Constitutional Classifiers++: Efficient Production-Grade Defenses Against Universal Jailbreaks

Constitutional Classifiers are Anthropic's defense against universal jailbreaks: prompting strategies that get a model to answer most questions in a dangerous domain, here chemical, biological, radiological and nuclear (CBRN) weapons. The previous version used an input classifier plus a separate output classifier, cost 23% extra compute and refused 0.38% of production traffic.

Further red teaming found two ways around it. Reconstruction attacks scatter a request across a long, harmless-looking context and have the model reassemble it. Output obfuscation has the model answer in substitutions or metaphors that look harmless unless you also read the prompt. Both degrade the model's capability, but by varying amounts, so better versions are likely.

The paper makes three changes. An exchange classifier judges the output in the context of its input, token batch by token batch as the reply streams. A two-stage cascade runs a cheap classifier on everything and escalates only suspicious exchanges to an expensive one, which can therefore flag freely. And linear probes on the protected model's own activations serve as an almost free first stage, ensembled with an external classifier fine-tuned from Claude Haiku 4.5.

The production system uses 3.5% of the old system's compute, refused 0.05% of production traffic during a month of shadow deployment on Claude Sonnet 4.5, and had the lowest rate of high-risk vulnerabilities in about 1,736 hours of red teaming. No red teamer found a universal jailbreak that answered all eight target questions at half the detail of an unguarded model.

Guardrail projects usually die on cost and false positives, not on the security idea. This paper is a rare public account of a large provider designing a classifier system against both constraints at once, with numbers for each.

Judge the exchange, not the message. Checking outputs without their inputs misses anything that's only harmful in context. The same holds for a customer's data-leak or policy classifier.

Cascades let the first stage over-flag. Because a first-stage flag means "look closer", not "refuse", a weak, cheap model is good enough there. It's the same economics as model routing, applied to safety.

Know what you can and can't build. Activation probes need access to the protected model's internals, so a team calling a hosted API can't copy that part. The cascade, the exchange framing and the streaming evaluation all transfer to any stack.