An off switch for dual use knowledge in AI models
Frontier AI models store vast knowledge, some of which is dual-use—beneficial for security or medicine but also exploitable for harm. Current safeguards like refusal training and input/output classifiers guard against dangerous outputs but do not alter the underlying knowledge. A determined attacker can still jailbreak the model. Filtering dual-use data from pretraining is a blunt instrument: it forces developers to train separate models for each desired capability set, which is prohibitively expensive for frontier models. The core tension is how to surgically limit access to dual-use knowledge while preserving the model’s general performance and allowing trusted users to use that knowledge for good.
To address this, Anthropic and AE Studio propose GRAM (Gradient-Routed Auxiliary Modules). GRAM adds extra neurons to every layer of a Transformer, divided into modules per dual-use category. During training, when the model encounters text from a category like virology, only the corresponding module learns; the general-purpose weights are frozen. This forces dual-use knowledge to accumulate in the removable module rather than diffusing across the network. After training, a module can be deleted to remove the capability, or kept for trusted deployments. In experiments across synthetic and realistic datasets, GRAM matched data filtering in effectiveness—removing a module removed the capability as effectively as never training on that data—and resisted recovery attacks better than unlearning techniques. The approach scaled from 50M to 5B parameters, with the gap between module-on and module-off widening as models grew.
This is early-stage research: GRAM has not been applied to Anthropic‘s production models like Claude, and evaluations use next-token prediction rather than real downstream tasks. A deeper open problem is that some dual-use capabilities may be too entangled with general knowledge to separate cleanly. Nonetheless, GRAM offers a promising path toward more robust access control that is surgical and flexible. For serious builders, the key takeaway is that knowledge isolation via modular routing could reduce the cost of managing multiple safety configurations, but it requires careful validation at scale and a recognition that not all capabilities may be neatly separable. The approach is worth watching but not yet ready for production deployment.
