Anthropic & AE Studio develop GRAM to surgically remove dual-use knowledge from AI models

Anthropic and AE Studio conducted research into GRAM (Gradient-Routed Auxiliary Modules), a technique designed to isolate dual-use knowledge—information that can be used for both beneficial and harmful purposes—into removable compartments within a single AI model. Examples of dual-use knowledge include virology (which can help create vaccines or design pathogens), cybersecurity (which can patch vulnerabilities or exploit them), nuclear physics, and specialized code.

Current AI safeguards rely on refusal training and classifiers that screen inputs and outputs for dangerous content. However, these layers protect against harmful outputs without changing the knowledge stored in the underlying model. A sufficiently determined attacker may still jailbreak the model to access this dual-use knowledge. GRAM takes a different approach by controlling what the model knows in the first place. The technique adds extra neurons to every layer of a standard Transformer (the neural network architecture underlying large language models) and divides them into modules, one per dual-use category. During training, when the model encounters general-purpose text, it learns normally. But when it encounters dual-use text—such as about virology—the rules change: the model can use its general knowledge to make predictions, but only the virology module is allowed to learn from that text, while general-purpose weights are frozen. The result is that dual-use knowledge accumulates in its own module rather than diffusing across the network. After training, the module can be deleted and the capability removed, or left in place for trusted deployments when that knowledge is needed.

The team tested GRAM in three settings of increasing realism. First, on a synthetic dataset of children's stories tagged by topic, a small model with GRAM could be reconfigured to "forget" any chosen topic, achieving results nearly identical to separate models trained from scratch with that topic filtered out. Second, they trained a larger model on a realistic mix of web text, code, and scientific papers, routing four dual-use domains—virology, cybersecurity, nuclear physics, and a niche programming language—into separate modules. Deleting a module removed the corresponding capability about as effectively as never having trained on that data at all, without degrading general performance. The team also tested whether attackers could recover removed knowledge through fine-tuning; GRAM resisted this about as well as data filtering did, whereas an "unlearning" technique applied after training only suppressed the knowledge and was easy to restore. Third, they ran the experiment at seven model sizes from 50 million to 5 billion parameters. GRAM matched the performance of data filtering at every size, and the gap between "module on" and "module off" grew wider as models grew larger. Remarkably, a single training run with four dual-use categories yielded a model configurable in 16 different ways.

The researchers acknowledge that this research is preliminary. GRAM has not been applied to any of Anthropic's Claude models, and the team is uncertain whether it ever will be. The experiments measure performance through next-token prediction ability rather than real downstream tasks, and evaluations have not reached frontier model scale or been tested in a production training pipeline. The team also identifies an open problem: some dual-use capabilities may be so entangled with general knowledge that no method can separate them cleanly. Nevertheless, the research offers a potential path toward more robust access control as AI companies train increasingly capable models.

Current AI safety relies on layers of defense—refusal training and classifiers that screen inputs and outputs—but these approaches do not alter the underlying knowledge stored in the model itself. A determined attacker may still jailbreak these defenses to access dual-use information. GRAM tackles this problem by changing the architecture and training process so that sensitive knowledge is confined to specific, removable modules rather than diffused throughout the network. This builds on earlier work at Anthropic that filtered dual-use information from pretraining data and showed that dual-use knowledge can be confined to a slice of a model's weights—but GRAM addresses the key limitation of previous approaches: filtering produces one fixed model configuration, requiring separate training runs for each desired capability set. Frontier AI models are expensive to train, making this approach costly for developers who need multiple versions with different capabilities (one for a vetted biosecurity lab, another for public deployment). By routing knowledge into separate modules during a single training run, GRAM offers a potential path to configure a model after training is complete, at a fraction of the cost.

The experiments show that GRAM works across a range of model sizes and resists attackers attempting to recover removed knowledge through fine-tuning—matching the robustness of data filtering while preserving general task performance. However, the team acknowledges clear limitations: tests have not reached frontier model scale, evaluations measure next-token prediction rather than downstream task performance, and some dual-use capabilities may be too entangled with general knowledge to be cleanly separated.