Researchers at Anthropic and AE Studio have published a preliminary study introducing a method called Gradient Routed Auxiliary Modules (GRAM) to isolate dangerous knowledge in large language models into discrete, switchable modules during initial training, aiming to improve AI safety by allowing on/off control over sensitive content. The research paper, titled "Modular Pretraining Enables Access Control," was posted on Anthropic's website on July 8, 2026, and has since sparked analysis from AI scientists and commentators.
The core idea is deceptively simple. Instead of letting a language model absorb all knowledge into a tangled web of interconnected neurons, GRAM routes sensitive information into dedicated compartments. These compartments can then be switched on or off, giving operators granular control over what the model knows at any given moment. The approach represents a fundamental departure from the monolithic architecture that underpins today's most prominent AI systems.
The Problem with Monolithic AI
Traditional large language models are monolithic structures. Knowledge is distributed across the entire network, with no clear boundaries separating benign facts from dangerous instructions. This is a direct consequence of how these systems are trained. Generative AI models like OpenAI's ChatGPT and GPT-5, Anthropic's Claude, Google's Gemini, Microsoft's Copilot, and xAI's Grok are trained on vast amounts of internet text data. They store this knowledge in a large-scale artificial neural network (ANN) structure, and the final result is a monolithic numeric blob with interconnected knowledge.
This architecture creates a serious safety problem. Dangerous knowledge, such as instructions for making toxins or explosives, becomes embedded throughout the network. It is not isolated in a single location that can be excised. Current safety measures attempt to block access to dangerous content by filtering prompts and responses. However, users can circumvent these blocks through indirect queries. They can ask for chemical combinations that explode or cheaply devised toxins, phrasing their requests in ways that evade detection systems.
The cat-and-mouse game between AI safety features and malicious users is well documented. Every time a safety filter is strengthened, someone finds a new way around it. The monolithic nature of the models makes this problem particularly intractable because the knowledge is always there, waiting to be accessed through the right combination of words.
How GRAM Works
The GRAM method tackles this problem at the root. Instead of trying to block access to dangerous knowledge after training, it prevents that knowledge from diffusing across the entire network in the first place. The approach adds additional artificial neurons to each layer of the ANN. These extra neurons form the auxiliary modules that give the method its name.
During training, general-purpose text is learned in the usual way. The model processes this information and updates its weights normally. But when the training data contains dual-use text, such as virology information that could be used for both legitimate research and bioweapon development, something different happens. The model routes this text to a specific module, and only that module's weights are updated. Other weights remain frozen.
The consequence is that virology knowledge accumulates in the virology module rather than diffusing across the whole network. This prevents knowledge from spreading throughout the model, keeping it contained in a controlled location. The researchers describe the mechanism in their paper: "Frontier AI models have knowledge that could be misused for nefarious purposes. To address this risk, we introduce Gradient Routed Auxiliary Modules (GRAM), a method for isolating dangerous knowledge to specific modules within a language model."
The modular design offers a clear operational advantage. "These modules can be switched on or off to control what the model knows, making it possible to restrict or extend access to the most sensitive model capabilities based on user need and trust," the researchers wrote. A user with legitimate research needs could be granted access to the virology module. A casual user asking about harmless topics would never trigger it.
The researchers also explained how the architecture handles sensitive content in practice. "(GRAM) would allow specific sensitive content to accumulate in dedicated sections, enabling an" operator to manage access without affecting the rest of the model's knowledge. This design choice is central to the method's promise of granular control.
Experimental Results and Limitations
The research team conducted experiments to test whether this approach actually works. They trained models using the GRAM method and then compared their performance against multiple models trained with different categories of dangerous data filtered out. The results were encouraging. "In our experiments, we find evidence that a single model trained in this way can approximate multiple models, each trained with a different category of dangerous data filtered out, and this ability holds for models ranging from 50M to 5B parameters," the researchers reported.
This is a significant finding. It suggests that a single modular model can replicate the behavior of several specialized models, each with different safety restrictions. The ability held across a range of model sizes, from 50 million parameters up to 5 billion parameters. That range covers many practical applications, though it falls far short of production-scale systems.
The researchers are careful to note the limits of their work. "This research is preliminary and has not been applied to production models at Anthropic," they stated. The method has not yet been tested on the hundreds of billions of parameters that characterize frontier models. Scaling to production-sized LLMs is a needed next step, and it is uncertain whether the approach will hold up at that scale.
There are also potential issues that could emerge at scale. Module explosion is a concern. If every category of dangerous knowledge requires its own module, the number of modules could grow unwieldy. Performance degradation in access checks is another risk. Every time a user request comes in, the system must determine which modules to activate. This adds computational overhead and could slow response times. There is also the risk of inhibiting cross-module reasoning. Some legitimate tasks require combining knowledge from multiple domains, and strict modularization could make that harder.
The Paradox of Concentration
The GRAM approach has a paradoxical quality that has not escaped notice. Concentrating dangerous knowledge into modules could make it easier for malicious actors to access if they crack the module. Instead of having to navigate a diffuse network of interconnected knowledge, an attacker would only need to break into a single, well-defined compartment.
This concern was raised in a Forbes article by Lance Eliot, an AI scientist, consultant, and Forbes contributor, published on August 17, 2026, at 03:15am EDT. Eliot's analysis, part of his ongoing Forbes column on AI, examines the feasibility of modularizing dangerous knowledge in LLMs. He notes that the approach could be a "gift" to evildoers if the modules are cracked. The article includes links to his previous analyses on AI safety and LLM setup.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
The researchers and analysts also consider the alternative of creating separate LLMs for each dangerous topic. This would avoid the concentration problem, but it introduces its own issues. API delays and failures become more likely when multiple models must be queried. Managing a fleet of specialized models is operationally complex. The GRAM approach offers a middle ground: one model with switchable internal states.
Eliot's article suggests that modules would be tightly controlled and users would not know they exist. This secrecy is intended to prevent attackers from targeting specific modules. But it also raises questions about transparency and accountability. If users do not know what knowledge is being withheld, they cannot evaluate whether the restrictions are appropriate.
Rethinking AI Architecture
The GRAM research has implications beyond immediate safety applications. It challenges a fundamental assumption about how language models should be structured. The article suggests that the monolithic architecture may not be the best structure for LLMs. The monolith might be a limiting factor for AI advancement.
There are two main choices for modularization: during training or post-training. Post-training modularization is considered problematic because the monolith is already formed. Once knowledge has diffused across the entire network, it is nearly impossible to extract it into clean compartments. During training, however, the model can route dual-use text to specific modules while freezing other weights. This is the approach GRAM takes.
The research team includes nine co-authors: Ethan Roland, Murat Cubuktepe, Erick Martinez, Stijn Servaes, Keenan Pepper, Mike Vaiana, Diogo Schwerz de Lucena, Judd Rosenblatt, and Addie Foote. Roland is the lead author. The team's work represents a novel and innovative approach to AI safety, though it requires further research before it can be deployed in production systems.
Eliot's analysis frames the research within the broader context of AI safety. He discusses the trade-offs of modularization versus separate LLMs. He raises questions about scaling, module explosion, performance, and cross-module reasoning. He points out the paradox that concentrating dangerous data might make it easier for malicious actors to access. And he suggests that the monolithic architecture may need to be reconsidered for future AI advances.
The research also touches on the nature of knowledge itself. In a monolithic model, knowledge is emergent. It arises from the complex interactions of billions of parameters. No single neuron or layer contains a discrete fact. This makes the models powerful but opaque. Modularization would make them more transparent, but potentially less capable. The trade-off between interpretability and performance is a central tension in AI research.
The GRAM method is one attempt to resolve this tension. By isolating dangerous knowledge, it creates islands of interpretability within a sea of complexity. These islands can be controlled, monitored, and switched off when necessary. The rest of the model remains free to learn and reason without the burden of dangerous knowledge diffusing through its weights.
The research is preliminary, and the path to production is uncertain. Scaling to hundreds of billions of parameters is a formidable challenge. The potential issues of module explosion, performance degradation, and inhibited cross-module reasoning are real. And the paradox of concentration means that the approach could create new vulnerabilities even as it closes old ones.
Still, the direction is clear. The monolithic architecture that has dominated AI for years may not be the final word. Researchers are exploring alternatives that offer greater control and safety. The GRAM method is an early step in that direction, and its results are promising enough to warrant further investigation.
Eliot's article concludes with a quote from Ralph Waldo Emerson, the essayist and philosopher: "Unless you try to do something beyond what you have already mastered, you will never grow." The sentiment applies to the researchers pushing the boundaries of AI architecture, and to the field as a whole as it grapples with the challenges of making powerful models safe.
The research was published on July 8, 2026, and the Forbes analysis followed on August 17, 2026. Both dates mark milestones in an ongoing conversation about how to build AI systems that are both powerful and safe. The GRAM method is not a final answer, but it is a meaningful contribution to that conversation.
As the field moves forward, the questions raised by this research will become increasingly important. How do we control what AI models know? How do we prevent dangerous knowledge from being misused? How do we build systems that are transparent enough to trust and powerful enough to be useful? The GRAM method offers one possible path. Whether it leads to production deployment or inspires better approaches, it has already expanded the range of possibilities.
The researchers at Anthropic and AE Studio have opened a new line of inquiry. Their work on modular pretraining suggests that the way we train AI models can be fundamentally rethought. Instead of accepting the monolithic blob as inevitable, we can design architectures that separate knowledge into controllable components. This is a significant conceptual shift, and its implications extend far beyond the specific method they have proposed.
For now, the GRAM method remains a research curiosity. It has been demonstrated on models up to 5 billion parameters, but not on the frontier systems that dominate the AI landscape. It has not been applied to production models at Anthropic. And it faces significant challenges before it could be deployed at scale.
But the idea is compelling. A language model that can switch off its knowledge of bioweapons or explosives is inherently safer than one that cannot. A model that can grant access to sensitive knowledge based on user trust is more flexible than one that must either allow all access or none. The GRAM method points toward a future where AI safety is built into the architecture rather than bolted on after the fact.
That future is not here yet. The research is preliminary, the scaling challenges are real, and the paradoxes are unresolved. But the direction is clear, and the first steps have been taken. The rest will depend on the research community's willingness to explore new architectures and its ability to solve the problems that arise along the way.
The GRAM method is a reminder that the tools we use to build AI are not fixed. They can be changed, improved, and reimagined. The monolithic architecture that dominates today is a choice, not a necessity. And as the researchers have shown, there are alternatives worth exploring.