News · 2026-07-29

Researchers built a model whose dangerous knowledge can be switched off like a module

Researchers have built language models whose most sensitive knowledge sits in modules that can be switched off. The method, called Gradient Routed Auxiliary Modules or GRAM, steers dual-use training data into small dedicated components during pretraining, so that removing a component at inference time approximates a model that was never trained on that category of data at all. In experiments spanning models from 50 million to 5 billion parameters, a single trained model could approximate several differently restricted models.

Key facts

• The mechanism: risky knowledge is isolated into auxiliary modules that can be turned on or off, so one training run yields multiple access-controlled configurations.
• The tested range: models from 50 million to 5 billion parameters -- well below frontier scale.
• Who and when: published July 8, 2026 on Anthropic's alignment science blog, by AE Studio's Ethan Roland, Murat Cubuktepe and Erick Martinez with colleagues, in collaboration with Anthropic researchers Cem Anil and Alex Cloud.
• Primary source: Modular Pretraining Enables Access Control.

The problem this attacks is the hardest one in AI release policy, and it is genuinely hard. A capable model trained on the open internet learns things that are useful to defenders and useful to attackers -- how vulnerabilities work, how pathogens behave, how to construct a convincing phishing campaign. The two standard answers are both unsatisfying. Keep the model behind an API and you retain the ability to monitor, rate-limit and revoke, but you concentrate capability in a few companies. Release the weights and you get transparency, private deployment and independent red-teaming, but you cannot take them back and you cannot enforce a guardrail on a copy running on someone else's machine.

GRAM's proposal is to make the risky knowledge structurally separable in advance. During pretraining, gradient routing directs updates from sensitive data categories into small auxiliary modules rather than letting them diffuse through the whole network. At inference, detach the module and the model behaves approximately as though that data had been filtered out of its training set entirely. Reattach it for a vetted user and the capability returns. Crucially, the authors report that one training run can produce several such configurations, which changes the economics: today, producing a model without a category of knowledge means paying for a whole additional pretraining run.

The intuition is a building with a restricted wing. The conventional approach either locks the entire building and issues visitor badges, or unlocks everything and hopes. GRAM tries to design the wing as a detachable annex, so the same construction serves both the general public and the credentialed specialist. This is a different technique from machine unlearning, which tries to remove knowledge after the fact from a network where it has already spread everywhere -- an approach that has repeatedly proven leaky under red-teaming.

The reason this three-week-old research post matters right now is that it is the only concrete technical answer on offer in this month's open-weights fight. Anthropic's own policy position argues for pre-release safety testing of sufficiently capable models rather than any categorical ban, and rests on the claim that released weights are irreversible. The opposing coalition, which now includes most large American technology companies, argues that broad access helps defenders more than attackers. Both sides accept the irreversibility premise. GRAM is an attempt to make it negotiable -- to create a middle option between a locked API and a permanent, unconditional release. The urgency is not hypothetical either: the UK AI Security Institute recently found that leading open-weight models are only months behind the closed frontier on cyber capability, and allied agencies have warned that AI-enabled cyber threats are close.

The authors' own caveat is the one to lead with, and they state it without hedging: "This research is preliminary and has not been applied to production models at Anthropic." Nothing here has been tested at frontier scale, and it is unknown whether the isolation survives when a model is large enough for capabilities to be deeply entangled, or whether removing a module degrades unrelated downstream behavior. A 5-billion-parameter demonstration is a proof of concept, not a release mechanism. And the security question that follows is obvious: if a capability can be switched on, someone will try to switch it on without permission -- a detached module is a file, and files travel. Treat this as a promising research direction that makes a policy debate more tractable, not as a solution anyone can deploy today. Code and a paper accompany the post for anyone who wants to check the claims.

Primary source, verified: read the paper →

Ground Truth. (2026, July 29). Researchers built a model whose dangerous knowledge can be switched off like a module. Ground Truth. https://groundtruth.day/news/switchable-dangerous-knowledge-inside-one-model.html

@misc{groundtruth:switchable-dangerous-knowledge-inside-one-model,
  title  = {Researchers built a model whose dangerous knowledge can be switched off like a module},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {jul},
  url    = {https://groundtruth.day/news/switchable-dangerous-knowledge-inside-one-model.html}
}

Topics: cybersecurity · ai-security · alignment · access-control · red-teaming · open-weights