Detecting Anomalies in Machine Learning Infrastructure via Hardware Telemetry

TL;DR

Modern ML deployments suffer from limited operator visibility due to virtualization, hampering resource optimization. Reveal introduces a hardware-centric profiling framework that relies solely on host-accessible telemetry and an unsupervised anomaly-detection pipeline to identify system-level bottlenecks across CPU, GPU, memory, network, and storage. It defines a compact, portable diagnostic metric space, provides automatic root-cause attribution, and demonstrates practical gains in training performance (e.g., DeepSeek) while open-sourcing datasets and tooling. This approach offers scalable observability for heterogeneous ML infrastructures and generalizes across hardware generations without instrumenting applications.

Abstract

Modern machine learning (ML) has grown into a tightly coupled, full-stack ecosystem that combines hardware, software, network, and applications. Many users rely on cloud providers for elastic, isolated, and cost-efficient resources. Unfortunately, these platforms as a service use virtualization, which means operators have little insight into the users' workloads. This hinders resource optimizations by the operator, which is essential to ensure cost efficiency and minimize execution time. In this paper, we argue that workload knowledge is unnecessary for system-level optimization. We propose Reveal, which takes a hardware-centric approach, relying only on hardware signals - fully accessible by operators. Using low-level signals collected from the system, Reveal detects anomalies through an unsupervised learning pipeline. The pipeline is developed by analyzing over 30 popular ML models on various hardware platforms, ensuring adaptability to emerging workloads and unknown deployment patterns. Using Reveal, we successfully identified both network and system configuration issues, accelerating the DeepSeek model by 5.97%.

Figures (9)

• Figure 1: Host-level hardware anomaly analysis via Reveal.
• Figure 2: Anomalous windows detected by Reveal during DeepSeek fine-tuning on a dual-host GPU setup.
• Figure 3: Causes of anomalous windows during DeepSeek fine-tuning on a dual-host GPU setup.
• Figure 4: Effect of correlation threshold $|r|$ on pruning. Pruning at $|r|=0.5$ removes substantial redundancy while preserving most diagnostic information.
• Figure 5: CPU overhead of Reveal at different sampling frequencies, compared with perf stat at 100 ms.