Detecting Hidden ML Training With Zero-Overhead Telemetry
For AI governance, this work shows that hardware-based monitoring can be robust to adversarial evasion, addressing a critical vulnerability in compute governance proposals.
The paper evaluates the adversarial robustness of GPU workload classification using zero-overhead NVML telemetry, achieving 98.2% binary accuracy for training detection and 43-87% accuracy against adversarial evasion strategies across 9 GPU models.
Hardware-enabled monitoring of GPU workloads underpins many proposals for AI compute governance, but if developers can defeat monitoring mechanisms, such schemes are unworkable. We evaluate the adversarial robustness of GPU workload classification using only zero-overhead, privacy-preserving NVML telemetry: content-agnostic signals that observe physical effects of computation without accessing model weights, training data, or hyperparameters. Across 5 rounds of monitor-evader iteration, we evaluate 20 evasion strategy families on 9 GPU models spanning 4 architecture generations. We develop a classifier that achieves 98.2% binary accuracy at identifying training workloads across the whole corpus, and 43-87% accuracy against the most challenging unexpected workloads even when they are adversarially disguised.