Начинается внедрение Вредоносных Знаний Искусственного Интеллекта В Модули С возможностью Включения / Выключения

В сегодняшней статье я рассмотрю инновационный подход к работе с опасными или вредоносными знаниями, которые содержатся в генеративном ИИ и больших языковых моделях (LLM). Вот в чем дело. Когда LLM изначально обучается работе с данными, все становится частью сложной сети знаний, которая формируется в рамках искусственного интеллекта. Это включает в себя невинные и важные материалы и, к сожалению, также включает в себя нежелательный контент.

Затем пользователи могут получить доступ к сомнительному контенту и использовать его в дурных целях. Возможно, ИИ содержит инструкции о том, как создать смертельный токсин. Пользователь может заставить ИИ раскрыть что-то, что мы все предпочли бы скрыть от общественности. Обычный подход к обеспечению безопасности заключается в том, чтобы попытаться помешать пользователю получить доступ к информации, но это трудно сделать, поскольку знания распространяются по всем внутренним элементам LLM. Этот новый инновационный подход направлен на то, чтобы выделить такой опасный контент в отдельные модули во время первоначального обучения, что позволяет позже использовать переключатель включения / выключения для отключения этих отмеченных фрагментов при необходимости. Главный вопрос заключается в том, осуществима ли такая модульность знаний и не приведет ли это в конечном итоге к подрыву всего LLM, возможно, превратив LLM в фрагментированную и бессвязную кашу.

Давайте поговорим об этом. Этот анализ достижений в области ИИ является частью моей постоянной колонки в Forbes, посвященной последним достижениям в области ИИ, в том числе выявлению и объяснению различных важных сложностей ИИ (смотрите ссылку здесь).

Типичный способ настройки генеративного ИИ заключается в предварительном сканировании большого количества письменных данных, найденных в Интернете. Это делают все известные LLM, в том числе OpenAI ChatGPT и GPT-5, Anthropic Claude, Google Gemini, Microsoft Copilot, xAI Grok и т.д. Сканирование позволяет ИИ сопоставлять шаблон с текстом, написанным человеком. Структура данных хранится в крупномасштабной структуре данных, которая в некоторой степени основана на особенностях человеческого программного обеспечения (отдаленно похожего на наш мозг), в искусственной нейронной сети (ANN). Для получения более подробной информации о том, как все это работает, смотрите мое подробное обсуждение наthe link here.

By and large, the final LLM is one humongous numeric blob. It is a monolith. When you enter a prompt, the AI performs various mathematical and computational efforts to tap into the numeric blob. You might think of the monolith as a vast spider’s web. One piece of knowledge tends to link to another, and another, and so on. It is all intricately interconnected.

I bring this up because within that morass are patterns associated with human writing that contain dangerous and malicious aspects. A person can ask AI to tell them which chemicals will explode when combined and then proceed to potentially make an explosive device based on what the AI divulged. Or a user might tell the AI to identify a toxin that can be cheaply devised and easily spread. This type of patterned knowledge is likely captured here and there inside the AI numeric web-like structure.

I’ve frequently explored the multitude of AI safety precautions that AI makers are undertaking to try to prevent people from using the AI in underhanded ways; see my analyses at the link here and the link here. It’s a tough problem. An AI maker wants to stop users from getting into untoward territory, but at the same time, the AI maker doesn’t want to overly restrict usage of the AI.

For example, suppose someone is asking about chemicals that are toxic. Any such query could be immediately blocked by an AI safety detection that has been triggered based on the word "toxic". The AI won’t even allow access to the numeric blob. Just rebuff the prompt and tell the user they cannot ask about that topic. Period, end of story.

A user might be clever enough to realize that an AI safety feature is going to try to stop their request. Therefore, the user asks about this or that chemical in an innocuous way. They get various properties associated with those chemicals. Amongst the cataloged properties, one factor might be the toxicity of the chemical. Voilà, the user has found a means to circumvent the AI safety feature.

A continual cat-and-mouse gambit is underway. AI safety features are adjusted, modified, and new ones are constantly being crafted. The evildoing users are also quick to adjust. They find sneakier ways to fool the AI safety features. It is a never-ending battle.

The problem that we are wrestling with is that the traditional LLM is one big interconnecting spider web. The knowledge contained in the large-scale data structure is highly distributed. It is dispersed to all nooks and crannies. Somehow, it would be extremely handy to be able to focus and then parcel out the portions that have something that we consider to be sensitive or not to be readily revealed.

If we could parcel out those aspects, we could seek to isolate them to particular segments, which we will refer to as modules. A module might have facets about toxins. Another module might have facets about explosives. We will have a much easier time managing things, readily switching on/off access to these modules. The hope is we can take an otherwise monolithic model and reshape it into a central core that has any number of modules that we believe ought to be crafted.

The modules will be tightly controlled. Users will have access to the central core. When they bring up something that potentially involves knowledge in a module, the request or indication can be given close inspection. Since the module is going to be under lock and key, it won’t be easy to slide into one by happenstance or by deviousness.

On a normal basis, the users won’t even know that the entire knowledge compendium has been shaped in this fashion. The AI can take care of things on their behalf. A user wouldn’t need to say "let me access module X or module Y" since this is being managed by the LLM itself. The AI will simply rebuff requests that veer into a module when the user isn’t supposed to have access to what is contained therein. Access will be allowed when the AI determines it is appropriate to do so.

We seem to have two major choices regarding the modular construction situation:

• (1) During training. Parcel out the sensitive stuff during the initial data training of the AI and fill in the respective modules accordingly.
• (2) Post-training. Parcel out the sensitive stuff after the initial data training has occurred and do so before we allow the AI to be put into active use with the public.

You could do both, though that raises some additional complications. For the sake of discussion, let’s pick one choice. If we choose the post-training route, this could be problematic because the monolith is already created and we are trying to shoehorn modules into it. The horse is already out of the barn.

The approach that seems more straightforward would be to craft the modules during the initial training of the LLM. We could have the AI inspect what’s coming in during the scanning and attempt to create and fill in various modules that we beforehand guided the AI to pursue. After the initial data training is completed, we could then perform tests to see if the whole conglomeration is working well.

There isn’t a guarantee that the construction will work well. Maybe we inadvertently vented too much on one topic into a specific module. It is overplayed. Perhaps we failed to detect and route sufficient aspects into a different module. It was underplayed. The wrong stuff could have gotten into this or that module. I think you can see that the modular angle has lots of upsides and downsides.

Researchers at Anthropic and AE Studio recently posted a research paper entitled "Modular Pretraining Enables Access Control" by Ethan Roland, Murat Cubuktepe, Erick Martinez, Stijn Servaes, Keenan Pepper, Mike Vaiana, Diogo Schwerz de Lucena, Judd Rosenblatt, Addie Foote, Anthropic website, July 8, 2026, and these salient points were made (excerpts):

• "Frontier AI models have knowledge that could be misused for nefarious purposes. To address this risk, we introduce Gradient Routed Auxiliary Modules (GRAM), a method for isolating dangerous knowledge to specific modules within a language model."
• "These modules can be switched on or off to control what the model knows, making it possible to restrict or extend access to the most sensitive model capabilities based on user need and trust."
• "In our experiments, we find evidence that a single model trained in this way can approximate multiple models, each trained with a different category of dangerous data filtered out, and this ability holds for models ranging from 50M to 5B parameters."
• "This research is preliminary and has not been applied to production models at Anthropic."

As per the points noted above, the researchers went ahead and did some experiments to pilot a modular approach. They opted to name their approach GRAM, gradient routed auxiliary modules. Notice that they did this on a preliminary basis, and they urge that additional research and exploration be undertaken on this budding topic.

In the third bullet point, you might have keenly observed that emphasis was made that this was still a single model, though it approximated the use of multiple models. That might have got you thinking, why go to the trouble of trying to keep this contained in one model? In other words, just bite the bullet and create entirely separate LLMs. Let’s pursue that thought.

Suppose you create an LLM that has a bounded body of knowledge that you believe is okay for all to access. You have kept out of the LLM any of the malicious stuff. Meanwhile, you create a different LLM that has stuff about toxins. You create a separate LLM about explosives. You keep creating separate LLMs for each topic that you believe has something malicious or dangerous in it.

When a user accesses the mainstay LLM, the AI will see if your prompt has anything to do with one or more modules. If so, the mainstay LLM will externally reach out to those other modules. Those modules will do their thing and respond to the mainstay LLM. The mainstay LLM will then respond to the user.

Several issues arise. One issue is that the connection of the mainstay to the external modules is likely to occur via an API (application programming interface). Each access to a module is going to be somewhat burdensome. This adds time delays. It could bring forth failures when making the connections. Having the modules directly inside the LLM is going to be a much smoother operation. Our preference would be to go on that route if feasible and avoid going on the externally separate LLMs pathway.

For those of you versed in building and setting up LLMs, you might enjoy and find quite informative the specific methods used to devise GRAM. I’ll give you a quick taste. Make sure to read the research paper if you want the details.

The researchers went ahead and added additional artificial neurons to each layer of a standard ANN structure. Scanning during the initial data training will look to see if the text aspects are considered okay for the central core of the LLM. That’s business as usual.

When something is flagged as possibly belonging in a module, which would be text that they describe as having a dual-use, the LLM will only allow that pertinent module to learn from the text. The other neurons’ weights are momentarily frozen. This keeps the matter from diffusing throughout the rest of t

As they pointed out: "During training, when the model encounters general-purpose text, it learns in the usual way. But when it encounters text from a dual-use category -- virology, for instance -- the rules change: the model can use its general knowledge to make predictions, but only the virology module is allowed to learn from that text." And this allied point: "The consequence is that virology knowledge accumulates in the virology module rather than diffusing across the whole network."

One question is whether this can scale up to the size of popular LLMs. A larger-sized LLM would tend to have hundreds of billions of parameters. The experiments done in this instance were on LLMs of 50M to 5B in size. The researchers acknowledged that scaling is a needed next step in these innovative explorations.

Consider the array of questions that come to mind. Could there be a kind of "module explosion" in the sense that a scaled LLM ends up with an enormous number of modules, and if so, is that serviceably manageable? Will performance degradations occur in the door checks regarding whether a module can or cannot be accessed? Will cross-module reasoning be inhibited even when it is useful and necessary to happen? Etc.

I’ve got a special twist that you might find surprising. Are you sitting down? I hope so. In one sense, it could be compellingly argued that this is the classic gambit of putting all your bad eggs in one basket. If an evildoer can crack into the module on toxins, they might be elated that they didn’t need to search across the LLM to find that volatile content. By design, it was put into a handy-dandy module. That makes your head spin. Are modules a great benefit or a potential gift of the worst knowledge that is neatly tied with a shiny bow?

Overall, advances in AI are stepwise opting to revisit whether the gigantic monolith is the best or right structure for LLMs. Maybe it has been the easy route. It has worked well. We might need to rethink our traditions. The monolith, as employed commonly today, could be a limiting factor that traps us into not making the next great forward advancement in AI.

As the famous essayist and philosopher Ralph Waldo Emerson once remarked: "Unless you try to do something beyond what you have already mastered, you will never grow." That’s a crucial motto for those with an open mind toward advancing AI.