What Is GRAM? Anthropic's New Off Switch for Risky AI Knowledge, Explained

AI models store enormous amounts of knowledge, and some of it is "dual-use" — usable for both good and bad purposes. On July 8, 2026, Anthropic, working with AE Studio, published research on a new method called GRAM that can isolate this kind of risky knowledge inside a model and let it be switched on or off. It's still early-stage research, but here's a beginner-friendly walkthrough of the concept and the findings.

Quick terms before we dive in

• Dual-use knowledge — knowledge that can be used for both good and harmful purposes. Cybersecurity knowledge, for example, can help patch a vulnerability or exploit one.
• Pretraining — the initial phase where an AI model learns from a huge amount of text, such as from the internet.
• Transformer — the neural network architecture (the computational design) that most of today's large language models (the AI behind chatbots) are built on.
• Parameters (weights) — the internal numeric values a model adjusts during training. Together, these values represent what the model "knows."
• GRAM (Gradient-Routed Auxiliary Modules) — the name of the method described here, referring to auxiliary (helper) modules that training signals ("gradients") are selectively routed to. This article refers to it simply as GRAM.
• Unlearning — a technique applied after training that tries to remove specific knowledge from an already-trained model.
• Fine-tuning — adjusting an already-trained model further using a smaller amount of additional data.

What today's safeguards are missing

AI companies currently train models to refuse harmful requests (refusal training) and use separate monitoring programs (classifiers) to screen inputs and outputs for dangerous content. Per the research post, these layers guard against dangerous outputs, but they don't change the knowledge actually stored inside the model. That means a sufficiently determined person trying to bypass the defenses (a "jailbreak" attempt) may still be able to reach the dual-use knowledge stored in the model.

The existing alternative: the limits of filtering

A more fundamental approach is to keep the model from ever learning the knowledge in the first place. In earlier work, Anthropic filtered information related to chemical, biological, radiological, and nuclear weapons (CBRN) out of pretraining data, and later showed that dual-use knowledge can be confined to a removable slice of a model's weights.

But filtering has a catch. According to the research post, filtering produces a single model with one fixed set of capabilities. If you want one version that can discuss advanced virology — for a vetted biosecurity lab, say — and another version that can't, you have to train two separate models from scratch. For frontier models (today's largest, most expensive-to-train models), that cost can become prohibitive.

The new approach: GRAM (Gradient-Routed Auxiliary Modules)

The research done with AE Studio aims to get the benefit of training many separately filtered models while only paying the cost of training one. A desk-with-drawers analogy helps here: the desk itself (the model's shared, general knowledge) is built only once, while each category of risky knowledge gets its own drawer (module) attached to it. A drawer that isn't needed can be pulled out entirely; a drawer can also be left in place for deployments that are trusted to use it.

How it works, step by step

1. Extra neurons (the basic computational units of a neural network) are added to every layer of a standard Transformer, and these neurons are divided into groups — one module per dual-use category.
2. When the model is learning from general-purpose text, its full set of weights updates as usual.
3. When the model encounters text from a dual-use category (say, virology-related material), the rules change: the model can still use its existing general knowledge to make predictions, but only that category's module is allowed to actually learn from the text. The general-purpose weights are temporarily frozen and don't change.
4. As a result, virology knowledge accumulates in the virology module instead of spreading across the whole network.
5. After training, that module can simply be deleted to remove the capability, or left in place for a trusted deployment — such as a vetted lab — where the virology knowledge is actually needed.

In the experiments, four dual-use categories were defined, meaning a single training run produced a model that could be configured 16 different ways (2 to the power of 4) — "on" or "off" for each category.

What three rounds of testing found

1. A small-scale test with children's stories — using a synthetic dataset of children's stories tagged by topic, a small GRAM model was trained and then reconfigured to "forget" any chosen topic. Each configuration performed almost identically to a separate model trained from scratch with that topic filtered out — meaning the cost of one training run produced results that would normally require multiple separate runs on different datasets.
2. A larger, more realistic test — a bigger model was trained on a mix of web text, code, and scientific papers, with four dual-use domains — virology, cybersecurity, nuclear physics, and a niche programming language (used as a stand-in for specialized dual-use code) — each routed to its own module. Deleting a module removed the corresponding capability about as effectively as never having trained on that data at all, and this removal did not degrade the model's general performance. The researchers also tested whether an attacker could recover deleted knowledge by fine-tuning on a small amount of malicious data; GRAM resisted this about as well as data filtering did. By contrast, an "unlearning" technique applied after training only suppressed the knowledge, which was easy to restore with a small amount of fine-tuning.
3. A test across model sizes — the same experiment was run at seven model sizes, from 50 million to 5 billion parameters. GRAM matched the performance of data filtering at every size, and the gap between "module on" and "module off" grew wider as models got larger. In terms of compute cost, attempting to bypass the protections became relatively more difficult and expensive as models scaled up.

Remember: this is still research

According to the official post, these results are preliminary, and GRAM has not been applied to any of Anthropic's production models — nor is it certain that it ever will be. The post also notes that as AI companies train more capable models, the need to limit access to dual-use capabilities will keep growing, and that today, this access is mainly limited through classifiers and refusal training.

In summary

GRAM is an experimental attempt to build "removable drawers" for potentially risky knowledge inside a model, so that a single trained model can be safely reconfigured for different purposes. It isn't used in any live product yet, but it illustrates a broader shift in AI safety research — from blocking dangerous outputs toward controlling the underlying knowledge itself.

Related articles

• How to Use Claude Projects: Knowledge & Instructions to Cut Repetition
• Claude Artifacts: How to Create, Edit, Publish & Share (2026)
• claude.ai Shortcuts & Power Tips — A Beginner's Guide to the Web App
• Desktop Extension vs Web Connector in Claude — How to Choose the Right One
• How to Use Claude in Chrome Safely — Official Guide