Anthropic and AE Studio Introduce GRAM for Dual-Use Knowledge Control

Anthropic, in collaboration with AE Studio, has introduced Gradient-Routed Auxiliary Modules (GRAM), a technique designed to isolate dual-use knowledge—information that can be used for both beneficial and harmful purposes—into removable compartments within a model's weights. This approach allows developers to surgically remove specific dangerous capabilities or grant access to trusted users without the prohibitive cost of training multiple separately filtered models.

The Challenge of Dual-Use Knowledge

Frontier AI models act as vast repositories of knowledge, but certain domains, such as virology or cybersecurity, are considered "dual-use" because they can be used to either create vaccines or design pathogens, or patch vulnerabilities or exploit them. Current safeguards primarily rely on refusal training and classifiers to screen inputs and outputs. However, these methods do not remove the underlying knowledge from the model, leaving it susceptible to jailbreaks.

While pretraining data filtering can remove this knowledge, it is a a blunt instrument that requires training entirely separate models for different sets of capabilities. For large-scale frontier models, the computational cost of training multiple versions of a model to suit different deployment needs is prohibitive.

How GRAM Works: Gradient-Routed Auxiliary Modules

GRAM enables the benefits of data filtering by isolating specific categories of knowledge into dedicated, removable modules.

Architectural Implementation

GRAM adds extra neurons to every layer of a standard Transformer architecture. These neurons are organized into "modules," with one module assigned per dual-use category.

The Training Process

During training, the model processes data using the following logic:

• General-purpose text: The model learns using standard training procedures.
• Dual-use text: When the model encounters text from a specific dual-use category (e.g., virology), it can use its general knowledge to make predictions, but only the weights within the corresponding virology module are allowed to learn from that data. The general-purpose weights are temporarily frozen.

This mechanism ensures that dual-use knowledge accumulates in the specific module rather than diffusing across the entire network. Consequently, the module can be deleted to remove the capability entirely or retained for trusted deployments.

Experimental Results and Testing

Researchers tested GRAM across three settings to evaluate its effectiveness in removing capabilities and maintaining general performance.

Synthetic and Realistic Datasets

In tests using synthetic children's stories, a GRAM model could be reconfigured to "forget" topics with performance nearly identical to a model trained from scratch with those topics filtered out. In a larger test using a mix of web text, code, and scientific papers, the model was routed into four domains: virology, cybersecurity, nuclear physics, and a niche programming language. Deleting these modules removed the capabilities as effectively as data filtering.

Resistance to Recovery

GRAM proved more robust than "unlearning" techniques. While unlearning only suppresses knowledge, making it easy to restore via fine-tuning, GRAM resisted attempts by attackers to recover removed knowledge using small amounts of malicious data, performing similarly to data filtering.

Scalability and Performance

Experiments conducted on seven model sizes ranging from 50 million to 5 billion parameters showed that:

• GRAM matched the performance of data filtering at every size.
• The gap between "module on" and "module off" configurations grew wider as models scaled.
• Bypassing protections became relatively more difficult and expensive as the model size increased.

Limitations and Future Outlook

GRAM is currently early-stage research and has not been applied to production models, including the Claude family. The researchers identified several key limitations:

• Evaluation Metrics: Current evaluations measure next-token prediction ability rather than performance on real-world downstream tasks.
• Knowledge Entanglement: Some dual-use capabilities may be so deeply intertwined with general knowledge that they cannot be cleanly separated using this method.
• Production Scale: The method has not yet been tested in a production training pipeline or at frontier scale.