In research with AE Studio, Anthropic introduces GRAM, an experimental technique to give language models removable compartments of dual-use knowledge. Can you imagine being able to remove just the part that knows how to exploit a vulnerability without destroying everything else that makes the model useful? That's what they're proposing here, with important caveats: it's early, technical, and still far from production.
What GRAM is and why it matters
GRAM stands for Gradient-Routed Auxiliary Modules. The central idea is simple in intuition: instead of letting all knowledge be learned and diffuse across the model's weights, you create dedicated modules for categories of dual-use knowledge (for example virology, cybersecurity). Each module is a set of neurons added to every layer of the Transformer.
During training, the model learns from general text as usual. But when an example belongs to a dual-use category, only the corresponding module can be updated; the general parts of the model are temporarily frozen. This way, the specific knowledge accumulates in that module and doesn't spread through the whole network. Practical result? The module can be deleted at deployment and the dangerous capability goes away with it, or it can be left active for trusted users.
Key point: this allows, with a single training run, configuring multiple versions of the same model (for example 16 configurations if there are 4 modules: each on or off).
How it works technically
-
Architecture: auxiliary neurons are added to each layer of a standard
Transformer. These neurons are grouped into modules, one per dual category. -
Learning rule: for general data, all parts can participate; for data in a dual category, only the specific module receives gradients. The rest of the model is frozen.
-
Removability: after training, the module can be physically removed from the weights. The associated capability disappears because its knowledge was confined there.
-
Configurations: with N modules you get 2^N possible configurations without retraining separate models.
-
Practical detail: the authors note that sometimes, for example a virology module also activates during learning with general text to improve cooperation between modules and the global representation.
Experimental results
Tested in three scenarios of increasing realism:
-
Synthetic dataset (children's stories labeled by theme). A small GRAM could forget chosen topics and, for each configuration, performed almost identically to training separate models with that topic filtered.
-
Realistic mix of web, code and scientific articles with four dual domains: virology, cybersecurity, nuclear physics and a niche programming language. Each domain is routed to its module. Deleting a module removed the associated capability almost as effectively as if those data had never been in pretraining, and without degrading overall performance.
-
Scaling from 50 million to 5 billion parameters. GRAM matched the performance of data filtering at all sizes. Also, the gap between module-on and module-deleted grew with model size. Attacking to recover deleted knowledge becomes relatively more expensive as you scale.
They also compared resistance to attacks: training with a small amount of malicious data did not easily recover deleted knowledge when GRAM was used; in contrast, post-training unlearning techniques only suppressed the knowledge and it was easy to restore with a bit of fine-tuning.
Limitations and open questions
-
Not tested at frontier scale nor integrated into production pipelines. The authors emphasize that GRAM has not been used in production Claude models.
-
Evaluations measure next-token prediction ability, not real downstream tasks. That means evidence is missing on effectiveness in concrete practical applications.
-
There is a bigger conceptual problem: some dual capabilities might be so intertwined with general knowledge that you can't separate them cleanly. In those cases, neither data filtering nor GRAM would solve the issue.
-
It's not a silver bullet against sophisticated attacks: the work shows resistance similar to filtering under specific attack conditions, but maintaining that robustness in the real world is a challenge.
Practical implications for developers and regulators
-
GRAM proposes a path for finer-grained access control and potentially stronger guarantees than classifiers and rejection training alone. You could deploy a single architecture and enable modules only for verified labs or credentialed experts.
-
For companies: it reduces the need to train many costly models with different filters. For regulators: it offers a technical mechanism to audit and restrict specific capabilities, though with clear technical limits.
-
In practice, GRAM would complement other defenses (screening, access policies, auditing), not replace them.
Final reflection
GRAM is an elegant idea that pushes the frontier of control over what a model "knows." As technical research, it shows solid results in controlled scenarios and moderate scaling. But we're far from applying it on frontier models without more testing and rigorous audits. Can engineering separate the harmful from the useful without losing the model's utility? GRAM is a promising step, but the question remains open and demands collaboration between researchers, operators and regulators.
Original source
https://www.anthropic.com/research/off-switch-dual-use
Summary: GRAM (Gradient-Routed Auxiliary Modules) proposes removable compartments inside a Transformer to confine dual-use knowledge and allow deleting it without retraining separate models. Experiments show promise in resistance and scaling, though important limitations remain and it hasn't been tested at frontier scale.