Next-generation Constitutional Classifiers: More efficient protection against universal jailbreaks
Anthropic says its new Constitutional Classifiers system blocks jailbreaks more effectively while using about 1% extra compute. It also lowers false refusals on harmless prompts.
Intelligence analysis by GPT-5.4 Mini
Anthropic says it has built a cheaper, stronger successor to its Constitutional Classifiers for spotting jailbreak attempts. The new system combines a lightweight internal probe, a cascade of classifiers, and an exchange-level model that checks conversation context, not just outputs.
Anthropic built a smarter security guard for its AI. Instead of only checking the final answer, it watches the whole conversation and uses a quick first check before calling in a stronger one, like a bouncer who spots trouble early.
Analysis
What changed
Anthropic says large language models still face jailbreaks, including universal jailbreaks that work across many prompts. Its first Constitutional Classifiers system was a big step forward: compared with an unguarded model, it reduced jailbreak success from 86% to 4.4%, but it also increased compute cost by 23.7% and raised refusal rates on harmless queries by 0.38%.
The new system
The new version, Constitutional Classifiers++, is described as an ensemble defense. Anthropic says it uses a cheap probe that looks at Claude’s internal activations to screen all traffic first. If that probe sees something suspicious, the exchange is escalated to a stronger classifier. Unlike the earlier setup, this classifier evaluates both sides of a conversation together, which helps when attackers try to hide harmful intent by splitting it across input and output.
Anthropic also describes a cascade architecture so only flagged exchanges reach the more expensive stage. The company says this reduces cost while avoiding unnecessary refusals, because suspicious but possibly benign requests can be escalated instead of blocked outright.
Remaining weaknesses and results
The article says earlier systems were still vulnerable to reconstruction attacks, where harmful material is broken into pieces and reassembled, and output obfuscation attacks, where dangerous content is disguised with harmless wording, metaphors, or riddles. Anthropic says these attacks can also damage model capability: on GPQA Diamond, performance fell from 74% to as low as 32% under some jailbreaks.
For the new system, Anthropic says red teaming has found no universal jailbreak yet. It reports 1,700+ hours of red-teaming across 198,000 attempts, one high-risk vulnerability, a detection rate of 0.005 per thousand queries, and a refusal rate of 0.05% on harmless queries during one month of deployment on Claude Sonnet 4.5 traffic. The company says the system adds roughly 1% compute overhead on Claude Opus 4.0 traffic.
Key points
- Anthropic says the first generation of Constitutional Classifiers cut jailbreak success from 86% to 4.4%, but added cost and some false refusals.
- The new version uses a lightweight probe, a cascade architecture, and an exchange classifier that sees both sides of the conversation.
- Anthropic says the new system has the lowest successful attack rate it has tested so far and no universal jailbreak has been found.
- The company reports 1,700+ hours of red-teaming across 198,000 attempts and only one high-risk vulnerability.
- Anthropic says the system adds about 1% compute overhead while reducing harmless-query refusals to 0.05% in one deployment month.
If the system works as described, it could make Claude much harder to trick into helping with dangerous requests. Anthropic also says it lowers false refusals, which means safer behavior without as much frustration for normal users.
The article still says jailbreaks evolve, and earlier defenses were vulnerable to attacks that hide harmful intent in pieces or disguise it in harmless language. Anthropic also notes that attackers may still discover new strategies that preserve model capability while bypassing safeguards.
