Modular Pretraining Enables Access Control

Alignment Science Blog

Modular Pretraining Enables Access Control

Ethan Roland¹*, Murat Cubuktepe¹*, Erick Martinez¹*July 8, 2026

Stijn Servaes¹, Keenan Pepper¹, Mike Vaiana¹, Diogo Schwerz de Lucena¹, Judd Rosenblatt¹

Addie Foote²

Cem Anil³, Alex Cloud³

¹ AE Studio; ² Independent; ³ Anthropic; *Equal contribution

tl;dr<br>Frontier AI models have knowledge that could be misused for nefarious purposes. To address this risk, we introduce Gradient Routed Auxiliary Modules (GRAM), a method for isolating dangerous knowledge to specific modules within a language model. These modules can be switched on or off to control what the model knows, making it possible to restrict or extend access to the most sensitive model capabilities based on user need and trust. In our experiments, we find evidence that a single model trained in this way can approximate multiple models, each trained with a different category of dangerous data filtered out, and this ability holds for models ranging from 50M to 5B parameters. This research is preliminary and has not been applied to production models at Anthropic.

📄 Paper, 💻 Code

This work was done at AE Studio, in collaboration with Anthropic.

Introduction

One of the major threats from frontier AI models is the misuse of legitimately helpful knowledge for harmful tasks, such as creating biological weapons or attacking critical infrastructure. AI companies already manage this risk with a mix of defenses: training models to refuse harmful requests, running classifiers to detect and reject dangerous queries, and restricting which users can access which models through vetting and tiered deployment. Each has drawbacks. Refusals and classifiers are behavioral layers on top of knowledge the model still has; they can be jailbroken and must be retuned for every release. Tiered access works at the level of whole models and whole accounts, so it forces a coarse trade-off: either a user gets every capability the model has, or they get a weaker model across the board.

An alternative approach is access control at the level of individual capabilities. For example, a deployment that includes advanced virology knowledge for a vetted biosecurity lab and excludes it everywhere else, with general performance unchanged in both cases. The most direct route to achieve this would be to train separate models on separately filtered datasets, reserving the most capable model variants for high-trust settings. But training multiple frontier models is prohibitively expensive.

To address this need, we develop Gradient-Routed Auxiliary Modules (GRAM), a method that approximates the performance of multiple data filtered models at the cost of a single training run. GRAM builds on prior ideas including DEMix layers, SGTM, and gradient routing. Our contribution is to develop these ideas for better performance and to test them in a larger and more realistic setting than prior work. Readers may also be interested in NULLs, a similar method developed concurrently. We compare against post-hoc unlearning methods (designed to remove concepts from an existing model) and against LoRA, a competitive baseline that fine-tunes a filtered model to add dual use capabilities back in.

This post covers our main lessons learned:

GRAM approximates separately trained, data filtered models in a single run. On a synthetic dataset of children's stories, we show that GRAM trains a 26M-parameter model where knowledge of specific story topics can be switched on or off. Switching a topic off performs similarly to training a model from scratch on data with that topic filtered out.<br>Both GRAM and LoRA isolate capabilities from real-world dual use data. We train an 800M-parameter language model on a combination of general text, code, and scientific papers. We additionally train on data from four dual use domains: virology, cybersecurity, nuclear physics, and specialized code. We use GRAM and LoRA to confine the dual use data to auxiliary modules. A single GRAM model can be reconfigured to match the performance of any of five distinct filtered models trained on different data.<br>Capability removal improves with scale. Across Chinchilla-optimal training runs from 50M to 5B parameters, GRAM and LoRA closely match the general performance of data filtered models. Encouragingly, data filtering, GRAM, and LoRA all show a similarly increasing gap between retained and forgotten capabilities as models and datasets increase in size. (Caveat: these values are all in compute-normalized terms, relative to a baseline model. In absolute terms, the bigger models are still better at the forgotten capabilities.)<br>GRAM may have advantages over alternatives, including LoRA. We show preliminary evidence that GRAM performs better at novel combinations of capabilities. We also show that, in a more realistic scenario where labeled data is sparse, GRAM achieves better capability removal than both LoRA and data...