Anthropic and AE Studio's GRAM: A Modular "Off Switch" for Dangerous AI Capabilities

Anthropic and AE Studio have introduced an experimental technique called GRAM (Gradient-Routed Auxiliary Modules) that could give AI models a granular "off switch" for dangerous knowledge. Instead of training separate models for every safety configuration, GRAM aims to build a single model with removable compartments for dual-use capabilities such as virology, cybersecurity, and nuclear physics . The research is preliminary—Anthropic states it has not been applied to any production Claude model —but it represents a promising direction for making AI safety more surgical than today's blunt toolkit.

What Is GRAM?

GRAM is a pretraining method designed to localize dual-use knowledge—information that can be used for both beneficial and harmful purposes—into removable neural modules inside a language model . After training, those modules can be switched on or off, giving operators fine-grained control over which dangerous capabilities the model retains . The same approach could also enable different access profiles for different users: researchers might turn on virology knowledge while a public-facing chatbot keeps it disabled .

How GRAM Works Architecturally

Training Phase

GRAM augments the standard Transformer architecture by adding small auxiliary modules—essentially dedicated neurons at every layer—that are intended to capture specific dual-use capabilities during training . The key mechanism is gradient routing: during backpropagation, weighted masks control which parameters update for which data .

• When the model processes general-purpose text, it learns normally, while the auxiliary modules can also train in a way that keeps them compatible with the rest of the model .
• When the model encounters text from a dual-use category like virology or cybersecurity, gradient routing directs the learning signal toward the corresponding auxiliary module rather than allowing that knowledge to diffuse across all model parameters .
• This concentrates knowledge about each target domain in a dedicated module instead of spreading it throughout the network .

Inference Phase

Once training is complete, individual modules can be removed or disabled to reduce access to a particular capability, or left in place for deployments that are permitted to use that knowledge . Because each dual-use category maps to its own module, a single GRAM-trained model with four categories can theoretically be configured into 2⁴ = 16 distinct capability profiles by toggling each module on or off independently .

Results on Models Up to 5 Billion Parameters

The researchers tested GRAM across several settings and model sizes :

1. Synthetic dataset: In a controlled synthetic setting, GRAM made a model "forget" selected topics, and the results were compared against models trained as if those topics had been filtered from the start .
2. Realistic dual-use data: In a more realistic setup using web text, code, scientific papers, and dual-use domains, removing a GRAM module reduced the corresponding capability—approximating the effect of data filtering—while preserving general-purpose performance .
3. Scaling study: GRAM was tested across model sizes from 50 million to 5 billion parameters . Key findings: GRAM tracked the behavior of data filtering; larger models showed clearer separation between module-on and module-off behavior; and the method compared favorably with some post-training unlearning approaches in the tested settings .

Policy Context: From Modular Controls to Real-World Export Bans

The GRAM research arrives alongside a high-stakes real-world example of the problem it aims to solve. In June 2025, the Trump administration imposed export controls on Anthropic's Claude Fable 5 and Mythos 5 models after cybersecurity concerns, blocking access for any foreign national—inside or outside the U.S., including foreign-national Anthropic employees . The ban lasted 18 days before the Commerce Department lifted it after a national security review .

This episode illustrates the current state of AI access control: an entire model—with all its capabilities—gets treated as a single indivisible unit. If a model has a dangerous capability, the only option today is to withhold the entire system. GRAM proposes a finer-grained alternative: instead of locking down an entire model, a system could allow or disable specific categories of knowledge depending on the deployment context .

Open Questions and Limitations

Anthropic's researchers explicitly identify GRAM as preliminary work and highlight several limitations :

• Frontier scale not tested: GRAM has not been shown to work in production Claude models or at the scale of the largest frontier systems .
• Evaluation scope: The reported experiments focus on controlled evaluations; real-world downstream capability removal may be harder to measure reliably .
• Fundamental entanglement problem: Some dual-use capabilities may be deeply entangled with general knowledge, making them difficult for any localization or filtering method to separate cleanly .
• Data-labeling realism: GRAM depends on identifying and routing relevant dual-use data during training, so reliably labeling such data at scale remains an important practical challenge .
• Preliminary findings: Anthropic presents GRAM as an early research direction rather than a deployed safety mechanism—and the organization is not sure it ever will be deployed .