cs.CROct 19, 2026
SaveDetecting AI Training in Datacentre Power
Organizations: School of Mathematics and Statistics, The University of Melbourne, Parkville, VIC 3010, Australia · Machine Alignment, Transparency & Security (MATS) · Department of Engineering Science, University of Oxford, Oxford, UK
Abstract
AI governance agreements require methods to detect large model training runs on a monitored computing cluster, without trusting the operator. We develop a method to detect synchronous model training in facility-level power by Viterbi tracking of the wandering iteration cadence. On simulated datacentre power, when the operator makes no attempt to hide, the Viterbi tracker detects at least of training runs against a declared inference workload, at a false-alarm rate and within of the Neyman--Pearson optimum, given a meter that samples at Hz or faster. Of eight adversarial strategies an operator might use to hide, only extreme variation of the work per iteration evades the tracker. Its strongest form hides training in up to of five-minute observations, but over a day at least of such runs are still caught, at a false-alarm rate per run. This adversarial strategy costs no throughput, but in small-scale training the operator needs -- more compute to reach the same loss. A modest passive meter is sufficient to make hidden training both detectable and expensive, which makes power metering a promising part of compute verification that does not depend on trusting the operator.
Figures & tables
Figure 1: The four workload classes at the power meter, on the nominal channel (20 Hz sampling, no filtering or decimation, W). Top: a 20 s excerpt. Bottom: the multitaper spectrum over the – Hz search band, with the true cadence marked. Training, fine-tuning, and the aggregate carry a line at ; the inference null does not. Cadences are pinned for legibility ( Hz training, Hz fine-tuning); elsewhere they are drawn from the Ko bands.
| Symbol | Train | Fine-tune | |
|---|---|---|---|
| Cadence band [Hz] | |||
| Period jitter | |||
| Phase ratio | |||
| Offset spread | |||
| Down-phase offset | |||
| Up noise range |
Table 1: Workload-model parameters of Section 2 . Training and fine-tuning values are Ko and Zhu’s ( Ko & Zhu, 2025 ) , except , the drift parameters, and for fine-tuning (Ko and Zhu list it for training only; we reuse it). The inference null is ours. Ko and Zhu’s intra-phase noise is a sub-millisecond fluctuation, and each sample of our tens-of-hertz generator averages over many of them, so we scale its standard deviation by ; the ranges are Ko and Zhu’s values before scaling. Amplitudes are fractions of the peak power . The drift excursion is swept in Section 5 . The scale values are ours, and are those of a single accelerator board; only the workload’s size relative to the meter’s additive terms affects detection ( Section 3.1 ).
Figure 2: How the power drawn by the workloads reaches the verifier. The workloads of Section 2 and a static overhead sum to the facility power , Equation 9 . This passes through the delivery path and the meter, and then additive terms are added, Equation 10 . The panels below show one training cadence at the four marked points as it is smoothed, sampled, and made noisy; they are illustrative. The shaded regions show which stages the operator and the verifier control ( Section 3.2 ). Badges mark where the adversarial strategies of Table 3 act: schedule attacks and dilution (S) on the workload, and the meter strategy (M) on the channel. lumps instrument noise with interference that physically originates behind the meter, such as the power-controller line. In the nominal channel the delivery path passes the power through unchanged ( ) and the meter samples at Hz with no integration ( Table 2 ).
| Stage | Parameter | Nominal | Swept | Stands for |
| Delivery path ( ; the identity in the workload model) | ||||
| Butterworth low-pass (order 2) | cutoff [Hz] | off | – | PSU/PDU bandwidth, smoothing |
| In-band notch | depth; centre [Hz]; | off | – ; – ; | delivery-path anti-resonance |
| Instrument ( and sampling; chosen by the verifier) | ||||
| Trailing boxcar integration | window [s] | – | meter averaging | |
| Gain | — | calibration factor | ||
Table 2: Stages of the observation map ( Equation 10 ). Nominal values define the channel used everywhere unless stated. The swept ranges are those of Figure 3 and the minimum-meter sweep of Section 5.2 ; the hostile channels of the meter strategy ( Table 3 ) are drawn from the same ranges. Every stage off except is the nominal channel; every stage off including is the identity.
Figure 3: Sensitivity of the cadence signature to the observation map, on a fixed honest training workload ( Hz, median of 20 realisations; the interquartile range is narrower than the markers). Columns follow the stages of Figure 2 : the delivery path (a, d), the meter (b, e), and the additive terms (c, f). The measure is an effective signal-to-noise ratio: spectral power at the known over the in-band power the meter itself contributes, normalised to the nominal channel (dashed line). Attenuating axes lower the signal and additive ones raise the noise, so every panel reads the same way: down is worse for the verifier. Harsher channels lie to the right. Open circles mark sample rates at which reaches the Nyquist frequency, so the cadence is not observable at all. Note is pinned away from Hz, which would coincide with both the Hz Nyquist frequency and the first sinc null of a s boxcar.
| Strategy | What the operator changes | Budget knob (range) | Cost anchor |
| Timing | |||
| Period jitter | i.i.d. period jitter of Equation 1 , by inserting idle time | measured | |
| Cadence drift | OU excursion of Equation 3 | Hz | measured |
| Work variation | micro-steps per iteration , drawn about with fractional spread ; down-phase unchanged | measured | |
| Phase slip | Brownian slip of iteration boundaries at fixed mean period | slip std periods | — |
| Frequency | |||
Table 3: Adversarial strategies available to the concealing operator. Each is implemented inside the generator of Section 2 and swept singly over the stated budget range in Section 6 . “Measured” marks strategies with a throughput-overhead anchor from the single-A100 campaign; the others were not run on hardware and are reported without a cost ( Section 6 ). Appendix C defines each strategy’s generator change. The meter strategy degrades the channel rather than the schedule and is read as a channel requirement ( Section 5.2 ), not priced.
Figure 4: The Viterbi tracker on three s traces at the nominal channel. Each panel is the contrast map of Equation 13 on the tracker’s own grid ( s frames at half overlap, mHz bins over ), with the best path of Equation 14 in white and its score inset. Dashed: the true cadence, (median iteration period) in each frame, from the generator’s iteration boundaries. Left: a stationary training cadence ( Hz), which the path sits on. Centre: the same run with Hz of cadence wander, which the path follows across most of the band; it cuts the corner off the brief excursion near s, where following the line costs more in jumps than it gains in contrast. Right: the inference null. The tracker still returns a best path, as it does for any input, but here it only strings together noise fluctuations and scores , below the threshold at ( Section 4.2 ).
Figure 5: Detection rate at empirical false-alarm rate against the null aggregate, versus cadence drift of the dominant training run ( per class, s traces, shares ). The Viterbi tracker stays within of the Whittle Neyman–Pearson ceiling across the wander axis; the spectral matched filter collapses once the line moves and the multitaper F-test has no usable power. The ceiling is described in Appendix A .
Figure 6: Minimum meter specification: Viterbi detection rate at empirical false-alarm rate over sample rate integration window , the honest aggregate against the null aggregate ( per class). The live region is Hz and s.
Figure 7: How much each schedule strategy hides, and what it costs. Each panel steps one strategy of Table 3 through its budget knob (bottom axis; settings evenly spaced, weakest on the left) and plots hiding, detection rate at false-alarm rate , for the Viterbi tracker (blue, solid) and the fixed tests (grey, dashed; the better of the matched filter and multitaper F-test per cell). Bands are Wilson intervals for traces per class. a–d , the four strategies run on a single A100. The top axis gives the measured throughput cost of each setting ( Equation 18 ); costs below in magnitude, zero within noise, are shown as , and drift-free scheduling costs zero by definition. Shape-filling costs were measured on a jittered base and are upper bounds ( ; Appendix E ). e–h , the four strategies we did not run on hardware, which therefore have no measured cost. The tracker detects almost every cell. The exception, ringed in c , is work variation at , which hides from it at ; idle-insertion jitter hides at most , for . The meter strategy degrades the channel rather than the schedule and is treated in Section 5.2 .
Figure 8: Detection of runs under each of two work-variation strategies, (blue) and lognormal (orange). Each run is one continuous -hour trace of the aggregate, scored in s windows. a , fraction of each run’s windows detected at false-alarm rate , against the run’s cadence. The dotted line is the null’s rate. b , fraction of runs flagged against observation time, at a run-level false-alarm rate of . Lines are the anytime-valid test, which may stop at any time; open circles are the counting rule, a separate fixed-time test at each marked time. Across null runs the anytime-valid test raises false alarms in a day.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 9: Notch sweep: Viterbi detection rate at empirical false-alarm rate versus notch centre, one line per notch depth, at Hz sampling with no integration window, the honest aggregate against the null aggregate ( per class). A deep notch near the band centre roughly halves detection; none removes it.
| Control load | Training? | Linear | Logistic | Forest |
|---|---|---|---|---|
| Discarded-update decoy | no | 1.00 | 1.00 | 1.00 |
| Gradient-only | no | 0.97 | 1.00 | 1.00 |
| Non-ML kernel loop | no | 1.00 | 1.00 | 1.00 |
| Controller cycle | no | 1.00 | 1.00 | 1.00 |
| Periodic inference | no | 1.00 | 1.00 | 1.00 |
| Co-resident mixture | yes | 1.00 | 1.00 | 1.00 |
Table 4: Fraction of each control load scored as training at a false-positive rate of , for each decision rule. All five non-training loads score as training.
More in this topic
Adversarial Attacks
Adversarial attacks exploit crafted inputs, poisoned data, or system interactions to manipulate AI predictions, behavior, privacy, or reliability.
See all 451 papers