Paper deep dive
Workload Identification with Physical Side Channels for AI Governance
Simone Gargiulo, Gabriel Kulp
Intelligence
Status: succeeded | Model: Gemma-4-26B-A4B | Prompt: intel-v1 | Confidence: 91%
Last extracted: 9/2/2026, 4:40:28 AM
Summary
This paper demonstrates that an external observer can identify AI workload classes (training, inference, non-AI) running on an NVIDIA H200 GPU by analyzing its power draw via a Rogowski current probe. The study records 930 genuine traces across 17 LLM families and 25 non-AI workloads, achieving 97% accuracy and an F1 score of 0.955. It also tests four adversarial evasion strategies designed to disguise training as inference, evaluating the robustness of a hardened classifier. While most evasion strategies are detected with >99% accuracy, diluted Low-Rank Adaptation (LoRA) is more challenging, requiring a specific rescue rule to achieve high detection rates.
Entities (8)
Relation Signals (5)
Rogowski current probe → measures → Power Draw
confidence 95% · Workload activity is recorded using a Rogowski current probe... measures the aggregate current drawn by the GPU
Power Draw → enablesidentificationof → GPU Training
confidence 92% · identify the class of the workload running on an NVIDIA H200 from its power draw... separate training from inference
Diluted LoRA → isusedtodisguise → GPU Training
confidence 90% · Four evasion strategies are tested to disguise training as inference... diluted low-rank adaptation (LoRA)
NVML → isvulnerabletospoofing → Power Draw
confidence 88% · Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently
Random Forest → classifies → Workload Type
confidence 85% · a two-stage random forest was found to be among the best approaches for distinguishing different workloads
Cypher Suggestions (0)
No Cypher suggestions yet.
Abstract
Abstract:AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with agreements requires the regulating authority to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. Here, we show that an external observer can identify the class of the workload running on an NVIDIA H200 from its power draw. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. We recorded $930$ five-second traces at $\sim 10$ MHz, covering seventeen open LLM families and twenty-five non-AI workloads. Over this corpus we separate training from inference and from non-AI computation with an accuracy of $97\%$ and a macro-averaged F1 score of $0.955$, evaluated on model families unseen during training. AI workload spectral content predominantly lies below $\sim 20$kHz and training is particularly recognizable through the memory-bound optimizer update. The GPU operator is then treated as adversarial and able to reshape the physical computation itself. Four evasion strategies are tested to disguise training as inference, producing an additional 680 adversarial traces. A detector hardened against evasion strategies, with the tested strategy held out, catches training $\geq 99\%$ of the time for three of the four strategies. The fourth, diluted low-rank adaptation (LoRA), is detected $48$--$88\%$ of the time with a hardened classifier, rising to $\geq 98\%$ with an additional rescue rule. While these attacks are not a comprehensive evaluation against adversarial behaviour, they offer initial insights beyond genuine activities and a dataset for developing and testing stronger evasion mechanisms.
Tags
Links
- Source: https://arxiv.org/abs/2609.00309v1
- Canonical: https://arxiv.org/abs/2609.00309v1
Trouble viewing inline? Open PDF directly →
Full Text
35,999 characters extracted from source content.
Expand or collapse full text
Workload Identification with Physical Side Channels for AI Governance Simone Gargiulo Affiliation: Pivotal Research Email: simonegargiulo2@gmail.com Gabriel Kulp Affiliation: Intelligence Security Laboratories Email: gabriel@intseclab.org Abstract AI compute verification is one of the first tangible and tractable points for international policy aimed at AI governance. Determining whether frontier labs, or any operator, comply with established agreements requires the regulating authority, at the very least, to discern how their compute is used. The elementary building block of AI compute is the GPU, and any activity it executes leaves a physical trace. Here, we show that an external observer can identify the class of the workload running on an NVIDIA H200 from its power draw. Unlike on-chip NVML telemetry, which can be spoofed or replayed, such a physical channel can in principle be observed independently of operator cooperation. We recorded 930930 five-second traces at 10 MHz10\,MHz, covering seventeen open LLM families and twenty-five non-AI workloads. Over this corpus we separate training from inference and from non-AI computation with an accuracy of 97%97\% and a macro-averaged F1 score of 0.9550.955, evaluated on model families unseen during training. AI workload spectral content predominantly lies below ∼20 kHz $20\,kHz$ and training appears to be particularly recognizable through the memory-bound optimizer update. The GPU operator is then treated as adversarial and able to reshape the physical computation itself. Four evasion strategies are tested with the aim of disguising training as inference, producing an additional 680 adversarial traces. A detector hardened against evasion strategies, with the tested strategy held out, catches training ≥99%≥ 99\% of the time for three of the four strategies. The fourth, diluted low-rank adaptation (LoRA), is detected 4848–88%88\% of the time with a hardened classifier, rising to ≥98%≥ 98\% with an additional rescue rule. While these attacks are not intended to provide a comprehensive evaluation against adversarial behaviour, they offer initial insights beyond genuine activities and a dataset for developing and testing stronger evasion mechanisms. 1 Introduction Proposals to regulate large-scale training of AI models rely on a verifier’s ability to establish the activity of a cluster, without trusting the operator’s self-report Shavit (2023); Scher and Thiergart (2024); Baker et al. (2025); Reuel et al. (2025). Identifying what a GPU is running is therefore a measurement problem of increasing importance for international policy. GPU activity affects several physical parameters that depend on the workload being executed. Recently, on-chip telemetry read through the NVIDIA Management Library at 1 Hz1\,Hz has been shown to reliably separate training from other workloads when the operator is non-adversarial Rahman and Tajdari (2026). The picture becomes more complex, however, when the operator actively manipulates the physical signature, for example by disguising training as model inference. The resulting classifier has been exposed to several rounds of red-teaming across 20 evasion strategies, including white-box diluted LoRA, which reduces the detection rate to 42.6%42.6\%. Compared with full fine-tuning, diluted LoRA interleaves small learning updates with genuine model inference, hiding the detectable signature within a window that mostly resembles inference, at the cost of reduced training throughput. Beyond the detection rate itself, the main vulnerability of on-chip telemetry counters is that they are read by software under the operator’s control. In fact, they could be reported without being measured, or replayed from an authorized workload while a hidden one is running. If the operator is capable of this manipulation and willing to accept some performance penalty, no amount of classifier hardening can detect it. Research efforts should therefore focus on tamper-resistant read paths and attested telemetry channels, as suggested by work on hardware-enabled mechanisms Kulp et al. (2024); Aarne et al. (2024); O’Gara et al. (2025); Petrie et al. (2025). On-chip (NVML) telemetry reports several workload-dependent signals, e.g. power, temperature, clock speed, and PCIe throughput, with updates at tens of hertz. An external probe, owned by the auditor, can read similar underlying signals, such as current draw, at much higher sampling rates in the MHzMHz range, trading the multidimensionality of slow telemetry counters for a single channel with much higher temporal resolution. Because it bypasses the operator’s control, this channel can in principle be read without trusting self-reported values and can serve as an additional defence layer or feed a sensor-fusion analysis. Deploying such a probe would require regulation of its own, together with tamper-resistant mechanisms that guarantee the fidelity of its readout. Against such a channel, however, evasion requires restructuring the computation itself, as also examined for NVML counters. Physical side channels have been widely reported in the literature, mostly in the form of attacks. For example, they have been used to obtain sensitive information about the execution of machine-learning models: to recover neural-network architectures and weights Maia et al. (2022); Xiao et al. (2026); Horváth et al. (2026), and to reconstruct user text from mixture-of-experts (MoE) routing Ding et al. (2025); Nuriyev and Kulp (2026). The same physics has also been considered for defensive monitoring DARPA-LADS (2015), for example to detect anomalous program execution on embedded devices through electromagnetic emissions Sehatbakhsh et al. (2019), or to flag cryptojacking through magnetic leakage signals Xiao et al. (2023). Beyond Rahman and Tajdari (2026), NVML has also been used to profile workload power for whole-facility infrastructure and energy planning Vercellino et al. (2026). In this work, we consider a verifier-owned current probe on the auxiliary power supply of a single GPU, while the operator retains full control of the GPU. With this probe, we record 16101610 traces (930930 genuine and 680680 adversarial) across seventeen open model families and twenty-five non-AI workloads. 2 Measurement and corpus Workload activity is recorded using a Rogowski current probe Shenzhen Micsig Technology (2026) clamped around all positive conductors of the PCIe auxiliary power supply of an NVIDIA H200 NVL hosted by Amodo Design (2026). The probe measures the aggregate current drawn by the GPU. It is AC-coupled, has no DC response, and has a specified bandwidth from 34 Hz34\,Hz to 30 MHz30\,MHz. Its output is digitized using a PicoScope at a nominal sampling rate of 10 MHz10\,MHz in 5 s5\,s acquisition windows, while each workload is executed continuously in a loop. An initial acquisition at 100 MHz100\,MHz showed that the relevant spectral content was predominantly confined below 1 MHz1\,MHz, motivating the lower sampling rate used for the main dataset. The genuine dataset contains 930930 traces covering seventeen model families, ranging from 44B to 2121B parameters and spanning both dense and mixture-of-experts architectures. Each LLM family is recorded under inference and three training configurations: full fine-tuning, low-rank adaptation (LoRA), and gradient accumulation. Each training configuration contributes 170170 recordings, corresponding to ten independent captures for each of the 17 families. Every trace is obtained from an independent run with a fresh model load, so that measurements are not conditioned by previous GPU execution state and scheduling history. For gradient accumulation, we choose the number of micro-batches for each family such that a complete accumulation cycle fits within the acquisition window regardless of its starting phase. Where necessary, we reduce the batch size to prevent the accumulated cycle from exceeding device memory as described in Table 7. Every training trace in the corpus contains at least one complete optimizer update in its acquisition window. We additionally include 25 non-AI workloads, one of which serves as an idle baseline. The adversarial corpus instead adds 680680 recordings, corresponding to four evasion strategies across the same 17 LLM families, with ten independent captures per model and strategy. Appendix A provides the full list of workloads and configurations. We release all recordings as a dataset Gargiulo (2026). 3 Results As shown similarly in the telemetry study, a two-stage random forest was found to be among the best approaches for distinguishing different workloads. The detector uses 3030 features, predominantly in the frequency domain, that do not depend on the absolute signal amplitude and are listed in Table 4. The classifier first asks whether the workload is an ML-related activity, and then whether it is training. We report accuracy and the macro-averaged F1, where the latter gives equal weight to the three classes regardless of class size. Performance is evaluated using five-fold grouped cross-validation, with folds grouped by model family and shuffled, and averaged over four independent splits and two seeds to capture variation in both fold composition and training seed. Detector performance is only weakly affected by the acquisition rate, even after a 256-fold decimation of the recorded traces, as shown in Table 3. This is consistent with most of the relevant content being concentrated at low frequencies. We then consider the threat model where the operator can manipulate workload execution through four evasion strategies that reshape the usual training pattern to avoid detection: (i) chunking the optimizer update, (i) diluting real steps with decoy inference, (i) throttling, and (iv) diluting LoRA. We assume that the verifier can observe only the signal leaking from the power supply. Each strategy is run on all seventeen families and carries a performance penalty. We quantify this penalty as the reduction in training throughput, measured in real training tokens per second, relative to an honest full fine-tune of the same model. Across the four strategies in Table 2, the penalty ranges from 28.1%28.1\% to 69.3%69.3\%. Figure 1 shows genuine training and inference recordings for Qwen3-14B, and how each evasion strategy reshapes both the temporal and spectral dynamics of the computation. A training step is divided into three phases: the forward pass, the backward pass, and the optimizer update. The latter two are absent during inference. The optimizer update is the phase that makes training stand out most clearly. It is limited by how fast data can be transferred in and out of memory and appears quieter than the surrounding steps, resulting in a distinct spectral signature. Figure 1: Temporal and spectral content of the recorded traces for Qwen3-14B over an identical 2 s2\,s window. From left to right: genuine training, the four evasion strategies ordered by descending detection rate, and inference. In the diluted LoRA panel, the optimizer update occupies only a short time window before the model returns to the inference pass. We distinguish three settings for the classifier. The genuine detector is trained on honest recordings alone and has never seen an evasion strategy, providing a baseline for how often honest training is recognized. The hardened unseen-strategy detector adds three evasion strategies to its training set and is tested on the fourth (leave-one-strategy-out). In both settings, all model families are visible. The hardened unseen-model detector has instead seen every strategy but is evaluated on model families held out of its training. Table 1: Training detection rate of the two-stage forest, in percent. Genuine is trained on the 930930 honest recordings alone. Unseen strategy adds the 510510 recordings from the other three strategies in a leave-one-strategy-out setting. Both detectors see every model family. Unseen model reverses the split, being trained on honest recordings and all four strategies from the training-side families, and scored on families held out from training. A trace is always evaluated by a detector that was not trained on it. The first two columns hold out only the ten recordings of the corresponding label, while the family remains visible; the third holds out the entire family. Ranges are 95%95\% bootstrap intervals over the seventeen model families, averaged over four training seeds. hardened Strategy genuine unseen strategy unseen model honest training (baseline) 9494–100%100\% %100\% 100%100\% chunked optimizer 100%100\% %100\% 100%100\% throttling 7474–92%92\% %100\% 100%100\% dilution 8080–100%100\% 99–%100\% 100%100\% diluted LoRA 3030–74%74\% 48–%88\% 8686–100%100\% with rescue rule 9090–100%100\% 98–%100\% 100%100\% Hardening improves detection across all strategies, from 8080–100%100\% to ≥99%≥ 99\% for dilution and from 3030–74%74\% to 4848–88%88\% for diluted LoRA. The unseen-model column suggests that the main challenge is the novelty of the evasion strategy rather than variation across model families. Entries are means over four training seeds. To improve the detection of diluted LoRA, we introduce a rescue rule targeting the signature left by the optimizer update, which produces a brief, deep spectral dip with characteristic low-frequency content. Traces labelled as inference by the second random-forest stage are relabelled as training when such a frequency-gated dip is detected. The threshold is calibrated on genuine recordings to avoid mislabelling genuine inference traces. Appendix A.1 provides the calibration details and an out-of-fold evaluation of the resulting false-alarm rate. This raises diluted LoRA detection to 9090–100%100\% with the genuine detector and 9898–100%100\% with the hardened detector. 4 Discussion The on-chip study Rahman and Tajdari (2026) reported, under leave-one-strategy-out evaluation, a mean accuracy of 92.2%92.2\% across twenty strategy families, including classifier-assisted white-box attacks, and 42.6%42.6\% on its hardest case, white-box LoRA with dilution. Our corresponding strategy is diluted LoRA, for which the hardened detector reaches 4848–88%88\% across seventeen model families and ≥98%≥ 98\% with the rescue rule. This uses a 5 s5\,s recording, compared with a 15 s15\,s–60 s60\,s window, under the same leave-one-strategy-out protocol. The higher bandwidth of the Rogowski probe enables detection over much shorter windows and appears to make these evasions substantially more difficult. While telemetry provides privacy-preserving, zero-overhead signals, it cannot be trusted alone against an adversary who controls both the hardware and software stack, since the reported telemetry could be forged or replayed. An auditor-owned external probe can provide an additional layer of security, but requires physical access to the monitored hardware and likely continuous on-site monitoring by the regulatory authority. This additional infrastructural overhead comes with an important advantage: unlike telemetry, evading this physical side channel requires a substantial modification of the workload execution. Several limitations of this study motivate future work. First, the corpus was collected on a single NVIDIA H200 NVL, and generalization across devices and hardware architectures remains to be established. The on-chip NVML results are nevertheless encouraging, suggesting that the underlying workload signatures may be sufficiently robust to support high-accuracy detection across different hardware. Second, the adversarial corpus should be extended to include more fine-grained manipulations of the physical execution pattern. We explored only a limited set of evasion strategies, among which diluted LoRA was the most difficult to detect. LoRA updates only a small fraction of the model parameters compared with full fine-tuning, leaving a shorter temporal footprint of the optimizer update and therefore making detection more difficult. This evasion comes at the cost of reduced optimization flexibility, since the set of parameters that can be updated is constrained. An important direction for future work is therefore to identify evasion strategies that retain the optimization flexibility of full fine-tuning while still reducing detectability. Acknowledgements The measurements reported here were collected on an NVIDIA H200 NVL provided by Amodo Design (2026). The authors would like to thank Carl Heimann of Amodo Design and acknowledge support from Pivotal Research. References Aarne et al. (2024) O. Aarne, T. Fist, and C. Withers Secure, governable chips: using on-chip mechanisms to manage national security risks from AI and advanced computing. Report Center for a New American Security. External Links: Link Cited by: §1. Amodo Design (2026) Amodo Design Side Channel Cloud: Instrumented GPU Infrastructure for AI Security Research. Note: https://sidechannel.cloud Cited by: §2, Acknowledgements. Baker et al. (2025) M. Baker, G. Kulp, O. Marks, M. Brundage, and L. Heim Verifying international agreements on AI: six layers of verification for rules on large-scale AI development and deployment. Working Paper Technical Report WR-A4077-1, RAND Corporation, Santa Monica, CA. External Links: Document, 2507.15916, Link Cited by: §1. DARPA-LADS (2015) DARPA-LADS Leveraging the analog domain for security (LADS). Note: https://w.darpa.mil/research/programs/leveraging-the-analog-domain-for-securityAccessed: 2026-08-24 Cited by: §1. Ding et al. (2025) R. Ding, T. Xu, X. Shen, A. A. Ding, and Y. Fei MoEcho: exploiting side-channel attacks to compromise user privacy in mixture-of-experts LLMs. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communications Security (CCS ’25), Taipei, Taiwan, p. 2159–2173. External Links: Document Cited by: §1. Gargiulo (2026) S. Gargiulo NVIDIA H200 power side-channel traces of GPU training, inference and non-AI workloads. Note: Hugging Face dataset, https://huggingface.co/datasets/simgar/h200-power-workload-traces-10MHz_5s930 genuine and 680 adversarial five-second recordings over seventeen open model families and twenty-five non-AI workloads. Nominal acquisition rate is 10 MHz10\,MHz. Cited by: §2. Horváth et al. (2026) P. Horváth, I. Shumailov, L. Chmielewski, L. Batina, and Y. Yarom Kraken: higher-order EM side-channel attacks on DNNs in near and far field. In IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), External Links: 2603.02891, Link Cited by: §1. Kulp et al. (2024) G. Kulp, D. Gonzales, E. Smith, L. Heim, P. Puri, M. J. D. Vermeer, and Z. Winkelman Hardware-enabled governance mechanisms: developing technical solutions to exempt items otherwise classified under export control classification numbers 3A090 and 4A090. Working Paper Technical Report WR-A3056-1, RAND Corporation, Santa Monica, CA. External Links: Link Cited by: §1. Maia et al. (2022) H. T. Maia, C. Xiao, D. Li, E. Grinspun, and C. Zheng Can one hear the shape of a neural network?: snooping the GPU via magnetic side channel. In 31st USENIX Security Symposium (USENIX Security 22), Boston, MA, USA. External Links: 2109.07395, Link Cited by: §1. Nuriyev and Kulp (2026) A. Nuriyev and G. Kulp Expert selections in MoE models reveal (almost) as much as text. In ICLR 2026 Workshop on Principled Design for Trustworthy AI, External Links: 2602.04105, Document, Link Cited by: §1. O’Gara et al. (2025) A. O’Gara, G. Kulp, W. Hodgkins, J. Petrie, V. Immler, A. Aysu, K. Basu, S. Bhasin, S. Picek, and A. Srivastava Hardware-enabled mechanisms for verifying responsible AI development. In ICML 2025 Workshop on Technical AI Governance (TAIG), Vancouver, Canada, p. 1–7. Note: Spotlight talk External Links: 2505.03742, Document, Link Cited by: §1. Petrie et al. (2025) J. Petrie, O. Aarne, N. Ammann, and D. Dalrymple Flexible hardware-enabled guarantees for AI compute. Report Commissioned by ARIA. Note: Part I of a three-part exploration of flexHEGs External Links: 2506.15093, Document, Link Cited by: §1. Rahman and Tajdari (2026) R. Rahman and S. Tajdari Detecting hidden ML training with zero-overhead telemetry. In Proceedings of the Second Workshop on Technical AI Governance Research (TAIGR) at the 43rd International Conference on Machine Learning, Seoul, South Korea. External Links: 2606.19262, Link Cited by: §1, §1, §4. Reuel et al. (2025) A. Reuel, B. Bucknall, S. Casper, T. Fist, L. Soder, O. Aarne, L. Hammond, L. Ibrahim, A. Chan, P. Wills, M. Anderljung, B. Garfinkel, L. Heim, A. Trask, G. Mukobi, R. Schaeffer, M. Baker, S. Hooker, I. Solaiman, A. S. Luccioni, N. Rajkumar, N. Moës, J. Ladish, D. Bau, P. Bricman, N. Guha, J. Newman, Y. Bengio, T. South, A. Pentland, S. Koyejo, M. J. Kochenderfer, and R. Trager Open problems in technical AI governance. arXiv preprint arXiv:2407.14981. Note: v1 July 2024; v2 April 2025. Authors ask to be cited as “Reuel, Bucknall, et al. (2025)” External Links: 2407.14981, Document Cited by: §1. Scher and Thiergart (2024) A. Scher and L. Thiergart Mechanisms to verify international agreements about AI development. Technical report Machine Intelligence Research Institute, Technical Governance Team. External Links: 2506.15867, Link Cited by: §1. Sehatbakhsh et al. (2019) N. Sehatbakhsh, A. Nazari, H. Khan, A. Zajić, and M. Prvulovic EMMA: hardware/software attestation framework for embedded systems using electromagnetic signals. In Proceedings of the 52nd Annual IEEE/ACM International Symposium on Microarchitecture (MICRO-52), New York, NY, USA, p. 983–995. Cited by: §1. Shavit (2023) Y. Shavit What does it take to catch a Chinchilla? Verifying rules on large-scale neural network training via compute monitoring. arXiv preprint arXiv:2303.11341. External Links: Document, Link Cited by: §1. Shenzhen Micsig Technology (2026) Shenzhen Micsig Technology Rogowski AC current probe, RCP-XS series. Note: Product page, https://en.micsig.com/product_detail/Flexible-Current-Probe--Rogowski-Coil-RCP-XS.htmlAccessed August 2026. The RCP120 variant used here reports 50 mV/A. Cited by: §2. Vercellino et al. (2026) R. Vercellino, J. Willard, G. Campos, W. da Silva Pereira, O. Hull, M. Selensky, and J. Mueller Measurement of generative AI workload power profiles for whole-facility data center infrastructure planning. arXiv preprint arXiv:2604.07345. External Links: 2604.07345, Link Cited by: §1. Xiao et al. (2026) R. Xiao, S. Feng, S. Ramesh, J. Han, and J. Han Peering inside the black-box: long-range and scalable model architecture snooping via GPU electromagnetic side-channel. In Proceedings of the 2026 Network and Distributed System Security Symposium (NDSS), Note: Distinguished Paper Award External Links: Link Cited by: §1. Xiao et al. (2023) R. Xiao, T. Li, S. Ramesh, J. Han, and J. Han MagTracer: detecting GPU cryptojacking attacks via magnetic leakage signals. In Proceedings of the 29th Annual International Conference on Mobile Computing and Networking (MobiCom ’23), p. 1–15. External Links: Document Cited by: §1. Appendix A Appendix Table 2: Throughput penalty. For each strategy, we report the reduction in real training throughput relative to an honest full fine-tune of the same model, defined as penalty=100(1−strategy tokens/shonest-full tokens/s)penalty=100 (1- strategy tokens/shonest-full tokens/s ). A positive value indicates slower training: for example, +69.3%+69.3\% means that the strategy achieves 30.7%30.7\% of the honest training token rate. LoRA alone is much faster than full fine-tuning and the penalty observed arises from the decoy inference interleaved with the training updates. throughput lost (%) Model Chunk. Dilute Thrott. LoRA Qwen3 4B +55.8+55.8 +56.2+56.2 +39.1+39.1 +69.3+69.3 Llama 3.1 8B +54.7+54.7 +54.9+54.9 +39.5+39.5 +64.7+64.7 Qwen3 14B +34.1+34.1 +54.9+54.9 +39.4+39.4 +61.9+61.9 GPT-OSS 20B +28.1+28.1 +48.1+48.1 +41.7+41.7 +33.8+33.8 Figure 2: Normalized spectral power per frequency band for training and inference phases, expressed as a percentage of the total power within each phase. The probe is AC-coupled from 34 Hz34\,Hz to 30 MHz30\,MHz, with a nominal sampling rate of 10 MHz10\,MHz. The figure is calculated over the genuine corpus: 340340 measurements for each training phase and 170170 for inference, for a total of 11901190. The three training columns include full fine-tuning and low-rank adaptation across all seventeen model families; gradient accumulation is excluded. Bars show the median spectral share across recordings, with fractions normalized within each recording so that each column sums to 100%100\%; vertical marks span one standard deviation. The three frequency decades above 20 kHz20\,kHz are merged for convenience. Together, they account for 0.41%0.41\%, 0.45%0.45\%, 1.47%1.47\%, and 0.39%0.39\% of the total power in the four phases, respectively. Almost all spectral power lies below 20 kHz20\,kHz, while the phases separate most clearly below 200 Hz200\,Hz. Table 3: Accuracy and macro-F1 as a function of sampling frequency, evaluated on the 930930 captures of the genuine corpus. Five-fold cross-validation grouped by model family and shuffled, with class-balanced two-stage forests, averaged over four splits and two seeds. Performance is evaluated over the three classes (training, inference, non-ML) on individual 5 s5\,s traces. The majority-class baseline accuracy is 0.5480.548. At each rate the bands above the corresponding Nyquist frequency are dropped, so the feature count falls from 3030 at the top rate to 2424 at the lowest. Rate (MS/s) Accuracy Macro-F1 9.766 0.9660.966 0.9550.955 4.883 0.9700.970 0.9610.961 2.441 0.9660.966 0.9550.955 1.221 0.9580.958 0.9440.944 0.610 0.9680.968 0.9590.959 0.305 0.9610.961 0.9490.949 0.153 0.9490.949 0.9300.930 0.076 0.9210.921 0.9010.901 0.038 0.9460.946 0.9280.928 Table 4: Features. The two-stage random forest uses 3030 features, separated into the frequency and time domains. Features do not depend on absolute signal amplitudes. The envelope is the root-mean-square current over 2 ms2\,ms frames. A frame is defined as quiet when the envelope falls below 20%20\% of its floor-to-ceiling range (11st–9999th percentiles), and active otherwise. Feature Domain Count What it measures band00–band13 frequency 14 normalized spectral power in each log-spaced band, 20 Hz20\,Hz to 8 MHz8\,MHz sp_centroid frequency 1 spectral centroid on the log-frequency axis sp_spread frequency 1 spectral spread about the centroid sp_skew frequency 1 spectral skewness sp_entropy frequency 1 spectral entropy of the power distribution sp_roll85, sp_roll95 frequency 2 frequencies containing 85%85\% and 95%95\% of total power frac_below_2k frequency 1 fraction of total power below 2 kHz2\,kHz frac_above_200k frequency 1 fraction of total power above 200 kHz200\,kHz env_cv time 1 coefficient of variation of the envelope env_crest time 1 envelope crest factor, peak-to-RMS ratio env_rep_hz time 1 repetition frequency estimated from envelope autocorrelation env_rep_strength time 1 autocorrelation strength at the repetition period env_acf_decay time 1 decay of the envelope autocorrelation env_idle_frac time 1 quiet fraction of the window env_duty time 1 ratio of median active-run duration to median cycle duration env_trans_hz time 1 rate of active-to-quiet transitions total 30 2222 frequency-domain, 88 time-domain Table 5: Dataset composition and open LLM models. The genuine corpus contains 9393 labels and 930930 recordings, with 1010 recordings per label. Each model family is recorded under inference and three training configurations: full fine-tuning, low-rank adaptation, and gradient accumulation. The three training configurations therefore contribute 170170 recordings each. Gradient-accumulation settings are reported in Table 7. For the remaining workloads, batch size is set to the largest value that fits each family: 88 for thirteen families, 44 for gemma9b, nemo12b, and ossmoe20b, and 22 for starcoder15b. Sequence length is 512512 throughout. Family Identifier Size Arch. Inference Full FT LoRA Accum. qwen4b Qwen/Qwen3-4B 4B dense ∙ ∙ ∙ ∙ mistral7b mistralai/Mistral-7B-v0.3 7B dense ∙ ∙ ∙ ∙ qwen8b Qwen/Qwen3-8B 8B dense ∙ ∙ ∙ ∙ apertus8b swiss-ai/Apertus-8B-2509 8B dense ∙ ∙ ∙ ∙ granite8b ibm-granite/granite-3.3-8b-base 8B dense ∙ ∙ ∙ ∙ llama8b meta-llama/Llama-3.1-8B 8B dense ∙ ∙ ∙ ∙ yi9b 01-ai/Yi-1.5-9B 9B dense ∙ ∙ ∙ ∙ gemma9b google/gemma-2-9b 9B dense ∙ ∙ ∙ ∙ falcon10b tiiuae/Falcon3-10B-Base 10B dense ∙ ∙ ∙ ∙ nemo12b mistralai/Mistral-Nemo-Base-2407 12B dense ∙ ∙ ∙ ∙ stablelm12b stabilityai/stablelm-2-12b 12B dense ∙ ∙ ∙ ∙ olmo13b allenai/OLMo-2-1124-13B 13B dense ∙ ∙ ∙ ∙ qwen14b Qwen/Qwen3-14B 14B dense ∙ ∙ ∙ ∙ phi4 microsoft/phi-4 14B dense ∙ ∙ ∙ ∙ starcoder15b bigcode/starcoder2-15b 15B dense ∙ ∙ ∙ ∙ dsv2lite deepseek-ai/DeepSeek-V2-Lite 16B MoE ∙ ∙ ∙ ∙ ossmoe20b openai/gpt-oss-20b 21B MoE ∙ ∙ ∙ ∙ Non-ML (2525 labels): idle, matmul_fp16, matmul_bf16, matmul_tall, matmul_int8, cufft_c2c, cufft_r2c, conv2d, reduce_sum, sort, cumsum, transpose, elementwise, memcpy_d2d, gather_random, scatter_random, rng_normal, histogram, topk, softmax_large, layernorm_only, l2_thrash, atomics_contended, spmv_csr, pcie_h2d Table 6: Workload types. Workloads in the genuine corpus are separated into three classes: inference, training, and non-ML. In the adversarial corpus, training workloads are further distinguished by how each evasion strategy reshapes the training cycle. For example, chunked optimization splits the optimizer update into smaller portions interleaved with inference passes, while in diluted LoRA the optimizer update occupies only a small fraction of the acquisition window. Every workload runs continuously throughout the recording, so the active fraction is 1.01.0 for every class. Type Class Families Recordings inference genuine 17 170 full fine-tuning genuine 17 170 low-rank adaptation (LoRA) genuine 17 170 gradient accumulation genuine 17 170 non-ML kernels genuine 25 labels 250 chunked optimizer disguised 17 170 dilution disguised 17 170 diluted LoRA disguised 17 170 throttling disguised 17 170 Table 7: Gradient accumulation settings for the three families that depart from four micro-batches per optimizer step. In gradient accumulation, several micro-batches are processed before a single optimizer update. The number of micro-batches is chosen so that one complete accumulation cycle fits within the 5 s5\,s recording window: ossmoe20b fits three, while olmo13b and qwen14b fit two. Batch size is reduced independently where the accumulated cycle would otherwise exceed device memory. Step time is the wall-clock duration of one complete accumulation cycle, including the optimizer update. The remaining fourteen families use four micro-batches per optimizer step at their serving batch size. Family Size Architecture Step (s) Micro-batches Batch ossmoe20b 21B MoE (4/324/32 active) 1.061.06 33 22 olmo13b 13B dense 1.241.24 22 44 qwen14b 14B dense 1.241.24 22 88 A.1 Diluted LoRA rescue rule Diluted LoRA hides a genuine optimizer update within a long stream of decoy inference, so the update occupies only about 1%1\% of the acquisition window. The two-stage random forest averages its features over the entire recording and therefore averages out this short-lived footprint. The training signature, however, remains physically distinct wherever the optimizer update occurs: it is quieter than the surrounding computation and its energy is concentrated at low frequencies. The rescue rule targets this single event directly. We compute the envelope e as the root-mean-square current over 0.5 ms0.5\,ms frames and define the dip depth as deep_dip=1−minte¯20(t)median(e), deep\_dip=1- _t e_20(t)median(e), (1) where e¯20(t) e_20(t) is the 20 ms20\,ms rolling mean of e. Over a 5 s5\,s recording, both e and e¯20(t) e_20(t) form time series of approximately 1×1041×10^4 values. Forward and backward passes are relatively flat, giving deep_dip∼0 deep\_dip 0, while a memory-bound optimizer update generally produces a larger value. In this way, a single update event can remain observable even when surrounded by inference. Depth alone may also be triggered by an idle or throttled GPU. Therefore, deep_dip is gated using the spectral content of the dip. The quantity lowfreq is computed over the 20 ms20\,ms window centered at its deepest point and represents the normalized fraction of spectral power below 10 kHz10\,kHz. The condition lowfreq>0.5 lowfreq>0.5 separates optimizer-update dips from idle or quiescent phases. The memory-bound optimizer update is concentrated at low frequencies, while the idle interval is dominated by the remaining higher-frequency noise components and a tone at 500 kHz500\,kHz. Finer spectral gating could be defined using the information in Fig. 2. When the second stage has labelled a recording as inference, the rescue rule relabels it as training if deep_dip>τandlowfreq>0.5. deep\_dip>τ lowfreq>0.5. (2) The threshold τ is calibrated using genuine recordings alone. Candidate values are taken from the deep_dip scores of genuine training traces and tested on genuine inference and non-AI recordings. The threshold is set to the smallest value that does not increase the detector’s false-alarm rate on these genuine recordings. In other words, τ is the smallest threshold for which the rescue rule relabels none of the genuine recordings that the base detector already classifies as inference, so by construction it cannot introduce additional false alarms on the genuine corpus. The threshold is computed separately for each classifier setting: 0.400.40, 0.320.32, and 0.470.47 for the genuine, unseen-strategy, and unseen-model detectors, respectively. These values decrease to 0.380.38, 0.310.31 and 0.430.43, respectively, when calibrated out-of-fold. Diluted LoRA traces typically reach deep_dip values with a median of approximately 0.680.68. Applied only to the diluted LoRA arm, the rule raises detection, as reported in Table 1, with no additional false-alarm cost in-sample. This holds true by construction, since τ is calibrated on the same honest recordings on which the false alarm is then measured. To test whether the rule generalises, we recompute τ out-of-fold: it is calibrated on part of the genuine recordings, while the false alarm rate is evaluated on a held-out remainder. The split is performed by label for the genuine and unseen-strategy detectors, and by family for the unseen-model detector. Out-of-fold, the rescue rule adds +0.6+0.6, +2.5+2.5 and +1.4+1.4 percentage points to the false-alarm rate for the genuine, unseen-strategy and unseen-model detectors, respectively.