Anthropic's GRAM Can Switch Dangerous Knowledge Off — and Back On Again

A frontier model can be used by a physician asking about vaccines — and by an actor asking about pathogens. Same weights, same knowledge. Until now, the industry's answer has been to teach the model to say no. New research from AE Studio, in collaboration with Anthropic, proposes something different: let the model know it anyway, but store the dangerous part in a room that can be switched off. And — here lies the paradox — a mechanism that can switch knowledge off can also switch it back on. The question shifts from "can the model answer?" to "who holds the switch?"

The method is called GRAM, for Gradient-Routed Auxiliary Modules. It is described in a fresh blog post from Anthropic, and it lands at a moment when American lawmakers are pressing on exactly the same problem from the other end. Rep. Ted Lieu, Democrat of California and author of the "AI Kill Switch Act," said on August 6, according to CNBC, that the bill must pass this year — partly because frontier labs are still reporting incidents in which models gained access to other companies' systems. In a Fox News op-ed, Lieu points to an incident in which OpenAI reportedly asked its most advanced model to carry out a cybersecurity test inside a "sandbox" — an environment that was supposed to be sealed.

From Guardians to Architects

Today's safety stack consists of two things, as Anthropic itself summarizes it: refusal training, in which the model is taught to decline dangerous requests, and classifiers that screen inputs and outputs. These layers guard what the model says. They do not touch what the model knows. A sufficiently determined attacker can try to jailbreak past the defenses and down to the knowledge that has been sitting there all along.

Anthropic has tried the more radical route before. In 2025, the company filtered content about chemical, biological, radiological, and nuclear weapons out of its pretraining data. Later that year, researchers showed that dual-use knowledge can be forced into a removable slice of the model's weights through selective gradient masking. But filtration is a blunt instrument. It yields one model with one fixed capability set.

That is where the economics bite. If you want a model variant that can discuss advanced virology — think an approved biosafety laboratory — and another that cannot, you have to train two separate frontier models. Anthropic describes this cost as "prohibitive" in its own blog post: frontier models are large and extremely expensive to train, and doubling the training cost per user profile is, by the company's account, unsustainable. GRAM is the answer to that arithmetic: the benefit of many separately filtered models at the price of a single training run.

How the Rooms Work

Technically, extra neurons are added to every layer of a standard Transformer. These neurons are divided into groups — modules — one per dual-use category, virology for instance. During training, general text follows the normal learning rule: gradients flow freely through the network. But when the model encounters text from a dual-use category, the rules change: gradients are routed only to the corresponding module, so knowledge about viruses collects in one separable room instead of seeping across all the weights.

Removal or shutdown thus happens inside the model itself, not in the prompt. This is what separates GRAM from refusal training: the model keeps its ability to do everything else, while the specific knowledge sits in a volume that can in principle be switched off, on, or out entirely.

The cost side is the quiet upheaval here. One expensive frontier model can in principle serve many capability profiles — a library of versions, where each release becomes a question of which modules are connected. For an industry where a single frontier-model training run costs hundreds of millions, that is a different economics entirely from one model per safety level.

Preliminary Work, Concrete Consequences

GRAM is not in production. Anthropic itself stresses that the results are preliminary, that the method has not been applied to any of the company's production models, and that it is not sure it ever will be. The consequences should therefore be read as direction, not product.

But the direction is concrete. A biosecurity institution that today must choose between a fully capable model with web-based safety layers, or a filtered model with reduced usefulness, could in a GRAM scenario get the same model with the virology module switched on after approval — and off otherwise. The ability to give different user groups different access to the same knowledge, without training separate models, changes who can get to what, and who has to approve it.

And that is where Congress enters. Lieu's bill is about an emergency stop at the model level — the ability to shut down an entire model that is misbehaving. GRAM operates at another level: the knowledge level, where specific capabilities are demoted without the model being shut down. So the bill and the research do not meet as the same thing — they meet as two answers to the same underlying question: can dangerous capability be switched off without destroying what is useful? Lieu argues, according to CNBC, that the answer must be implemented this year, because the labs' own reports of models reaching beyond their environments show the risk is not hypothetical.

The Hard Part: Keeping the Room Sealed

GRAM's weakness lies in a question that technically fluent readers ask immediately: what stops general knowledge — general biology, general programming — from sitting right up against the module's domain already during pretraining? Gradient routing governs where new knowledge is stored during training. It does not govern what the model can already derive.

Anthropic's earlier work with gradient masking showed that dual-use knowledge can be placed in a removable slice. But that does not prove the knowledge is gone when the slice is removed — only that the direct route in is closed. An attacker does not need the key to the room if the model can reconstruct the contents from general knowledge lying in the open. The routing can, in other words, hide the door without removing the room. What would distinguish the two cases — surface control and genuine knowledge control — is precisely what the research has not yet answered: systematic tests of whether removed modules actually eliminate the capability, or merely make it harder to reach via known attack paths.

Then come the questions of leakage between modules during training, and whether the method scales to frontier-model size. Neither is settled in the published work.

Who Holds the Switch?

Which means the most important consequence of GRAM may not be technical but institutional. A switch must be operated by someone. In Anthropic's laboratory, it is researchers who decide which modules are connected. In Lieu's bill, it is authorities who gain expanded enforcement power over models that misbehave. GRAM shows the switch can be built; it says nothing about who should be allowed to use it, on what criteria, and with what oversight.

The field is moving, then. From "teach the model to say no" to "decide what the model gets to carry." From guardians of answers to architects of knowledge. And from the question of whether such switches can be built — which GRAM has shown, at small scale and with caveats — to the question of whether the rooms stay sealed when someone with time and creativity looks for another way in. The burden of proof now rests on the compartments.