How GRAM Works Architecturally

Training Phase

GRAM augments the standard Transformer architecture by adding small auxiliary modules—essentially dedicated neurons at every layer—that are intended to capture specific dual-use capabilities during training . The key mechanism is gradient routing: during backpropagation, weighted masks control which parameters update for which data .

• When the model processes general-purpose text, it learns normally, while the auxiliary modules can also train in a way that keeps them compatible with the rest of the model .
• When the model encounters text from a dual-use category like virology or cybersecurity, gradient routing directs the learning signal toward the corresponding auxiliary module rather than allowing that knowledge to diffuse across all model parameters .
• This concentrates knowledge about each target domain in a dedicated module instead of spreading it throughout the network .

Inference Phase

Once training is complete, individual modules can be removed or disabled to reduce access to a particular capability, or left in place for deployments that are permitted to use that knowledge . Because each dual-use category maps to its own module, a single GRAM-trained model with four categories can theoretically be configured into 2⁴ = 16 distinct capability profiles by toggling each module on or off independently .

Results on Models Up to 5 Billion Parameters

The researchers tested GRAM across several settings and model sizes :

1. Synthetic dataset: In a controlled synthetic setting, GRAM made a model "forget" selected topics, and the results were compared against models trained as if those topics had been filtered from the start .
2. Realistic dual-use data: In a more realistic setup using web text, code, scientific papers, and dual-use domains, removing a GRAM module reduced the corresponding capability—approximating the effect of data filtering—while preserving general-purpose performance .
3. Scaling study: GRAM was tested across model sizes from 50 million to 5 billion parameters . Key findings: GRAM tracked the behavior of data filtering; larger models showed clearer separation between module-on and module-off behavior; and the method compared favorably with some post-training unlearning approaches in the tested settings .

Policy Context: From Modular Controls to Real-World Export Bans

The GRAM research arrives alongside a high-stakes real-world example of the problem it aims to solve. In June 2025, the Trump administration imposed export controls on Anthropic's Claude Fable 5 and Mythos 5 models after cybersecurity concerns, blocking access for any foreign national—inside or outside the U.S., including foreign-national Anthropic employees . The ban lasted 18 days before the Commerce Department lifted it after a national security review .

This episode illustrates the current state of AI access control: an entire model—with all its capabilities—gets treated as a single indivisible unit. If a model has a dangerous capability, the only option today is to withhold the entire system. GRAM proposes a finer-grained alternative: instead of locking down an entire model, a system could allow or disable specific categories of knowledge depending on the deployment context .

Open Questions and Limitations

Anthropic's researchers explicitly identify GRAM as preliminary work and highlight several limitations :

• Frontier scale not tested: GRAM has not been shown to work in production Claude models or at the scale of the largest frontier systems .
• Evaluation scope: The reported experiments focus on controlled evaluations; real-world downstream capability removal may be harder to measure reliably .
• Fundamental entanglement problem: Some dual-use capabilities may be deeply entangled with general knowledge, making them difficult for any localization or filtering method to separate cleanly .
• Data-labeling realism: GRAM depends on identifying and routing relevant dual-use data during training, so reliably labeling such data at scale remains an important practical challenge .
• Preliminary findings: Anthropic presents GRAM as an early research direction rather than a deployed safety mechanism—and the organization is not sure it ever will be deployed .

How GRAM Works Architecturally

Training Phase

GRAM augments the standard Transformer architecture by adding small auxiliary modules—essentially dedicated neurons at every layer—that are intended to capture specific dual-use capabilities during training . The key mechanism is gradient routing: during backpropagation, weighted masks control which parameters update for which data .

• When the model processes general-purpose text, it learns normally, while the auxiliary modules can also train in a way that keeps them compatible with the rest of the model .
• When the model encounters text from a dual-use category like virology or cybersecurity, gradient routing directs the learning signal toward the corresponding auxiliary module rather than allowing that knowledge to diffuse across all model parameters .
• This concentrates knowledge about each target domain in a dedicated module instead of spreading it throughout the network .

Inference Phase

Once training is complete, individual modules can be removed or disabled to reduce access to a particular capability, or left in place for deployments that are permitted to use that knowledge . Because each dual-use category maps to its own module, a single GRAM-trained model with four categories can theoretically be configured into 2⁴ = 16 distinct capability profiles by toggling each module on or off independently .

Results on Models Up to 5 Billion Parameters

The researchers tested GRAM across several settings and model sizes :

1. Synthetic dataset: In a controlled synthetic setting, GRAM made a model "forget" selected topics, and the results were compared against models trained as if those topics had been filtered from the start .
2. Realistic dual-use data: In a more realistic setup using web text, code, scientific papers, and dual-use domains, removing a GRAM module reduced the corresponding capability—approximating the effect of data filtering—while preserving general-purpose performance .
3. Scaling study: GRAM was tested across model sizes from 50 million to 5 billion parameters . Key findings: GRAM tracked the behavior of data filtering; larger models showed clearer separation between module-on and module-off behavior; and the method compared favorably with some post-training unlearning approaches in the tested settings .

Policy Context: From Modular Controls to Real-World Export Bans

The GRAM research arrives alongside a high-stakes real-world example of the problem it aims to solve. In June 2025, the Trump administration imposed export controls on Anthropic's Claude Fable 5 and Mythos 5 models after cybersecurity concerns, blocking access for any foreign national—inside or outside the U.S., including foreign-national Anthropic employees . The ban lasted 18 days before the Commerce Department lifted it after a national security review .

This episode illustrates the current state of AI access control: an entire model—with all its capabilities—gets treated as a single indivisible unit. If a model has a dangerous capability, the only option today is to withhold the entire system. GRAM proposes a finer-grained alternative: instead of locking down an entire model, a system could allow or disable specific categories of knowledge depending on the deployment context .

Open Questions and Limitations

Anthropic's researchers explicitly identify GRAM as preliminary work and highlight several limitations :

• Frontier scale not tested: GRAM has not been shown to work in production Claude models or at the scale of the largest frontier systems .
• Evaluation scope: The reported experiments focus on controlled evaluations; real-world downstream capability removal may be harder to measure reliably .
• Fundamental entanglement problem: Some dual-use capabilities may be deeply entangled with general knowledge, making them difficult for any localization or filtering method to separate cleanly .
• Data-labeling realism: GRAM depends on identifying and routing relevant dual-use data during training, so reliably labeling such data at scale remains an important practical challenge .
• Preliminary findings: Anthropic presents GRAM as an early research direction rather than a deployed safety mechanism—and the organization is not sure it ever will be deployed .