In today’s column, I examine an innovative approach to dealing with dangerous or malicious knowledge that is inside generative AI and large language models (LLMs). Here’s the deal. When an LLM is initially trained on data, everything gets baked into the complex web of knowledge that is being formulated within the AI. This includes innocent and important stuff and, unfortunately, also encompasses untoward content.

Users can then tap into the unsavory content and use it for evil purposes. Perhaps the AI contains instructions on how to make a deadly toxin. A user could get the AI to reveal something that we’d all prefer not to be readily available. The customary security or safety approach is to try to stop the user from accessing the info, but this is hard to do since the knowledge is spread throughout the internal elements of the LLM. This new innovative approach aims to isolate such dastardly content into discrete modules at the time of initial training, thus allowing an on/off switch to be used later to turn off those marked portions when needed. The issue at hand is whether this modularization of knowledge is feasible and doesn’t end up undermining the entire LLM, perhaps distorting the LLM into a fragmented and incoherent mess.

Let’s talk about it. This analysis of AI breakthroughs is part of my ongoing Forbes column coverage on the latest in AI, including identifying and explaining various impactful AI complexities (see the link here ).

The typical way to set up generative AI consists of first scanning lots of written data found across the Internet. All the well-known LLMs do this, including OpenAI ChatGPT and GPT-5, Anthropic Claude, Google Gemini, Microsoft Copilot, xAI Grok, and so on. The scanning allows the AI to pattern match on human writing. The patterning is stored inside a large-scale data structure that is somewhat based on aspects of human wetware (vaguely like our brains), doing so in an artificial neural network (ANN). For more details on how this all works, see my in-depth discussion at the link here .

By and large, the final LLM is one humongous numeric blob. It is a monolith. When you enter a prompt, the AI performs various mathematical and computational efforts to tap into the numeric blob. You might think of the monolith as a vast spider’s web. One piece of knowledge tends to link to another, and another, and so on. It is all intricately interconnected.

I bring this up because within that morass are patterns associated with human writing that contain dangerous and malicious aspects. A person can ask AI to tell them which chemicals will explode when combined and then proceed to potentially make an explosive device based on what the AI divulged. Or a user might tell the AI to identify a toxin that can be cheaply devised and easily spread. This type of patterned knowledge is likely captured here and there inside the AI numeric web-like structure.

I’ve frequently explored the multitude of AI safety precautions that AI makers are undertaking to try to prevent people from using the AI in underhanded ways; see my analyses at the link here and the link here . It’s a tough problem. An AI maker wants to stop users from getting into untoward territory, but at the same time, the AI maker doesn’t want to overly restrict usage of the AI.

For example, suppose someone is asking about chemicals that are toxic. Any such query could be immediately blocked by an AI safety detection that has been triggered based on the word “toxic”. The AI won’t even allow access to the numeric blob. Just rebuff the prompt and tell the user they cannot ask about that topic. Period, end of story.

A user might be clever enough to realize that an AI safety feature is going to try to stop their request. Therefore, the user asks about this or that chemical in an innocuous way. They get various properties associated with those chemicals. Amongst the cataloged properties, one factor might be the toxicity of the chemical. Voilà, the user has found a means to circumvent the AI safety feature.

A continual cat-and-mouse gambit is underway. AI safety features are adjusted, modified, and new ones are constantly being crafted. The evildoing users are also quick to adjust. They find sneakier ways to fool the AI safety features. It is a never-ending battle.

Distributed Or Dispersed Knowledge

The problem that we are wrestling with is that the traditional LLM is one big interconnecting spider web. The knowledge contained in the large-scale data structure is highly distributed. It is dispersed to all nooks and crannies. Somehow, it would be extremely handy to be able to focus and then parcel out the portions that have something that we consider to be sensitive or not to be readily revealed.

If we could parcel out those aspects, we could seek to isolate them to particular segments, which we will refer to as modules. A module might have facets about toxins. Another module might have facets about explosives. We will have a much easier time managing things, readily switching on/off access to these modules. The hope is we can take an otherwise monolithic model and reshape it into a central core that has any number of modules that we believe ought to be crafted.

The modules will be tightly controlled. Users will have access to the central core. When they bring up something that potentially involves knowledge in a module, the request or indication can be given close inspection. Since the module is going to be under lock and key, it won’t be easy to slide into one by happenstance or by deviousness.

On a normal basis, the users won’t even know that the entire knowledge compendium has been shaped in this fashion. The AI can take care of things on their behalf. A user wouldn’t need to say “let me access module X or module Y” since this is being managed by the LLM itself. The AI will simply rebuff requests that veer into a module when the user isn’t supposed to have access to what is contained therein. Access will be allowed when the AI determines it is appropriate to do so.

Going Modular Is Challenging

We seem to have two major choices regarding the modular construction situation:

  • (1) During training. Parcel out the sensitive stuff during the initial data training of the AI and fill in the respective modules accordingly.
  • (2) Post-training. Parcel out the sensitive stuff after the initial data training has occurred and do so before we allow the AI to be put into active use with the public.

You could do both, though that raises some additional complications. For the sake of discussion, let’s pick one choice. If we choose the post-training route, this could be problematic because the monolith is already created and we are trying to shoehorn modules into it. The horse is already out of the barn.

The approach that seems more straightforward would be to craft the modules during the initial training of the LLM. We could have the AI inspect what’s coming in during the scanning and attempt to create and fill in various modules that we beforehand guided the AI to pursue. After the initial data training is completed, we could then perform tests to see if the whole conglomeration is working well.

There isn’t a guarantee that the construction will work well. Maybe we inadvertently vented too much on one topic into a specific module. It is overplayed. Perhaps we failed to detect and route sufficient aspects into a different module. It was underplayed. The wrong stuff could have gotten into this or that module. I think you can see that the modular angle has lots of upsides and downsides.

New Research Study On This

Researchers at Anthropic and AE Studio recently posted a research paper entitled “Modular Pretraining Enables Access Control” by Ethan Roland, Murat Cubuktepe, Erick Martinez, Stijn Servaes, Keenan Pepper, Mike Vaiana, Diogo Schwerz de Lucena, Judd Rosenblatt, Addie Foote, Anthropic website, July 8, 2026, and these salient points were made (excerpts):

  • “Frontier AI models have knowledge that could be misused for nefarious purposes. To address this risk, we introduce Gradient Routed Auxiliary Modules (GRAM), a method for isolating dangerous knowledge to specific modules within a language model.”
  • “These modules can be switched on or off to control what the model knows, making it possible to restrict or extend access to the most sensitive model capabilities based on user need and trust.”
  • “In our experiments, we find evidence that a single model trained in this way can approximate multiple models, each trained with a different category of dangerous data filtered out, and this ability holds for models ranging from 50M to 5B parameters.”
  • “This research is preliminary and has not been applied to production models at Anthropic.”

As per the points noted above, the researchers went ahead and did some experiments to pilot a modular approach. They opted to name their approach GRAM, gradient routed auxiliary modules. Notice that they did this on a preliminary basis, and they urge that additional research and exploration be undertaken on this budding topic.

Divide Into Separate LLMs

In the third bullet point, you might have keenly observed that emphasis was made that this was still a single model, though it approximated the use of multiple models. That might have got you thinking, why go to the trouble of trying to keep this contained in one model? In other words, just bite the bullet and create entirely separate LLMs. Let’s pursue that thought.

Suppose you create an LLM that has a bounded body of knowledge that you believe is okay for all to access. You have kept out of the LLM any of the malicious stuff. Meanwhile, you create a different LLM that has stuff about toxins. You create a separate LLM about explosives. You keep creating separate LLMs for each topic that you believe has something malicious or dangerous in it.

When a user accesses the mainstay LLM, the AI will see if your prompt has anything to do with one or more modules. If so, the mainstay LLM will externally reach out to those other modules. Those modules will do their thing and respond to the mainstay LLM. The mainstay LLM will then respond to the user.

Several issues arise. One issue is that the connection of the mainstay to the external modules is likely to occur via an API (application programming interface). Each access to a module is going to be somewhat burdensome. This adds time delays. It could bring forth failures when making the connections. Having the modules directly inside the LLM is going to be a much smoother operation. Our preference would be to go on that route if feasible and avoid going on the externally separate LLMs pathway.

For those of you versed in building and setting up LLMs, you might enjoy and find quite informative the specific methods used to devise GRAM. I’ll give you a quick taste. Make sure to read the research paper if you want the details.

The researchers went ahead and added additional artificial neurons to each layer of a standard ANN structure. Scanning during the initial data training will look to see if the text aspects are considered okay for the central core of the LLM. That’s business as usual.

When something is flagged as possibly belonging in a module, which would be text that they describe as having a dual-use, the LLM will only allow that pertinent module to learn from the text. The other neurons’ weights are momentarily frozen. This keeps the matter from diffusing throughout the rest of t

As they pointed out: “During training, when the model encounters general-purpose text, it learns in the usual way. But when it encounters text from a dual-use category -- virology, for instance -- the rules change: the model can use its general knowledge to make predictions, but only the virology module is allowed to learn from that text.” And this allied point: “The consequence is that virology knowledge accumulates in the virology module rather than diffusing across the whole network.”

Many Questions To Address

One question is whether this can scale up to the size of popular LLMs. A larger-sized LLM would tend to have hundreds of billions of parameters. The experiments done in this instance were on LLMs of 50M to 5B in size. The researchers acknowledged that scaling is a needed next step in these innovative explorations.

Consider the array of questions that come to mind. Could there be a kind of “module explosion” in the sense that a scaled LLM ends up with an enormous number of modules, and if so, is that serviceably manageable? Will performance degradations occur in the door checks regarding whether a module can or cannot be accessed? Will cross-module reasoning be inhibited even when it is useful and necessary to happen? Etc.

I’ve got a special twist that you might find surprising. Are you sitting down? I hope so. In one sense, it could be compellingly argued that this is the classic gambit of putting all your bad eggs in one basket. If an evildoer can crack into the module on toxins, they might be elated that they didn’t need to search across the LLM to find that volatile content. By design, it was put into a handy-dandy module. That makes your head spin. Are modules a great benefit or a potential gift of the worst knowledge that is neatly tied with a shiny bow?

The Monolith Is Taking A Beating

Overall, advances in AI are stepwise opting to revisit whether the gigantic monolith is the best or right structure for LLMs. Maybe it has been the easy route. It has worked well. We might need to rethink our traditions. The monolith, as employed commonly today, could be a limiting factor that traps us into not making the next great forward advancement in AI.

As the famous essayist and philosopher Ralph Waldo Emerson once remarked: “Unless you try to do something beyond what you have already mastered, you will never grow.” That’s a crucial motto for those with an open mind toward advancing AI.