An off switch for dual use knowledge in AI models

Frontier AI models know things that can cut both ways. Understanding how pathogens work helps vaccine researchers and also helps someone trying to build one. Same goes for cybersecurity knowledge, nuclear physics, and apparently even niche programming languages. Right now, the industry mostly handles this with refusal training and content classifiers bolted on after the fact — guardrails that stop a model from saying the bad thing, without actually removing the knowledge underneath. A patient enough attacker can often talk their way around them.

Anthropic, working with AE Studio, is testing a different approach called GRAM, short for Gradient-Routed Auxiliary Modules. The idea is to physically segregate risky knowledge inside the model itself. GRAM adds extra neurons to each layer of a transformer, grouped into dedicated modules, one per sensitive category. When the model reads normal text, it learns normally. But when it hits material from a flagged category — say, virology — only that module gets to update, while the rest of the network stays frozen. Over time, virology knowledge piles up in its own compartment instead of bleeding into the model's general weights, so it can later be surgically deleted or left in place depending on who's deploying the model.

That matters because the old method — filtering dangerous content out of training data entirely — only gives you one fixed model. Want a version for a vetted biosecurity lab that can discuss advanced virology, plus a locked-down public version that can't? That means training two full frontier models, which at today's costs is basically a non-starter. GRAM's pitch is you train once and get up to 16 configurable versions, in this case built around four dual-use domains: virology, cybersecurity, nuclear physics, and a specialized programming language used as a stand-in for dangerous code capabilities.

The results across three test setups, from toy children's-story datasets up to 5-billion-parameter models, are genuinely promising. Deleting a module removed the associated capability about as thoroughly as never training on that data in the first place, and general performance held steady. GRAM also resisted attempts to recover deleted knowledge through small-scale malicious fine-tuning almost as well as full data filtering did, while a simpler post-hoc unlearning technique folded easily under the same attack. Bigger models actually showed a wider gap between module-on and module-off performance, meaning the trick scales, and possibly scales better as models grow.

Anthropic is careful to flag that this is early-stage, lab-bench research. GRAM hasn't touched any production Claude model, evaluations were measured on next-token prediction rather than real-world tasks, and there's an unresolved question of whether some dangerous knowledge is simply too tangled up with ordinary understanding to ever cleanly separate out.