Bottom line
The useful idea is architectural access control. Instead of relying only on refusals or output filters, the GRAM approach tries to route categories of dual-use knowledge into removable modules during training. That could make future model access more granular. The caution is just as important: Anthropic says GRAM is preliminary, has not been applied to production Claude models, has not been tested at frontier scale, and may not cleanly separate knowledge that is deeply entangled with ordinary expertise.
What Anthropic published
On July 8, 2026, Anthropic published An off switch for dual-use knowledge in AI models. The post says the work was conducted by AE Studio in collaboration with Anthropic and points to a more technical Alignment Science Blog post, Modular Pretraining Enables Access Control.
The problem is straightforward but difficult: frontier models can contain knowledge that is useful in legitimate settings and dangerous in malicious ones. Anthropic gives examples such as cybersecurity and virology. Current safety layers usually try to screen prompts and outputs. GRAM asks whether some categories of knowledge can be compartmentalized while the model is being trained.
The GRAM idea in plain English
GRAM stands for Gradient-Routed Auxiliary Modules. The method adds small auxiliary groups of neurons to every Transformer layer. During training, ordinary text updates the model normally. When the model sees text from a selected dual-use category, the general weights are frozen and learning is routed into the relevant auxiliary module.
If that works, the developer can keep one trained model but switch certain capability modules on or off for different trust contexts. In theory, a vetted lab could receive a version with a specialist module available, while a public deployment could run without that module. That is a different safety shape than asking the same model to know everything and merely refuse certain requests.
What the tests actually showed
Anthropic's public summary says the experiments used model sizes from 50 million to 5 billion parameters, plus an 800 million-parameter model trained on web text, code, scientific papers and four dual-use domains. The technical blog describes those domains at a high level as virology, cybersecurity, nuclear physics and specialized code.
The main reported result is that deleting or disabling a GRAM module removed the corresponding capability about as effectively as not training on that data, without noticeably degrading general next-token performance in the test setting. Anthropic also says GRAM resisted recovery through a small amount of malicious fine-tuning about as well as data filtering did, while a post-training unlearning method was easier to reverse.
Why this matters
The most important Managing Expectations point is that refusal behavior is not the same thing as knowledge access control. A model can refuse today and still contain the underlying capability. Attackers can then try jailbreaks, indirect prompts, tool routes or fine-tuning. GRAM is interesting because it moves part of the safety question earlier, into training architecture.
If future work scales, this line of research could support more serious deployment choices: which model variant is appropriate for public use, trusted research, lab-internal use, government review, or high-security settings? It could also make safety discussions less theatrical: not "does the chatbot say no?" but "what knowledge is actually present, where is it stored, and who can activate it?"
What this does not prove
- It does not prove that frontier models can safely contain all dangerous knowledge.
- It does not prove that Claude currently uses GRAM; Anthropic explicitly says it has not been applied to production Claude models.
- It does not prove that dual-use expertise can always be cleanly separated from ordinary science, engineering or security knowledge.
- It does not replace red teaming, policy controls, logging, access review, misuse monitoring or independent evaluation.
The practical read
GRAM belongs in the AI Papers Library because it is a concrete technical proposal for a governance problem that is usually discussed in vague language. If a model's dangerous capability is only controlled by refusals, a determined user may try to route around the refusal. If the capability can be compartmentalized, safety engineers get another lever.
But the lever is not magic. The right expectation is: promising early access-control research, meaningful because it attacks the knowledge-storage problem directly, still far from a proven production answer for frontier-scale systems.
Source trail
- Anthropic — An off switch for dual-use knowledge in AI models
- Anthropic Alignment Science Blog — Modular Pretraining Enables Access Control
- Managing Expectations source note for this article
Managing Expectations framing
AI safety should be judged not only by what a model says, but by what it stores, who can activate it, and whether the claimed control survives adversarial pressure.
Open the AI Papers Library