Anthropic publishes GRAM, a removable 'off switch' for dual-use AI knowledge

Anthropic, working with AE Studio, published research on GRAM (Gradient-Routed Auxiliary Modules), a training method that gives a model dedicated, removable compartments for categories of dual-use knowledge — such as virology, cybersecurity and nuclear physics — rather than relying on refusal training or output classifiers to keep that knowledge from misuse. The method adds extra neurons, organised into per-category modules, at each layer of the transformer; when training data belongs to a given dual-use category, gradients update only that module, concentrating the specialised knowledge in a compartment that can later be deleted or disabled while the general model weights stay untouched.

Anthropic said the technique was tested at scales from 50 million to 5 billion parameters, alongside synthetic datasets used to validate the mechanism in isolation. Deleting a module removed the corresponding capability about as effectively as never having trained on that data at all, while leaving general performance unaffected, and the isolation proved harder to reverse through fine-tuning than existing unlearning methods. A single training run could, on this approach, yield up to 16 differently configured model variants — for example, a version safe to hand to external researchers with sensitive modules stripped out, alongside a full version retained internally.

The paper’s authors were explicit that this is preliminary research: GRAM has not been applied to any production Anthropic model, and they said it remained unclear whether or how it would be deployed. The appeal of the approach, as described, is architectural rather than behavioural — it aims to make dangerous knowledge literally absent from a released model rather than merely suppressed, addressing a weakness of refusal-based safeguards, which determined users have repeatedly been able to circumvent through jailbreaking.