off-switch-dual-use-gram

name	off-switch-dual-use-gram
category	ai_collection
description	Gradient-Routed Auxiliary Modules (GRAM) methodology from Anthropic/AE Studio research (Jul 8, 2026) — training a single LLM with removable, category-specific knowledge compartments that can be toggled on/off post-training without retraining, enabling surgical dual-use knowledge control.
tags	["anthropic","alignment","dual-use-knowledge","GRAM","gradient-routed","removable-modules","safety","model-training"]
url	https://www.anthropic.com/research/off-switch-dual-use
collaborator	AE Studio

GRAM: Gradient-Routed Auxiliary Modules — An Off Switch for Dual-Use Knowledge

Anthropic/AE Studio research (Jul 8, 2026) introducing GRAM, a method for training a single model with dedicated, removable knowledge compartments for each dual-use category.

Problem Statement

Frontier AI models store dual-use knowledge (knowledge usable for both good and bad). Current safeguards (refusals, classifiers) guard against dangerous outputs but don't change what the model knows. Filtering dual-use data is a blunt instrument requiring separate model training for each deployment configuration.

Three-way tension:

1. Limit dual-use capabilities surgically
2. Allow trusted users to access the same capabilities
3. Don't degrade general model performance

How GRAM Works

Architecture

• Add extra neurons to every Transformer layer
• Neurons divided into modules, one per dual-use category
• General-purpose weights remain unchanged for normal learning

Training Protocol

• General text: Model learns normally across all weights
• Dual-use text (e.g., virology): General-purpose weights are temporarily frozen; only the corresponding module is allowed to learn from that data
• Model can use its general knowledge to make predictions on dual-use text, but only the targeted module updates

Result

• Knowledge accumulates in the targeted module rather than diffusing across the whole network
• After training, the module can be deleted — the capability goes with it
• Or left in place for trusted deployments

Combinatorial Configuration

• In experiments: 4 dual-use categories → 16 different configurations (on/off for each category)
• Achieved from one training run, versus 16 separate training runs with traditional filtering

Experimental Results

Test 1: Synthetic Dataset

• Children's stories tagged by topic
• Small GRAM model could "forget" any chosen topic
• Each configuration performed almost identically to a separate model trained from scratch with that topic filtered out
• Cost of one model → results that normally require multiple training runs

Test 2: Realistic Dataset

• Mix of web text, code, and scientific papers
• Four dual-use domains: virology, cybersecurity, nuclear physics, niche programming language
• Deleting a module removed capability as effectively as never having trained on that data
• Removal did not degrade general performance
• Post-removal fine-tuning attack: GRAM resisted recovery about as well as data filtering
• By contrast, post-training "unlearning" only suppressed knowledge — easily restored with small fine-tuning

Test 3: Scaling

• Seven model sizes: 50M → 5B parameters
• GRAM matched data filtering performance at every size
• Gap between "module on" and "module off" grew wider at larger sizes
• Bypassing protections became relatively more expensive as models scaled

Comparison to Alternatives

Method	Requires Retraining?	Knowledge Recoverable?	Performance Degradation?
Data filtering	Yes (per configuration)	Resistant	None
Post-training unlearning	No	Easily restored with fine-tuning	Unknown
GRAM	No (one run, many configs)	Resistant (like filtering)	None

Key Advantages

1. One training run → N configurations: Exponential configuration space from linear cost
2. No performance degradation: Deleting modules doesn't harm general capabilities
3. Removable by deletion: Physically removing weights, not just suppressing behavior
4. Scales favorably: Larger models make bypass harder, not easier
5. Resists post-removal recovery: As resistant as data filtering to fine-tuning attacks

Limitations

• Preliminary: Not applied to production Anthropic models
• Requires labeled dual-use data: Need to identify and categorize dual-use content at training time
• Fixed module count: Number of modules set at training time; cannot add categories post-hoc
• Overhead: Extra neurons increase model size proportionally to number of dual-use categories

Applications

• Biosecurity: Deploy models with virology capabilities only in vetted labs
• Cybersecurity: Control access to vulnerability exploitation knowledge
• Nuclear safety: Compartmentalize nuclear physics knowledge
• Regulatory compliance: Region-specific capability toggling
• Trusted researcher access: Enable specific domains for verified users while deploying safe versions publicly

Implementation Considerations

1. Module routing: Need a classifier at training time to route dual-use text to correct modules
2. Neuron overhead: Each module adds parameters; for K categories, overhead is ~K× module size per layer
3. Freeze/unfreeze mechanics: Training loop must dynamically freeze general weights on dual-use examples
4. Module deletion: Post-training weight pruning is straightforward — zero out module weights
5. Combinatorial deployment: Binary on/off per module → 2^K deployment configurations from 1 model

Activation

GRAM, gradient-routed auxiliary modules, dual-use knowledge, removable knowledge, knowledge compartments, model unlearning, AI safety, capability toggling, surgical knowledge removal, Anthropic alignment, AE Studio, model training efficiency