Power monitoring is an important confidence-building measure for AI verification, as explored by RAND: Verifying International Agreements on AI.
It can likely be spoofed, but is still valuable because:
- Power monitoring can complement other verification systems. It is harder to spoof compute accounting if the actor must also keep the power signature unchanged.
- Low-level power monitoring could be more expensive to spoof. An actor constrained to preserve per-GPU power signatures has much less room to e.g. conceal training as inference.
As a basic model, each stage of the power delivery network (VRM → PSU → rack PDU → row PDU → building → grid) acts as an LC low-pass filter, progressively attenuating higher-frequency signals. The further up the hierarchy you measure, the less compute-level detail survives.
Power Delivery Diagram
Our diagram shows the power delivery stack for a data center, from the compute level to the grid interconnect. The data available and measurement techniques at each level are discussed. In addition, signals of interest for AI security monitoring are outlined.
What’s Next
In follow-up work we intend to quantify the attenuation of the power signal across different frequencies at each stage of the delivery system. This will allow us to identify optimal locations for AI data center power monitoring for classification of training or inference.
Interested in data center power monitoring and how it can be used for securing AI data centers? Reach out.