Anthropic Constitutional Classifiers++ Release

Anthropic has developed Constitutional Classifiers++, a next-generation safety system designed to protect large language models from jailbreaks—techniques used to circumvent safety guardrails to elicit harmful information, particularly regarding chemical, biological, radiological, or nuclear (CBRN) weapons. This new system significantly reduces the compute cost of safety monitoring to approximately 1% while eliminating the discovery of universal jailbreaks during testing.

Evolution from First-Generation Constitutional Classifiers

The original Constitutional Classifiers were safeguards trained on synthetic data derived from a "constitution" of natural language rules. While they reduced jailbreak success rates from 86% to 4.4% (blocking 95% of attacks), they introduced significant operational trade-offs:

Compute Costs: Increased compute costs by 23.7%.
False Refusals: Increased refusal rates on harmless queries by 0.38%.
Vulnerability: One universal jailbreak was discovered during a bug bounty program.

The Constitutional Classifiers++ Architecture

Constitutional Classifiers++ utilizes an ensemble defense and a "cascade architecture" to balance robustness with efficiency. The system operates in two stages:

Stage 1: Internal Probe Classifiers

The first stage uses linear probes to monitor Claude's internal activations. These probes identify patterns in the model's neural network that suggest harmful content before a response is formulated. Because these probes reuse existing computations, they are computationally inexpensive and harder for attackers to manipulate than final outputs.

Stage 2: Exchange Classifiers

If the internal probe flags an exchange as suspicious, it is escalated to a more powerful second-stage classifier. Unlike previous versions that screened inputs and outputs separately, this "exchange classifier" monitors the output in the context of its input. This allows the system to detect harmful intent that is only apparent when the input and output are viewed together, such as when an attacker uses code words (e.g., "food flavorings" for chemical reagents).

Performance and Benchmarks

In deployment on Claude Sonnet 4.5 traffic, the Constitutional Classifiers++ system demonstrated the following results:

Refusal Rate: The refusal rate on harmless queries dropped to 0.05%, representing an 87% decrease compared to the original system.
Compute Overhead: When applied to Claude Opus 4.0 traffic, the system adds roughly 1% compute overhead.
Robustness: Across 198,000 red-teaming attempts (over 1,700 cumulative hours), only one high-risk vulnerability was found, resulting in a detection rate of 0.005 per thousand queries. No universal jailbreaks were discovered.

Identified Vulnerabilities and Model Degradation

Despite these improvements, Anthropic identified two categories of attacks that remain challenging:

Reconstruction Attacks: These break harmful information into benign-looking segments that are reassembled later (e.g., embedding a query as functions across a codebase).
Output Obfuscation Attacks: These prompt the model to disguise outputs using metaphors, riddles, or innocuous substitutions.

Anthropic noted that these jailbreaking attempts often degrade the model's actual capabilities. On the GPQA Diamond benchmark (PhD-level science concepts), model performance dropped from 74% to as low as 32% when certain jailbreaking techniques were applied.

Future Research Directions

Anthropic is exploring several avenues to further harden the system, including:

Integrating classifier signals directly into the response generation process.
Training models to be more resistant to obfuscation.
Utilizing automated red-teaming to generate higher-quality training data for classifiers.