# Anthropic off-switch / GRAM source note — 2026-07-20

Purpose: weekly Managing Expectations AI Papers Library maintenance note. Selected item: Anthropic and AE Studio's July 2026 GRAM / modular-pretraining research on controlling access to dual-use AI knowledge.

## Bottom line

Substantive source found and selected for one new library/blog note. Anthropic published `An off switch for dual-use knowledge in AI models` on July 8, 2026, with a linked Alignment Science Blog technical post, `Modular Pretraining Enables Access Control`. The work describes Gradient-Routed Auxiliary Modules (GRAM), a modular-pretraining method meant to isolate selected dual-use knowledge into switchable/removable model modules during training.

Editorial framing: treat this as promising early technical safety research, not as proof that Claude has a production-ready off switch or that dangerous knowledge can always be cleanly separated from general expertise. Anthropic explicitly says GRAM is preliminary, has not been applied to production Claude models, has not been tested at frontier scale or in a production training pipeline, and was evaluated mainly through next-token prediction rather than real downstream task performance.

## Sources checked this run

### Anthropic Research feed

- Page: https://www.anthropic.com/research
- Accessed: 2026-07-20
- Tooling: direct HTML retrieval via Python/urllib because general web_search/web_extract was unavailable in this Hermes runtime.
- Recent visible items included:
  - `How Canada uses Claude: Findings from the Anthropic Economic Index` — Jul 14, 2026.
  - `Claude's values across models and languages` — Jul 13, 2026.
  - `Claude plays robotics` — Jul 9, 2026.
  - `An off switch for dual-use knowledge in AI models` — Jul 8, 2026.
  - `A global workspace in language models` — Jul 6, 2026.
- Local duplicate check: `A global workspace in language models` already has a Managing Expectations article/source-note from 2026-07-07. The off-switch/GRAM item had no existing local article/source note.

### Anthropic article / official source

- Page: https://www.anthropic.com/research/off-switch-dual-use
- Accessed: 2026-07-20
- Title: `An off switch for dual-use knowledge in AI models`
- Page date: Jul 8, 2026
- Page subject/category: Alignment
- Page description metadata: `New results on a method of controlling access to potentially dangerous AI capabilities`
- Collaboration statement: the post says the research was conducted by AE Studio in collaboration with Anthropic.

Key facts verified from page text:

- Anthropic frames the problem as dual-use knowledge: information that can be beneficial in legitimate contexts but dangerous in malicious contexts.
- The post contrasts ordinary refusal/classifier safeguards with controlling what knowledge the underlying model has access to.
- It says previous work explored pretraining-data filtering and confining dual-use knowledge to removable slices of weights.
- It introduces GRAM, Gradient-Routed Auxiliary Modules, as a method intended to approximate training many separately filtered models while requiring only one training run.
- Anthropic says GRAM adds extra neurons to every Transformer layer, grouped into modules by dual-use category. During selected dual-use training examples, general weights are frozen and only the relevant module learns from the data.
- The public summary says experiments covered four dual-use domains at a high level: virology, cybersecurity, nuclear physics, and a niche/specialized programming-language/code domain.
- It says experiments were run at seven model sizes from 50 million to 5 billion parameters.
- It says deleting a module removed the corresponding capability about as effectively as never training on that data, without degrading general next-token performance in the test setting.
- It says GRAM resisted recovery through a small amount of malicious fine-tuning about as well as data filtering, while a post-training unlearning technique only suppressed knowledge and was easier to restore.

### Alignment Science Blog technical post

- Page: https://alignment.anthropic.com/2026/modular-pretraining/
- Accessed: 2026-07-20
- Title: `Modular Pretraining Enables Access Control`
- Description metadata: `We study a method for isolating dual use knowledge to specific modules within a language model. These modules can be switched on or off to control what the model knows.`

Key facts verified from page text:

- The post states that GRAM approximates separately trained, data-filtered models in a single run.
- It reports an initial synthetic children's-stories experiment with a 26M-parameter model where knowledge of specific story topics could be switched on or off.
- It reports a more realistic 800M-parameter experiment trained on web text, code, scientific papers and four dual-use domains.
- It says the dual-use data was small relative to general training data: about 16B general tokens versus roughly 40M per risky domain, or about 0.25% each.
- It compares GRAM against data filtering, LoRA fine-tuning on a filtered model, and a post-hoc knowledge-removal method called MaxEnt.
- It says GRAM and LoRA removed selected capabilities nearly as effectively as not training on the data, while retaining stronger performance on retained domains than strict filtering.
- It reports that MaxEnt recovered close to all-data baseline performance under malicious fine-tuning, suggesting that this kind of post-hoc unlearning suppressed rather than fully removed the capability.

### OpenAI official RSS / blocked page check

- RSS: https://openai.com/news/rss.xml
- Accessed: 2026-07-20
- RSS was reachable and listed recent July 2026 items, including:
  - `A scorecard for the AI age` — Jul 17, 2026.
  - `Why teens deserve access to safe AI` — Jul 16, 2026.
  - `The US is advancing AI safety through state and federal action` — Jul 15, 2026.
  - `GPT-Red: Unlocking Self-Improvement for Robustness` — Jul 15, 2026.
- Direct OpenAI pages returned HTTP 403 in this environment. Therefore OpenAI items were treated as official RSS leads only and were not selected for publication because the full primary article/technical body could not be verified during this run.

### Google DeepMind blog / official source

- Page: https://deepmind.google/discover/blog/ and canonical https://deepmind.google/blog/
- Accessed: 2026-07-20
- Recent visible DeepMind cards included `Our approach to bioresilience` and `Empowering India's next generation of innovators with ATL Saathi` in July 2026, plus June 2026 model and safety posts.
- Local duplicate check: `Securing the future of AI agents` / `GDM AI Control Roadmap` already has a Managing Expectations source note and article from 2026-07-06.
- Selection rationale: the Anthropic GRAM item was more directly suited to a new AI Papers Library card this run because it is an accessible technical safety post with no existing local duplicate.

### LawZero / Yoshua Bengio

- Homepage: https://lawzero.org/en
- Accessed: 2026-07-20
- Recent visible LawZero homepage items still included the Scientist AI safety-case news/publication and ICML 2026 presence material.
- Local duplicate check: LawZero/Bengio Scientist AI materials were already captured in `research/ai/yoshua-bengio-update-2026-07-02.md`.

### arXiv API spot checks

- API queried for recent July 2026 terms across Anthropic, OpenAI, Google DeepMind, Yoshua Bengio and AI safety.
- Recent arXiv leads included `Coercion and Deception in AI-to-AI Management`, `Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems`, `Value Leakage`, and `Harmonizing AI Safety Thresholds`.
- These were not selected because the task prioritizes primary official source pages where available, and the Anthropic GRAM item had an official research page plus a technical blog post with enough source detail for a public note.

## Why this was selected

- Primary source from a frontier AI lab / official Anthropic research page.
- Technical safety method, not only product marketing or policy commentary.
- Distinct from existing Managing Expectations AI articles: it is about training-time knowledge compartmentalization and access control, not robotics, economic usage telemetry, global-workspace interpretability, or agent-control monitoring.
- Strong Managing Expectations angle: refusal behavior is not the same as knowledge access control.

## Article framing used

Title: `Anthropic's Off Switch for Dual-Use AI Knowledge`

Evidence label: `technical safety research / modular-pretraining access control`

Core caution: GRAM is promising early work, but it has not been applied to production Claude models, has not been demonstrated at frontier scale, and does not prove that dual-use knowledge can always be cleanly separated from general expertise.

## Files updated locally

- `blog/articles/anthropic-off-switch-dual-use-knowledge.html`
- `research/ai/anthropic-off-switch-dual-use-knowledge-source-note-2026-07-20.md`
- `ai-library.html`
- `research/ai/ai-paper-library-seed-2026-06-11.json`
- `research/ai/ai-paper-library-source-note-2026-06-11.md`
- `blog/index.html`
- `sitemap.xml`