Anthropic tests GRAM to switch off AI knowledge

Anthropic and AE Studio have tested a technique to turn dual-use knowledge on or off inside an AI model, including knowledge related to virology and cybersecurity, without having to train a different model for each case.

The research is still preliminary: GRAM has not been applied to any Anthropic production model, and the company does not know whether it ever will be. But it offers a different way to control dangerous capabilities: not just asking the model to refuse to answer, but physically removing the part of its parameters that contains specific knowledge.

The problem with dual-use capabilities

An advanced AI model stores vast amounts of information. Some of it can serve both beneficial and harmful purposes.

Cybersecurity knowledge, for example, helps fix vulnerabilities but can also be used to exploit them. Information about virology can support vaccine development, though it could also help someone design a dangerous pathogen.

Today, systems are usually protected by two main layers:

• Training the model to reject harmful requests.
• Classifiers that review questions and answers for dangerous content.

These measures control what the model says, but they do not remove its underlying knowledge. A determined attacker can try to bypass the barriers with a jailbreak, meaning an instruction designed to evade the restrictions.

A switch inside the model

GRAM stands for Gradient-Routed Auxiliary Modules. The technique adds extra groups of neurons to every model layer. Each group acts as a separate compartment for a category of dual-use knowledge.

During training, the model learns normally from general texts. But when it processes information from a specific category, such as virology, only the virology module is updated. The rest of the parameters remains frozen.

This should concentrate that knowledge in its own module instead of spreading it throughout the network. The module can then be removed to switch off the capability or kept active in an authorized setting, such as a biosafety laboratory.

In their tests, the researchers separated four areas: virology, cybersecurity, nuclear physics, and a specialized programming language. Because each could be switched on or off independently, a single training run produced 16 possible configurations.

What happened in the tests

The researchers tested GRAM in three scenarios, ranging from an artificial setup to larger models:

• In children’s stories classified by topic, the model could forget any selected topic and performed almost as well as a model trained from scratch without that content.
• In a mix of web pages, code, and scientific papers, removing a module eliminated the corresponding capability almost as effectively as never training on that data in the first place.
• When testing seven model sizes, from 50 million to 5 billion parameters, GRAM matched the performance of data filtering.

Removing the modules did not reduce overall performance in these tests. Recovering the removed knowledge through a small adjustment using malicious data was also just as difficult as recovering knowledge removed through data filtering.

The comparison was unfavorable to another technique known as unlearning, which attempts to erase information after training. In the experiment, a relatively small adjustment was enough to recover knowledge that had supposedly been removed.

The results also showed a relevant trend: the larger the model, the wider the difference between having a module switched on or off, and the more costly it became to try to overcome the protection.

What it means for you

GRAM does not change how Claude or other commercial models work today. It has not been tested at frontier scale, is not part of a production process, and the evaluations focused mainly on next-token prediction rather than real tasks such as analyzing a threat or designing a vaccine.

Its importance lies in the approach. Instead of creating a completely new model for each access level, a developer could train one version and distribute different configurations depending on who uses it.

A fundamental difficulty remains: some dangerous knowledge may be so mixed with general information that separating it could be impossible without affecting other capabilities. The next question is whether GRAM works in much larger models and on real tasks, not just in laboratory tests.