Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks

jailbreaksclassifierslinear probescascadesred teamingcbrn

Cunningham, Wei et al. report attacks that got past the first Constitutional Classifiers and replace its separate input and output classifiers with exchange classifiers, a two-stage cascade and linear probes on the guarded model's activations; the final system flagged 0.05% of production traffic in shadow deployment, cost about 40 times less than a single exchange classifier, and yielded one high-risk vulnerability in about 1,700 hours of red teaming.

Hoagy Cunningham, Jerry Wei et al. · 2026-01-09 · original

Constitutional Classifiers (February 2025) guarded a model with an input classifier and a streaming output classifier, both trained on synthetic data generated from a written constitution of restricted and permitted content. That system resisted thousands of hours of red teaming for universal jailbreaks, but it added 23.7% to inference cost and 0.38% to refusals. This paper rounds these to "a 23% computational overhead" and "a refusal rate of 0.38%", which it says "limited the deployment viability" of the system (Section 1). Further testing also found attacks that got through it. This paper, posted by Anthropic as "Next-generation Constitutional Classifiers: More efficient protection against universal jailbreaks" and titled Constitutional Classifiers++ on arXiv, asks how to make the same kind of defense both more robust and cheap enough to run on all production traffic. It is an engineering paper: the constitution-based data pipeline is kept, and the changes are to what the classifier sees, how classifiers are combined, and where their signal comes from.

Terms used in this note

  • Universal jailbreak. As in the earlier paper, a jailbreak strategy that consistently bypasses safeguards on most target queries in a domain, here CBRN (chemical, biological, radiological and nuclear) weapons (Section 2, footnote).
  • Exchange classifier. A classifier that judges the model's output in the context of the input that produced it, rather than judging input and output separately.
  • Cascade, or two-stage classifier. A cheap first-stage classifier screens everything and passes only suspicious exchanges to a more accurate, more expensive second stage. The second stage, not the first, decides whether to refuse.
  • Linear probe. A linear function of the guarded model's own internal activations, trained to predict a label, here whether an exchange is harmful. It reuses computation the model already does.
  • High-risk vulnerability. In this paper, an attack that answers more than five of the eight target questions with rubric scores at least half those of a model without safeguards (Section 3, Appendix A).
  • Vulnerability discovery rate. High-risk vulnerabilities found per thousand red-teaming queries, the paper's main robustness measure, chosen because different systems received different amounts of red teaming (Appendix A).
  • Flag rate, refusal rate. The share of traffic the system blocks.

What the paper does

Attacks on the previous system

Further adversarial testing of the earlier design found two kinds of successful attack (Section 2, Figure 1):

  • Reconstruction attacks scatter a harmful request across harmless-looking context, for instance as return values of functions in a codebase, and ask the model to reassemble and answer it, with the answer obfuscated if needed to pass the output classifier.
  • Output obfuscation attacks get the model to disguise its answer, for instance by calling reagents "food flavorings" or answering in metaphor and riddle, so that the output looks harmless unless read alongside the input.

Such attacks cost the model capability, by varying amounts. On GPQA Diamond, Claude Opus 4 scored 74.2% without obfuscation, 32.3% under one such attack and 49% under another (Section 2). The authors find the variation concerning because it suggests attackers could find attacks that preserve more capability (Section 2).

Four systems compared

The paper builds and red teams four systems in sequence (Sections 3 to 6, Appendix A):

  1. Last generation. The authors' implementation of the earlier design: an input classifier fine-tuned from Claude Haiku 3.5 and a streaming output classifier from a smaller internal model, guarding Claude Sonnet 3.7.
  2. Exchange classifier. The input classifier reused, without special training, as an exchange classifier that also scores the response in batches of tokens as it is generated, guarding Claude Opus 4. Because it runs a Haiku-sized model over outputs, it costs about 50% more than the last-generation system (Section 3).
  3. Two-stage cascade. A first-stage exchange classifier from an internal model about a third the size of the second, and a second stage fine-tuned from Claude Haiku 4.5, guarding Claude Opus 4 (Section 4). The first stage's threshold is set so that it flags the vast majority of internal red-teaming examples; flagged exchanges are escalated, not refused.
  4. Production grade. A linear probe on the guarded model screens all exchanges; above a threshold, the exchange goes to a Claude Haiku 4.5 classifier, and the final score is $0.55\,z_{\text{probe}} + 0.45\,z_{\text{classifier}}$, a weighted sum of the two logits (Section 6). It guards Claude Sonnet 4.5.

All systems were trained on synthetic data following the earlier paper, with a CBRN constitution (Section 3), and thresholds were calibrated to a 0.1% refusal rate on WildChat for the exchange classifier and the second stage (Sections 3 and 4).

How the probes are trained

A probe predicts the harmfulness of a whole exchange at every token, but the label applies to the whole exchange, which may turn harmful only late. The paper makes two changes to a plain per-token probe (Section 5.1):

  • Logit smoothing. During training the probe's logits are averaged over a sliding window of $M$ tokens, so that a single spiking token does not flag a sequence; at inference an exponential moving average is used instead because it needs only one stored number.
  • Softmax-weighted loss. The per-token losses are weighted by a softmax over the smoothed logits with temperature $\tau$, so positions where the probe predicts harm get most of the weight. A harmless prefix shared by a harmful and a harmless sequence then carries almost no penalty, while any confident harmful prediction on a harmless sequence is penalized heavily, which matches streaming, where one flag stops all further output (Section 5.1).

The probe is cheap: for an all-layer probe on Gemma 3 27B, the paper estimates about 377K floating-point operations per token, against about 8 billion for one token through Gemma 3 4B (Section 5.1). The probes studied in Section 5 read all layers of Claude Sonnet 4, with $\tau = 1$ and $M = 16$, trained on about 25% of the exchange dataset with soft labels from a Claude Sonnet 4 classifier (Section 5.2). They were evaluated on about 7,000 human red-teaming exchanges from red teamers whose data had never been used for training, truncated to 20K tokens (Section 5.2).

Red teaming

The protocol follows the earlier paper: participants try to develop universal jailbreaks for eight CBRN target questions, and outputs are graded by LLM rubrics against a model without safeguards (Section 3, Appendix B). Bounties scaled with the number of questions answered, with maximum payouts of $25K to $35K depending on the campaign (Appendix B.1). For the two-stage and production systems the protocol changed: participants got a credit-free model alias, sample questions with their rubrics, a clarified definition of universal jailbreak, a 1.05 multiplier per "strong pass" (at least 75% of unsafeguarded detail), higher rewards for more universal attacks, and four of the eight questions replaced (Appendix B.2). Query counts exclude users whose queries had a classifier refusal rate of 5% or less, to filter out people using the program for other purposes (Appendix A).

What it finds

Exchange classifiers are more robust

The last-generation system had 13 high-risk vulnerabilities in 695K red-teaming queries (0.01871 per thousand); the exchange classifier had 2 in 226K (0.00885 per thousand) (Section 3). The introduction states this as 2.2 times fewer high-risk vulnerabilities per attempt (Section 1). Four attacks on the last-generation system answered all target questions at half the unsafeguarded detail, found after an average of 27 self-reported hours; the exchange system had one such universal attack, which took 100 hours (Section 3). The two systems guarded different models, which the authors argue does not substantially affect the comparison because the earlier paper found classifier robustness to be the main determinant of system robustness (Section 3, footnote).

The cascade keeps robustness at lower cost

The two-stage system had 5 high-risk vulnerabilities in 569K queries (0.00878 per thousand), about the same rate as the exchange classifier, though the mean time to find one was 33 hours, lower than for the exchange system (Section 4). No single jailbreak answered all target questions at detail similar to an unsafeguarded model (Section 4). A footnote adds that "expert-level red-teamers operating outside our bounty program were nonetheless able to discover universal jailbreaks for this system", with substantial effort and automated tools (Section 4, footnote). The system cost 5.4 times less than the exchange classifier; the updated second-stage classifier alone gave a 3 times reduction. About 10% of traffic went to the second stage, and the first stage accounted for about 77% of the cost (Section 4).

Probes approach small classifiers and complement them

On the static red-teaming data, the best probe had a lower attack success rate than the extra-small classifier and almost matched the Claude Haiku 4.5 classifier, but flagged benign scientific requests more often (Section 5.2, Figure 2). Smoothing and softmax weighting each helped, and together worked best (Section 5.2, Figure 2); the softmax loss also beat the cumulative-maximum losses of the earlier paper (Appendix C, Figure 5). Using all layers gave the lowest attack success rate, about 1.4%, and fewer layers did worse (Section 5.2).

Ensembling a probe with the small external classifier gave the lowest attack success rate of the pairs tested, better than ensembling the two external classifiers (Section 5.3, Figure 3). Probe and classifier predictions had a lower rank correlation than the two classifiers had with each other, which the authors read as the probe using complementary signals (Section 5.3). Equal weighting was close to optimal for probe-classifier pairs (Appendix D). Used as a cascade, the probe-plus-classifier system exceeded the small classifier's robustness on this dataset at a 100 times reduction in compute (Section 5.3).

The production system

In shadow deployment on Claude Sonnet 4.5 traffic from 1 December 2025 to 1 January 2026, the production system flagged 0.05% of queries, and the probe escalated about 5.5% of traffic to the second stage (Section 6). Its compute overhead was about 8 times lower than the two-stage cascade and about 40 times lower than the exchange classifier (Section 6). In an estimated 1,736 hours of red teaming over about 198K attempts, one high-risk vulnerability was found, a rate of 0.005 per thousand queries, after 30 hours; no attack answered all eight questions at half the unsafeguarded detail (Section 6).

Table 1 of the paper compares the four systems. Taking the last-generation system's compute as 100%, the exchange classifier uses 150%, the two-stage cascade 27.8% and the production system 3.5%. The production system also has the lowest vulnerability discovery rate (0.00505 per thousand queries). On production refusals the ordering differs: the two-stage cascade is lowest at 0.036%, then the exchange classifier at 0.038%, the production system at 0.050% and the last-generation system at 0.073% (Table 1). The refusal rates in this comparison were measured in each system's first week on production traffic (Appendix A, Figure 4 caption). The paper also compares the 0.05% flag rate with the 0.38% "reported by" the earlier paper (Section 6); in the earlier paper, 0.38% was an absolute increase in refusals measured on 5,000 sampled conversations for a different system and guarded model.

The accompanying post gives several figures that do not appear in the paper: that the system adds "roughly 1% compute overhead if applied to Claude Opus 4.0 traffic", that its refusal rate is "an 87% drop" from the original system, that the exchange classifier "cut successful jailbreaking attempts by more than half" (the paper's measure is 2.2 times fewer high-risk vulnerabilities per attempt), and that in the bug bounty run for the earlier system "one universal jailbreak was found". The earlier paper itself reports no universal jailbreak in its prototype bug bounty; the one universal jailbreak matches the February 2025 public demo described in the earlier system's post (see the Constitutional Classifiers note).

The constitution and other written specifications

This paper says little about the constitution. All classifiers were trained "on synthetic data following" the earlier paper, "using a constitution related to" CBRN weapons (Section 3); the constitution is not printed, and no result concerns its wording. The probes are trained on the same exchange data, with labels distilled from a constitutional classifier (Section 5.2), so the constitution reaches them only through that data and those labels.

Two pieces of text do bear on behavior here:

  • The red-teaming rules. The definition of a universal jailbreak was "clarified to emphasize the need for detailed, actionable responses across multiple queries", and providing sample questions and rubrics improved submissions (Appendix B.2, Appendix E). The robustness numbers depend on these definitions and on the rubrics.
  • The post's description of the constitution. The post summarizes the first-generation constitution as "natural language rules specifying what's allowed and what isn't", for example that Claude "should help with college chemistry homework, but not assist in the synthesis of Schedule 1 chemicals". The first paper's printed harmless constitution lists high-school chemistry; the college-level example is the post's own illustration.

In its future work, the paper suggests "targeted synthetic data generation to teach classifier models the intended decision boundary" as a way to reduce false positives further (Section 8), which would act through the data the constitution generates.

Limitations and open questions

The paper's own caveats and design features limit what the results show:

  • Different guarded models. The systems guard Claude Sonnet 3.7, Claude Opus 4 and Claude Sonnet 4.5; the authors argue this matters little (Section 3, footnote).
  • Changing red-teaming conditions. The bounty structure, rewards and four of the eight questions changed between campaigns (Appendix B.2), and effort varied widely, which is why the paper uses a normalized discovery rate (Appendix A).
  • Universal jailbreaks found outside the program. Expert red teamers outside the bounty found universal jailbreaks of the two-stage system (Section 4, footnote).
  • Static evaluation of probes. The probe analysis uses a fixed dataset, and counting an attack as defended if the classifier flags at any point "may underestimate the attack success rate" (Section 5.2, footnote).
  • Higher flag rate for probes on benign science (Section 5.2).
  • Infrastructure. The lessons section reports that infrastructure bugs created effective jailbreaks during development (Appendix E), as an implementation error had in the earlier paper.

The authors' future work includes building classifier signals into sampling, training models to resist obfuscation, automated red teaming for training data, and data closer to production traffic (Section 8).

Research questions

  1. How do exchange classifiers handle attacks spread over many turns? The reconstruction attacks studied fragment a request within one context (Section 2). Red teaming focused on multi-turn reconstruction, with the vulnerability rate compared between the exchange and last-generation systems, would test how far the exchange view extends.
  2. What signal do probes use that classifiers miss? The paper infers complementarity from rank correlations (Section 5.3). Examining the exchanges on which probe and classifier disagree, and which features the probe weights, would identify it, and test the post's claim that internal representations are harder to manipulate.
  3. Is the probe harder or easier to attack directly? The production system was red teamed as a whole (Section 6). An attack campaign aimed at the first-stage probe alone, measuring how often harmful exchanges avoid escalation, would show whether the cheap first stage is a weak point.
  4. How does the cascade threshold trade robustness against cost in deployment? The 100 times compute reduction is measured on a static dataset (Section 5.3). Red teaming the production system at several probe thresholds would map the trade-off under live attack.
  5. How much do the red-teaming rules shape the robustness numbers? The definition of universal, the rewards and the questions changed between campaigns (Appendix B.2). Running two systems under the same rules, or one system under both rule sets, would show how much of the difference in discovery rates comes from the protocol.
  6. Can targeted synthetic data narrow the probe's false positives on benign science? The authors propose such data (Section 8). Adding harmless scientific categories to the constitution and measuring the probe's flag rate on benign scientific requests would test it.

How it connects

  • Predecessor. Constitutional Classifiers supplies the constitution-based data pipeline, the red-teaming protocol, the rubric grading and the cumulative-maximum losses compared in Appendix C.
  • Attacks. Keyword substitution and ciphers were also among the most successful strategies in the February 2025 live demo of the earlier system, as reported in that system's post (see the Constitutional Classifiers note); Many-shot jailbreaking and Red Teaming Language Models to Reduce Harms are earlier work in this library on attacks and human red teaming.
  • Probes on activations. The paper cites Anthropic's work on classifiers built from dictionary-learning features (Using dictionary learning features as classifiers) among model-internals approaches (Section 7).
  • In the course wiki. Calibrating thresholds to a fixed false-positive rate and combining classifiers are covered in Evaluating Classifiers; the cascade, where a cheap stage screens and an expensive stage decides, resembles the multi-stage ranking described in Search at Scale.

References

  • Cunningham, H., Wei, J., Wang, Z., Persic, A., Peng, A., Abderrachid, J., Agarwal, R., Chen, B., Cohen, A., Dau, A., et al., Perez, E., and Sharma, M. (2026). Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks. Anthropic. arXiv:2601.04603v1, submitted 8 January 2026. https://arxiv.org/abs/2601.04603
  • Anthropic. (2026, January 9). Next-generation Constitutional Classifiers: More efficient protection against universal jailbreaks [post]. https://www.anthropic.com/research/next-generation-constitutional-classifiers
  • Sharma, M., Tong, M., Mu, J., Wei, J., et al. (2025). Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming. arXiv:2501.18837.
  • Studies cited above only as the paper describes them are listed in full in the paper's references.