Skip to content
NewsResearch

Anthropic Publishes GRAM Technique to Remove Dual-Use Knowledge From AI Model Weights

· by Pondero Newsdesk

The short version

Anthropic and AE Studio published research on July 8 describing GRAM, a training method that routes dangerous knowledge into removable weight modules, allowing post-hoc capability deletion without degrading general model performance.

Anthropic Publishes GRAM Technique to Remove Dual-Use Knowledge From AI Model Weights

When a frontier model retains dangerous knowledge internally but refuses to say it, a persistent attacker still has something to work with. Research published July 8 by Anthropic and AE Studio tests a different approach: routing specific dual-use knowledge into dedicated weight modules during training, so those modules can simply be deleted from the finished model.

What happened

The technique is called GRAM, for Gradient-Routed Auxiliary Modules. According to Anthropic's research page, it works by adding groups of extra neurons to every layer of a standard transformer. These groups are divided into modules, one per dual-use category. When the model trains on general text, learning proceeds normally. When it trains on text from a designated dual-use category such as virology, only that category's module is allowed to update. The general-purpose weights are frozen.

The consequence is compartmentalization. Virology knowledge accumulates in the virology module instead of diffusing across the full network. After training, that module can be deleted entirely, removing the capability, or left in place for deployments where the capability is needed. In the reported experiments, Anthropic and AE Studio defined four dual-use categories: virology, cybersecurity, nuclear physics, and a niche programming language used as a stand-in for specialized dual-use code. A single training run with GRAM produced a model configurable 16 different ways, one for each combination of the four categories set to on or off.

The team tested the approach at seven model sizes from 50 million to 5 billion parameters. Per the research page, GRAM matched the performance of data filtering at every scale tested. Deleting a module removed the corresponding capability about as effectively as never having trained on that data at all, with no degradation to general-purpose scores. The technique also resisted knowledge recovery through fine-tuning on malicious data at roughly the same level as conventional data filtering, and that resistance grew as model size increased.

Why it matters

Output-layer safeguards, such as refusal training and content classifiers, protect against harmful outputs while leaving the underlying knowledge intact. A sufficiently motivated attacker can sometimes circumvent those safeguards through jailbreaks. GRAM targets the knowledge itself. If a module is deleted, the model cannot produce what it no longer contains, per Anthropic's framing of the distinction.

There is also a cost argument. Producing two versions of a model, one that can discuss advanced virology for a vetted biosecurity lab and one that cannot, previously required two separate training runs on different filtered datasets. At frontier scale, that is expensive. GRAM claims to deliver both configurations from one training pass. That efficiency matters to any organization that needs to offer different capability tiers to different user classes or compliance jurisdictions.

Anthropic stated clearly that GRAM has not been applied to any production Claude models. The limitations are significant: the experiments used next-token prediction as the capability proxy rather than real downstream tasks, the approach has not been tested at frontier model scale, and the authors acknowledged that some dual-use capabilities may be too entangled with general knowledge to separate cleanly using any method.

What to watch next

Anthropic directed readers to the Alignment Science blog post for the full experimental details. The two concrete follow-up signals to watch are: whether any lab replicates GRAM at a scale closer to production deployment, and whether policymakers or standards bodies cite it in regulatory discussions around dual-use capability controls. Independent replication at larger parameter counts would determine whether the technique's clean performance separation holds as model capacity grows.

Sources