LLM Abuse Detection via GPU Power Telemetry

Research Paper · April 2026

LLM Abuse Detection via GPU Power Telemetry

Hardware Signal Classification of Adversarial Inference Sessions

Abstract

Key Findings

The Signal: Power Feature Distributions

Abusive sessions impose a distinct computational load during harmful content generation. Across all three models, power-related features show clear separation between benign (blue) and abusive (red) sessions — with abusive sessions shifted toward higher wattage and tighter variance, consistent with sustained compute demand.

Fig 1. KDE plots of power features (mean, max, std, per-token, AUC) across all models. Abusive sessions cluster at higher wattage with lower variance.

Looking at the raw temporal signal reinforces this finding. The waveform overlay below plots 80 sampled power traces per class across normalized session time for each model. The separation is visible at a glance — abusive sessions (red) run consistently hotter throughout the session, while benign sessions (blue) fluctuate at a lower baseline. This temporal persistence is what makes the signal robust to single-sample noise.

Fig 2. GPU power waveforms sampled across normalized session time for LLAMA, Phi, and QWEN. Abusive sessions (red) sustain elevated power levels throughout; benign sessions (blue) show lower, more variable baselines.

Classifier Performance

Four classifiers — Random Forest, XGBoost, LightGBM, and a Neural Network — were trained on the 11-feature telemetry representation. All four achieve near-perfect ROC curves under in-distribution conditions, with confusion matrices confirming zero false positives across the test set.

Fig 3. ROC curves for all four classifiers on in-distribution test data. All achieve AUC ≥ 0.999.

Fig 4. Confusion matrices across all classifiers. FPR = 0.000, FNR = 0.009 on held-out test data.

The radar chart below gives a direct side-by-side comparison of all four classifiers across five key metrics. The fact that all four models trace nearly identical polygons confirms that the signal quality — not model choice — is driving performance. Any reasonably expressive classifier can learn this boundary from telemetry features alone.

Fig 5. Radar chart comparing all four classifiers on F1, Precision, AUC, Recall, and Low FPR. Near-identical polygons indicate the signal itself is the dominant factor, not the choice of model.

To understand where the classifier draws the line, the decision boundary plot below maps the Random Forest's learned separation in a 2D slice of feature space — power per token vs. GPU utilization. The white contours mark where the model transitions from benign to abusive predictions, with the background color showing predicted abuse probability. The clustering of red points (abuse) in the upper-right and blue points (benign) in the lower-left confirms that even two features alone carry substantial discriminative power.

Fig 6. Random Forest decision boundary in the power-per-token × GPU utilization feature space. White contours show the classifier's abuse probability transitions; red = abusive sessions, blue = benign.

Fig 7. Neural network training loss (BCE) and validation ROC-AUC over 50 epochs. Best AUC = 0.9997, converging by epoch ~10.

What Drives the Signal

Power minimum (power_min_w), power range, and mean power are the dominant features across both tree-based models. This makes physical sense: abusive sessions sustain higher baseline power throughout inference, raising the floor and compressing variance relative to benign queries which show more idle-time variation.

Fig 8. Pearson correlation between each telemetry feature and the abuse label across all three models. Power features show the strongest and most consistent signal.

Fig 9. Feature importance scores for Random Forest (MDI) and LightGBM (Gain). Power floor and range metrics dominate both models.

The Limitation: Distribution Shift

Out-of-distribution evaluation on 16,000 WildJailbreak sessions reveals a critical failure mode. The benign power baseline in the wild dataset overlaps heavily with the abusive range seen during training — the classifier's learned boundary no longer separates the classes. This is an environment-sensitivity problem, not a model problem, and points toward recalibration or ensemble approaches as the path forward.

Fig 10. Training vs. WildJailbreak power distributions for Qwen2.5-7B. The benign baseline shifts into the abusive range, causing near-total classifier breakdown (FPR ≈ 0.999).

Implications