL/NIR behavior with 10 trials (Figure 6), impedance-based stability analysis using the standard Middlebrook criterion (Eq. 1), a hardware power delivery chain testbed (Figure 10), and a detectability analysis against realistic monitoring tools (Table 4, Figure 14). The falsifiable predictions regarding THD and damping ratio under specific GPU counts and DER penetration levels are commendable.","major_comments":[{"comment":"§5.1: The synchronized worst-case aggregation model is the load-bearing assumption for all headline grid-impact results (46.8% THD, -0.27 damping ratio, 81% cascading load loss). The paper models 1,000 GPUs as a single ideal current source with perfect phase alignment. The paper's own jitter analysis (§5.3.2) reports ~20% amplitude reduction at σ_τ = 100 μs for 2 kHz modulation. However, realistic cloud scheduling jitter—including OS scheduling non-determinism, CUDA kernel launch latency, VRM response variability, and network latency—plausibly falls in the 0.5–5 ms range, which would largely randomize phases at the claimed 2–6 kHz modulation frequencies. With randomized phases, aggregate amplitude scales as √N rather than N, reducing the effective modulation from 1,000 GPUs to approximately 3% of the synchronized value. The paper does not adequately characterize realistic jitter magnitud","section":null},{"comment":"§5.3.2: The claim that asynchronization 'can be compensated by increasing the number of victim devices, owing to the scaling effect of large populations' is misleading. If phase randomization reduces aggregate amplitude by a factor of k, compensating requires k² more devices (since √N scaling), not k more. This statement should be corrected, as it materially affects the feasibility assessment of the attack under realistic conditions.","section":null},{"comment":"§5.1 and §5.2.1: The simulation models 1,000 GPUs as a single current source, bypassing per-GPU SPS dynamics. However, the paper's own hardware experiments (§5.2.1, Figure 11a) show that 'the SPS stage introduces the strongest high-frequency attenuation,' absorbing high-frequency modulation locally. The simulation thus omits a filtering stage that the paper's own empirical evidence identifies as the primary attenuator of the attack signal. The paper should either (a) incorporate per-GPU SPS filtering into the simulation model and re-evaluate the headline results, or (b) provide a quantitative bound on how much the SPS attenuation would reduce the effective aggregated modulation reaching the PCC, and discuss the implications for the reported THD and damping ratio values.","section":null},{"comment":"§5.3.2: The jitter analysis is limited to σ_τ ≤ 100 μs at a single frequency (2 kHz). Given that the paper claims modulation frequencies up to 6 kHz (period ≈ 167 μs), and that the robustness 'decreases as the frequency increases' (acknowledged in the text), the absence of jitter analysis at higher frequencies leaves the feasibility of the most novel aspect of the attack (high-frequency modulation) unexamined. A sensitivity analysis at 5–6 kHz with realistic jitter values would substantially strengthen or constrain the claims.","section":null}],"minor_comments":[{"comment":"Table 1: The LTMA frequency for RTX 2080 is listed as 1,200 Hz, but the text in §4.2.3 references '1.23 kHz' for LTMA. Please reconcile.","section":null},{"comment":"§4.2.3: The sentence 'This limitation is attributed to the finite dynamic response of GPU power management and voltage regulation, which cannot fully track rapid workload transitions' could benefit from a quantitative characterization of the VRM bandwidth to support the 6 kHz ceiling claim.","section":null},{"comment":"Figure 4: The x-axis labels are somewhat unclear regarding which segments correspond to which attack. Consider adding vertical separators or annotations.","section":null},{"comment":"§5.1: The load composition (1/4 GPU, 3/4 background) is motivated by Virginia electricity consumption patterns, but no specific citation or data is provided for this ratio. Please add a reference.","section":null},{"comment":"Table 3: The SPS rectifier inner loop lists i*_q = 0, but the SPS is a DC-DC converter. Please clarify whether this refers to a front-end AC-DC stage or correct if it is a typo.","section":null},{"comment":"Figure 19 (Appendix C): The legend text appears garbled ('<<== = 10.0 77s'). Please fix the rendering of σ_τ values.","section":null},{"comment":"§5.3.5: The exfiltration experiment uses a 50-bit test sequence. A BER analysis over a longer sequence with varying SNR conditions would strengthen the covert channel claim.","section":null},{"comment":"The paper would benefit from a clearer statement, early in §5.1, that all simulation results represent a synchronized worst-case bound, so that readers do not interpret the headline numbers as expected realistic outcomes.","section":null}],"recommendation":"major_revision","confidential_remarks":"The synchronized aggregation assumption is the central issue. The paper's own data (jitter sensitivity, SPS attenuation) suggests the headline results may overstate realistic impact by one or more orders of magnitude. The authors have the experimental data to bound this gap more tightly; a revision that incorporates per-GPU SPS filtering into the simulation and extends the jitter analysis to realistic cloud scheduling timescales (0.5–5 ms) at multiple frequencies would either confirm or substantially constrain the attack's feasibility. This is a fixable issue within the manuscript's scope, but it is load-bearing for the central claims and must be addressed before acceptance. The novelty of the attack surface and the quality of the hardware experiments justify a major revision rather than rejection."},"author_rebuttal":{"model":"glm-5.2","summary":"We thank the referee for a careful and substantive review. The referee's comments on synchronization realism, the SPS filtering gap between simulation and hardware, and the limited jitter analysis are well-taken. We address each below.","responses":[{"response":"The referee raises a valid and important concern. We acknowledge that the synchronized worst-case aggregation model represents an idealized upper bound, and that realistic cloud scheduling jitter—arising from OS scheduling non-determinism, CUDA kernel launch latency, VRM response variability, and network latency—would substantially reduce the aggregate modulation amplitude. The referee's estimate of 0.5–5 ms jitter is plausible for general cloud environments, and at 2–6 kHz modulation frequencies (periods of 500 μs to 167 μs), such jitter would indeed drive the system toward √N scaling rather than N scaling, reducing the effective aggregate modulation by roughly an order of magnitude or more. Our current jitter analysis (σ_τ ≤ 100 μs at 2 kHz) does not cover this realistic regime. We will revise the manuscript to: (1) explicitly acknowledge that the headline results (46.8% THD, -0.27 damping ratio, 81% cascading loss) represent a synchronized worst-case upper bound; (2) add a quantitative discussion of the √N scaling regime under realistic jitter, including the implied increase in required GPU counts; and (3) reframe the contribution as characterizing the vulnerability's maximum potential impact rather than its expected impact under typical conditions. We believe the vulnerability remains relevant even under √N scaling—large-scale GPU deployments of 10⁴–10⁵ units are increasingly common—but the required scale and the framing of results must be revised to reflect this honestly.","revision_made":"yes","referee_comment":"§5.1: The synchronized worst-case aggregation model is the load-bearing assumption for all headline grid-impact results. Realistic cloud scheduling jitter (0.5–5 ms) would largely randomize phases at 2–6 kHz, reducing aggregate amplitude from N to √N scaling. The paper does not adequately characterize realistic jitter magnitudes."},{"response":"The referee is mathematically correct. Under √N scaling, if the aggregate amplitude is reduced by a factor of k relative to the synchronized case, compensating for this reduction requires k² additional devices, not k. Our statement as written is misleading and will be corrected. We will revise §5.3.2 to state the correct scaling relationship and discuss its implications for attack feasibility. Specifically, we will note that under realistic jitter conditions, the number of GPUs required to achieve the same impact as the synchronized case grows quadratically with the amplitude reduction factor, which materially affects the feasibility assessment.","revision_made":"yes","referee_comment":"§5.3.2: The claim that asynchronization 'can be compensated by increasing the number of victim devices, owing to the scaling effect of large populations' is misleading. If phase randomization reduces aggregate amplitude by a factor of k, compensating requires k² more devices (since √N scaling), not k more."},{"response":"This is a fair and significant observation. There is an internal inconsistency in the paper: our hardware experiments (Figure 11a) demonstrate that the SPS stage introduces the strongest high-frequency attenuation, yet the Simulink model in §5.1 aggregates all GPUs into a single current source at the PCC without explicitly modeling per-GPU SPS filtering. We will address this in two ways. First, we will add a quantitative bound on the SPS attenuation effect. Based on the spectral measurements in Figure 11a, the SPS stage attenuates high-frequency components (above ~1 kHz) by approximately 15–25 dB relative to the GPU-side signal. We will incorporate this as a frequency-dependent attenuation factor applied to the aggregated current source in the simulation, and re-evaluate the headline THD and damping ratio results. We expect the THD and damping degradation to be reduced but not eliminated, since (a) the SPS attenuation is frequency-dependent and less severe below ~300 Hz, and (b) the UPS stage reshapes rather than purely attenuates the disturbance, projecting energy into lower-frequency bands that still interact with DER control loops. Second, we will explicitly discuss the gap between the simulation model and the hardware measurements as a limitation, and clarify that the revised results represent a more realistic—though still conservative—estimate. We note that fully incorporating per-GPU SPS dynamics with individual VRM models for 1,000 GPUs is computationally prohibitive in Simulink, so the attenuation-factor approach is a practical middle ground.","revision_made":"partial","referee_comment":"§5.1 and §5.2.1: The simulation models 1,000 GPUs as a single current source, bypassing per-GPU SPS dynamics. The paper's own hardware experiments show SPS introduces the strongest high-frequency attenuation. The simulation omits a filtering stage that the paper's own empirical evidence identifies as the primary attenuator."},{"response":"The referee is correct that the jitter analysis should be extended to higher frequencies. At 5–6 kHz, the modulation period is 167–200 μs, meaning that even σ_τ = 50 μs represents a quarter-period of jitter, which would significantly degrade phase coherence. We will add a sensitivity analysis at 5 kHz and 6 kHz with σ_τ values of 10, 50, 100, 500, and 1000 μs. Based on preliminary reasoning, we expect that at 6 kHz, even σ_τ = 50 μs will reduce aggregate amplitude by more than 50%, and σ_τ ≥ 500 μs will effectively randomize phases entirely. This analysis will likely constrain the feasibility of high-frequency modulation under realistic conditions and will be reported honestly. We anticipate that the results will show a clear frequency-dependent feasibility boundary: lower modulation frequencies (e.g., 500 Hz–1 kHz) remain robust under realistic jitter, while the highest frequencies (5–6 kHz) require either very tight synchronization (as in dedicated HPC clusters with PTP) or very large GPU populations to compensate for √N scaling. This will strengthen the paper by providing a more nuanced and realistic feasibility assessment rather than presenting the maximum frequency as practically achievable under all conditions.","revision_made":"yes","referee_comment":"§5.3.2: The jitter analysis is limited to σ_τ ≤ 100 μs at a single frequency (2 kHz). Given claims up to 6 kHz (period ≈ 167 μs), the absence of jitter analysis at higher frequencies leaves the feasibility of the most novel aspect unexamined."}],"tokens_in":22730,"tokens_out":1709,"duration_ms":108568,"standing_objections":[]},"desk_editor":{"model":"glm-5.2","letter":"The core insight here is genuinely new: an unprivileged cloud tenant can modulate GPU workloads to inject high-frequency power fluctuations that excite inverter control-loop resonances in DER-rich grids. Nobody has formalized this cyber-physical coupling before, and the hardware work backs it up. Table 1 measures power modulation up to 6 kHz across six GPU models. The CPL/NIR validation (Figure 6) is clean — 10 trials, mean power error of 1.5% under 10% voltage perturbation. The spectral propagation analysis through SPS→PDU→UPS (Figure 11) is the paper's best empirical contribution: it shows SPS strongly attenuates high-frequency components but the UPS reshapes them into low-frequency DC-bus oscillations (ripple from 0.45% to 2.82%). That attenuation-and-reshaping mechanism is real and well-documented with actual hardware. The detectability analysis (Table 4, Figure 14) is also useful — standard telemetry is genuinely blind to this. The impedance-based stability analysis using the Middlebrook criterion is textbook and sound. No circular reasoning, no data integrity concerns. Credit where it's due: the GPU-side and inverter-side mechanisms are validated with real measurements, and the Watt2Bit feedback path (harmonic-induced thermal stress, EMI exfiltration at 99% decode accuracy) is a nice extension. Now the soft spot, and it's a big one. Every headline number — 46.8% THD, -0.27 damping ratio, 81% cascading load loss — comes from §5.1, where 1,000 GPUs are modeled as a single ideal current source with perfect phase alignment. The paper calls this a 'conservative bound,' but the gap between this and reality is enormous, and the paper's own data shows it. At 2 kHz (period = 500 μs), §5.3.2 reports ~20% amplitude reduction at σ_τ = 100 μs. At 5 kHz, even 50 μs jitter is 25% of the period. Realistic cloud scheduling jitter — OS non-determinism, CUDA kernel launch latency, VRM response variability, network latency — plausibly falls in the 0.5–5 ms range, which would randomize phases across multiple full periods at all claimed modulation frequencies. With randomized phases, aggregate amplitude scales as √N, not N, so 1,000 GPUs would yield roughly 3% of the synchronized value. The paper's claim that asynchronization 'can be compensated by increasing the number of victim devices' is wrong on the math: compensating a factor-k reduction requires k² more devices, not k. Additionally, the single-current-source simulation bypasses per-GPU SPS dynamics, but the paper's own Figure 11 shows SPS provides the strongest high-frequency attenuation. Even with perfect synchronization, 1,000 individual SPS units would each filter locally before aggregation. The 8-kW, 6-GPU hardware testbed does not bridge to the 1-MW, 1,000-GPU simulation. The stress-test concern lands squarely. The core finding — that GPU power modulation can excite DER resonances — survives. The severity scaling from 6 GPUs to 1,000 does not. This paper is for researchers working at the intersection of data center power systems and grid stability, and for security people thinking about cross-domain attack surfaces. It deserves a serious referee who can push the authors to (1) model per-GPU SPS dynamics in the simulation, (2) extend the jitter analysis to realistic millisecond-scale values, and (3) either qualify the headline numbers prominently or recompute them under realistic synchronization assumptions. The fundamental contribution is real and publishable; the severity claims need to be brought down to what the evidence supports.","headline":"Novel cross-domain vulnerability with real hardware validation, but headline severity numbers rest on an unrealistic synchronization assumption","tokens_in":23714,"tokens_out":1668,"would_cite":false,"duration_ms":107638,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"glm-5.2","headline":"GPU workloads weaponized to destabilize renewable-powered grids","keywords":[],"falsifier":"If realistic cloud scheduling jitter (millisecond-scale) and device heterogeneity reduce the aggregated modulation amplitude below the threshold needed to excite DER resonant modes or push damping negative, the attack would not achieve grid destabilization with practically obtainable numbers of GPUs.","tokens_in":23031,"feed_emoji":"⚡","tokens_out":915,"duration_ms":243253,"temperature":0.7,"pith_summary":"This paper identifies and analyzes a new class of cyber-physical vulnerability, which the authors call Bit2Watt, in which a legitimate cloud tenant manipulates GPU computational workloads to induce controlled, high-frequency power modulations that destabilize local power infrastructure. The core mechanism is the coupling between GPU power dynamics and inverter-dominated grids with high distributed energy resource (DER) penetration. GPUs act as near constant-power loads (CPLs) exhibiting negative incremental resistance, meaning that when grid voltage drops, GPU current draw increases to maintain power, which further depresses voltage in a positive feedback loop. The authors design two attack methods: a synthetic workload modulation attack (SWMA) using custom CUDA kernels that achieves modulation frequencies up to 6,000 Hz, and an LLM training modulation attack (LTMA) that embeds modulation logic within standard deep learning training pipelines. They validate through impedance-based analysis, Simulink simulations, and real-world experiments on GPUs and PV inverters. Under a synchronized worst-case aggregation model, manipulating 1,000 GPUs in a 1-MW system with 90% DERs raises current total harmonic distortion (THD) to 46.8% and produces a negative damping ratio of -0.27, indicating an unstable operating mode. The attack operates entirely through legitimate workload execution paths, making it difficult to detect with standard cloud- and facility-side monitoring tools, which typically report coarse-grained, temporally averaged statistics rather than high-bandwidth instantaneous waveforms. The authors further analyze a feedback path they term Watt2Bit, where grid disturbances propagate back to disrupt computing services through protection trips and thermal stress, and demonstrate a covert EMI side-channel exfiltration vector achieving over 99% bit recovery accuracy.","feed_headline":"GPU workloads weaponized to destabilize renewable-powered grids","feed_subtitle":"A legitimate cloud tenant can modulate GPU power draw at kilohertz frequencies to destabilize inverter-dominated grids, raising current THD","key_machinery":"Impedance-based model linking GPU constant-power-load negative incremental resistance with DER inverter frequency-shaped output impedance, validated through Simulink simulations and hardware experiments on GPU clusters and PV inverters","core_discovery":"The central discovery is that legitimate, user-level GPU workload manipulation can serve as a high-frequency actuator capable of destabilizing inverter-dominated power grids. The mechanism rests on two interacting properties: the negative incremental resistance of GPU clusters as constant-power loads, and the frequency-shaped output impedance of inverter-based DERs, which exhibits resonant peaks at high frequencies that conventional stability analysis does not typically consider. When GPU-induced power modulations align with these resonant frequencies, they can amplify harmonic distortion, degrade system damping past the stability boundary (Hopf bifurcation), and in simulated extreme cases, ","pith_inferences":[],"forward_implications":["Cloud providers and grid operators may need to jointly monitor workload-level power signatures and grid-side power quality, as isolated monitoring at either layer fails to detect this attack class.","Data center power architecture standards may need revision to account for high-frequency load modulation capabilities of GPU clusters, particularly as DER penetration increases and grid stiffness decreases.","The Watt2Bit feedback loop suggests that power-quality degradation from workload manipulation could cascade into computing service disruptions, creating a self-reinforcing cyber-physical failure cycle.","The demonstrated EMI exfiltration channel (99%+ accuracy) suggests that workload-induced power modulation could serve as a covert communication path across air-gapped or isolated computing environments.","Grid stability analysis for regions with high data-center concentration and high DER penetration may need to incorporate workload-induced high-frequency excitation as a threat scenario."],"fun_headline_variants":["Bit2Watt: GPU workload manipulation destabilizes inverter-based power grids","Legitimate GPU tenants can induce grid-destabilizing high-frequency power modulations","GPU clusters as high-frequency actuators: a cyber-physical grid vulnerability","Cloud tenant GPU power draw modulation raises current THD to 46.8% in simulated 1-MW grid","Synchronized GPU workload manipulation degrades damping ratio to -0.27 under high-DER cond"],"cache_read_input_tokens":0,"weakest_assumption_plain":"The synchronized worst-case aggregation model assumes all victim GPUs switch between high- and low-power states with identical modulation frequency and phase, without modeling device-level heterogeneity, phase dispersion, or communication delays. The paper acknowledges this is a conservative bound, and its own analysis shows that at 100 microseconds of timing jitter, attack amplitude drops by roughly 20%. Real cloud environments exhibit millisecond-scale scheduling non-determ","fun_headline_variants_meta":{"raw":{"variants":["Bit2Watt: GPU workload manipulation destabilizes inverter-based power grids","Legitimate GPU tenants can induce grid-destabilizing high-frequency power modulations","GPU clusters as high-frequency actuators: a cyber-physical grid vulnerability","Cloud tenant GPU power draw modulation raises current THD to 46.8% in simulated 1-MW grid","Synchronized GPU workload manipulation degrades damping ratio to -0.27 under high-DER conditions"]},"model":"glm-5.2","effort":"high","cost_usd":0.0,"raw_usage":{"total_tokens":771,"prompt_tokens":675,"completion_tokens":96,"prompt_tokens_details":null},"tokens_in":675,"tokens_out":96,"duration_ms":74134,"temperature":1.0,"reasoning_tokens":null,"cache_read_input_tokens":0,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-07-08T19:17:53.719915+00:00","model_set":{"reader":"glm-5.2"},"falsifier":"If realistic cloud scheduling jitter (millisecond-scale) and device heterogeneity reduce the aggregated modulation amplitude below the threshold needed to excite DER resonant modes or push damping negative, the attack would not achieve grid destabilization with practically obtainable numbers of GPUs.","supporting_citations":[],"review_version":1}