Constitutional Classifiers++: An Efficient Production-Grade Defense Against Universal Jailbreaks

Core question: how to make Constitutional Classifiers meet the low computational overhead and low refusal rate required for production deployment while defending against universal jailbreaks.

• Setting and importance: Jailbreaks are prompting strategies that bypass defenses and extract harmful information from LLMs; the authors consider such defenses critical for mitigating high-risk CBRN (chemical, biological, radiological, nuclear) threats.
• Shortcomings of existing systems: The authors report that the system of Sharma et al. (2025) had 23% computational overhead and a 0.38% production traffic refusal rate, limiting deployment feasibility; further testing by the authors also found two classes of attacks that could bypass it (Section 2).
• Core observation: Reconstruction attacks split harmful information into benign contexts and reassemble it, while output obfuscation attacks make outputs uninterpretable once detached from the input; the authors believe evaluating outputs in conversational context makes obfuscation harder, and that cascades and probes can greatly reduce cost.
• What the paper proposes: A production-grade defense system combining an exchange classifier, a two-level cascade, linear probes and ensembles, validated through more than 1,700 hours of human red-teaming.
• Threat model:
  • Attacker goal: Find a universal jailbreak, i.e., one that reliably bypasses defenses on most target queries in the CBRN domain and elicits detailed harmful answers (definition follows Sharma et al., 2025).
  • Attacker knowledge and capability: API access to the protected model, the ability to submit arbitrary prompts and iteratively develop attacks; red-teaming was incentivized with bounties of up to $35K (Appendix B).
  • Victim system: Claude models loaded with Constitutional Classifiers (different experiments protected Claude Sonnet 3.7, Claude Opus 4 and Claude Sonnet 4.5 respectively).
  • Success criterion: An answer reaching at least half the detail of the unprotected model on the LLM rubric score; an answer to more than 5 of the 8 target questions counts as a high-severity vulnerability.

Previous-generation Constitutional Classifiers and jailbreak analysis

• Sharma et al. (2025)—proposed Constitutional Classifiers, using an input classifier plus an output classifier to defend against universal jailbreaks; this paper improves directly on that work and identifies its two classes of vulnerabilities, reconstruction attacks and output obfuscation (Section 2).
• Souly et al. (2024), Nikolić et al. (2025)—noted that jailbreaks degrade model capability; this paper's tests on GPQA Diamond are consistent with this, and find that capability loss varies greatly across jailbreaks.

Adaptive computation and cascaded classification

• OpenAI (2025a;b)—use a lightweight topic filter to identify high-risk domains and trigger more expensive classification only when necessary; the paper notes that their first layer performs topic detection, whereas this paper's first layer directly targets jailbreak attempts.
• Hua et al. (2025)—study strategies for combining multiple monitors under cost constraints; the paper notes that this paper adopts a more direct two-level classification and validates it with human red teaming.
• HybridLLM (Ding et al., 2024), AutoMix (Aggarwal et al., 2025), Rabanser et al. (2025), TARS (Kim et al., 2025)—related work on cascades, routing, and adaptive allocation of test-time compute.

Classification based on model internals

• Cunningham et al. (2025)—explore internals-based classifiers, focusing on last-N layer networks; the paper notes that this paper focuses on improving a simple linear probe with a weighted loss and logit smoothing.
• McKenzie et al. (2025)—proposed softmax-weighted probes and cascades; the paper notes that they aggregate token scores into sequence-level predictions, whereas this paper performs streaming continuous prediction and weights per-token losses, additionally using logit smoothing.
• Other internal methods: standard activation probes (Alain & Bengio, 2016; Zou et al., 2023; Youstra et al., 2025), short-circuiting (Zou et al., 2024), latent adversarial training (Casper et al., 2024), SAE feature classifiers (Bricken et al., 2024; Kantamneni et al., 2025).

Baselines and benchmarks: the baseline for the robustness comparison is the authors' own implementation of the previous-generation dual-classifier system (Section 2); the baselines for the probe experiments are the first-level (extra-small) and second-level (small, Claude Haiku 4.5) external classifiers from Section 4. Calibration uses WildChat, capability loss testing uses GPQA Diamond, and robustness uses a dataset of approximately 7,000 human red-team CBRN exchanges.

The authors position this paper as moving Constitutional Classifiers from a research prototype to production grade: while exceeding the previous generation in robustness, it reduces compute cost and false refusal rates to a deployable level.

Overall approach: first use the exchange classifier to close the two classes of vulnerabilities in the previous generation, then use a two-level cascade and a linear probe ensemble to reduce compute cost step by step, ultimately combining them into a production-grade system.

Exchange classifier (Section 3)

• Design: first evaluate the prompt alone as an input classifier would, then evaluate sampled tokens in batches during generation, so that each output segment is judged in the full conversation context; prompt caching makes this approach's cost manageable.
• Rationale: the authors believe that segments of a reconstruction attack are often reorganized into something resembling ciphertext after the model begins answering, and thus become detectable; obfuscation such as encoded language, metaphor, and substitution is easier to recognize when the classifier knows the input.
• Implementation: an input classifier fine-tuned directly from Claude Haiku 3.5 serves as the exchange classifier (the authors found that a standard input classifier can also effectively perform exchange classification), using a simpler exchange-only architecture; the threshold is calibrated to a 0.1% refusal rate on WildChat.

Two-level cascade (Section 4)

• Design: a lightweight first level screens all traffic, and flagged exchanges are escalated to a more accurate but more expensive second level rather than directly refused; therefore a higher first-level false positive rate can be tolerated, allowing a cheaper and weaker model to serve as the initial screen.
• Implementation: the second level is fine-tuned from Claude Haiku 4.5, and the first level is an internal model about one-third the size/cost of the second level; the second-level threshold is calibrated to a 0.1% flag rate on WildChat when used independently, and the first-level threshold is set to flag the vast majority of samples in the internal red-team dataset; combined with inference pipeline optimization.

Linear probe (Section 5)

• Problem setting: the exchange-level label y⁽ⁱ⁾ ∈ {0,1} marks whether an entire conversation is harmful, but the streaming setting requires position-by-position prediction during generation, and the probe performs linear classification using intermediate-layer activations.
• SWiM logit smoothing: during training, average the logits over a sliding window of M tokens, where z̄_t is the average logit at position t; only when multiple consecutive tokens are all predicted harmful is it counted as harmful, reducing false positives caused by isolated spikes; at inference, an exponential moving average (EMA) is used instead, requiring only one scalar state to be stored.
• Softmax-weighted loss: per-token losses are weighted by exp(z̄t/τ), where τ controls the temperature; predictions on harmless prefixes receive almost no weight, so the probe can confidently predict harmless without penalty, while any confident harmful prediction in a harmless sequence is heavily penalized. The authors note that this differs from weighting by |z̄t|, which would incorrectly penalize confident harmless predictions before harm appears.
• Training parameters: trained on concatenated activations from all layers of Claude Sonnet 4; soft labels are produced by a Constitutional Classifier fine-tuned from Claude Sonnet 4; τ = 1, M = 16, using only about 25% of the exchange dataset (more data gave no improvement).
• Cost: the authors estimate, using Gemma 3 27B as an example, that a full-layer probe costs about 377K FLOPs per token, whereas a single-token forward pass of Gemma 3 4B costs about 8B FLOPs, and state that the probe's marginal cost is effectively zero.

Production-grade system (Section 6)

• Architecture: the linear probe monitors all exchanges during generation, and if the probe score exceeds the threshold, the exchange is escalated to the second-level external classifier; escalated exchanges are scored as zfinal = 0.55·zprobe + 0.45·zclassifier.
• Implementation: the second level is fine-tuned from Claude Haiku 4.5, the defended model is Claude Sonnet 4.5, and the probe uses that model's activations.

Success determination and evaluation method

• rubric scoring: following the LLM rubric procedure of Sharma et al. (2025), a baseline is first generated with the undefended model and scoring criteria are established for each query; a response is considered successful if it reaches at least half the score of the undefended model.
• High-risk vulnerability: a single attack successfully answers more than 5 of the 8 target questions; the main metric is the high-risk vulnerability discovery rate per thousand red-team queries, normalizing for the different amounts of red-team effort across systems.

Experimental setup

• Protected models: The previous-generation system protected Claude Sonnet 3.7; the exchange classifier and two-level cascade protected Claude Opus 4; the production-grade system protected Claude Sonnet 4.5; the protected model in the probe experiments was Claude Sonnet 4 (Figure 3 caption).
• Classifiers: The previous-generation input classifier was fine-tuned from Claude Haiku 3.5, and the output classifier was a smaller internal LLM; the exchange classifier was fine-tuned from Claude Haiku 3.5; the second level of the cascade was fine-tuned from Claude Haiku 4.5, and the first level was an internal model about one-third the size; the probe was a linear activation probe.
• Data: 8 CBRN target queries (4 of which were replaced in the two-level system and the production-grade system); the probe analysis used about 7,000 human red-team CBRN exchanges (using only data from red-teamers not involved in training, truncated to 20K tokens); thresholds were calibrated using WildChat.
• Metrics: High-severity vulnerability discovery rate (per thousand red-team queries), attack success rate (ASR), production traffic refusal rate, relative computational overhead, and time to vulnerability discovery.
• Evaluation method: LLM rubric scoring, with success defined as reaching at least half the score of the unprotected model; in the probe experiments, the defense was considered successful if the exchange classifier flagged at any point during sampling (the authors note this may underestimate ASR).
• Red-team scale: 695K queries for the previous generation, 226K for the exchange classifier, 569K for the two-level cascade, and about 198K attempts for the production-grade system, estimated at 1736 hours; bounties were up to $25K–35K.

Main results

According to Table 1 (relative overhead uses the authors' implementation of the previous-generation system as 100%):

Swipe horizontally to read the table

System	Relative computational overhead (%)	High-severity vulnerability discovery rate per thousand queries	Production traffic refusal rate (%)
Previous generation (§2)	100.0	0.01871	0.073
Exchange classifier (§3)	150.0	0.00885	0.038
Two-level cascade (§4)	27.8	0.00878	0.036
Production-grade (§6)	3.5	0.00505	0.050

• The authors state that the production-grade system achieves the best trade-off among robustness, inference overhead and refusal rate; its overhead is about 40 times lower than a single exchange classifier and about 8 times lower than the two-level cascade (Section 6).
• The previous-generation system had 13 high-severity vulnerabilities discovered, of which 4 jailbreaks could answer all target queries with half the detail of the unprotected model, with an average discovery time of 27 hours; the exchange system had only 2 vulnerabilities, of which 1 was a universal attack, taking 100 hours to discover (Section 3).
• The production-grade system had only 1 high-severity vulnerability discovered, with a discovery time of 30 hours, the highest minimum vulnerability discovery time among the systems; the authors report that no red-team member found a universal jailbreak that could answer all 8 target queries with half the detail (Section 6).

Static analysis of probes and ensembles (Section 5)

• Probes vs. external classifiers: On static jailbreak data, the best probe's ASR was better than the extra-small classifier and close to the small Claude Haiku 4.5 classifier (Figure 2a); the all-layer probe had an ASR of about 1.4%, and performance steadily worsened as layers were reduced (Figure 2c); the authors report that the probe had a higher flagging rate on benign scientific requests.
• Ensembles: The logit-weighted ensemble of the probe and the small classifier had the lowest ASR, better than the more expensive XS-S external classifier ensemble, and equal weighting (α = 0.5) was already close to optimal (Figure 3a, Appendix Figure 6); the Spearman rank correlation between the probe's and small classifier's predictions was lower than that between the two external classifiers, and the authors believe the probe captures complementary signal (Figure 3b).
• Cascade trade-off: The authors state that the probe-small cascade exceeded the robustness of the small classifier alone on this dataset while reducing computational cost by 100 times (Figure 3c, cost relative to the small classifier processing all traffic).

Effect of jailbreaks on model capability (Section 2)

• What was measured: Claude Opus 4's accuracy on GPQA Diamond under two fragmentation attacks that do not involve input-aware obfuscation.
• Results: 74.2% without obfuscation, dropping to 32.3% and 49% under the two attacks.
• Authors' interpretation: Such attacks degrade model capability, but to widely varying degrees; the authors believe attackers may develop attacks with smaller capability loss, so the vulnerability remains a concern.

Other ablations and analyses

• Loss function ablation (Figure 2b): ASR was highest with neither smoothing nor softmax weighting, and the combination of both was best.
• Appendix Figure 5a: smoothed softmax outperformed the cumulative max and annealed cumulative max losses proposed by Sharma et al. (2025).
• Appendix Figure 5b: performance was best around window M = 16, and worsened when it was too large or too small.
• Two-level cascade cost breakdown (Section 4): 5.4 times lower than a single exchange system, with the second-level update contributing a factor of 3; about 10% of traffic reached the second level, and the first level accounted for about 77% of total system cost.
• Exception: The authors note that expert red-teamers outside the bounty program, using automated tools and considerable effort, still found a universal jailbreak for the two-level system (Section 4, footnote 3).

Limitations and future directions noted by the authors

• Tighter classifier-model integration (Section 8): for example, incorporating classifier signals directly into the model's sampling process, or training the model to better resist obfuscation attempts; the authors believe this could enhance robustness.
• Improved training data (Section 8): better classifiers might be obtained through automated red teaming (Perez et al., 2022) or by incorporating data closer to production traffic.
• Other approaches to reducing false positives (Section 8): the authors state that although the latest system improved the false positive rate, future work could study targeted synthetic data generation so that classifiers learn the intended decision boundary.
• Probe flag rate on benign requests (Section 5.2): the authors report that the probe's flag rate on benign science requests is higher than that of the external classifier.
• Residual vulnerabilities of the two-level system (Section 4, footnote 3): expert-level red-team members outside the bounty program, using automated tools and expending substantial effort, still found a universal jailbreak.

Scope of experimental coverage

• There are 4 defended models in total: Claude Sonnet 3.7, Claude Opus 4, and Claude Sonnet 4.5, with probe experiments using Claude Sonnet 4 (Sections 3, 4, 6 and the Figure 3 caption).
• Red-team query volumes differ across systems: 695K (previous generation), 226K (exchange), 569K (two-level), and approximately 198K (production-grade); the production-grade red-team duration is an estimate (API logs, 5-minute buckets).
• The red-team protocol changed between the two-level system and the production-grade system: 4 of the 8 target queries were replaced, the bounty structure was adjusted, and participants were provided with test queries and rubrics (Appendix B.2).
• Robustness analysis of the probe and ensemble was conducted on approximately 7,000 static red-team exchanges, truncated to 20K tokens; the authors note that "flagging at any point during sampling counts as a successful defense" may underestimate ASR (Section 5.2).
• The paper does not report the specific model of the LLM used for rubric scoring, the number of red-team members, or the agreement between LLM judging and human judgment.

Anthropic's work on improving defenses against universal jailbreaks in LLMs, with the goal of increasing robustness while bringing cost and false refusals down to a production-deployable level.

• Problem: The authors found that the previous generation of Constitutional Classifiers (input and output dual classifiers) had two classes of vulnerabilities, reconstruction attacks and output obfuscation attacks, and that 23% computational overhead and a 0.38% refusal rate limited deployment.
• Method: Use an exchange classifier to stream-evaluate outputs in conversational context; a two-level cascade lets a lightweight model screen first and an expensive model review; then use a linear probe with logit smoothing and a softmax-weighted loss as the first level, and a probe–external classifier ensemble as the second level.
• Robustness: The production-grade system (protecting Claude Sonnet 4.5) was estimated to have found only 1 high-severity vulnerability across 1736 hours and about 198K red-team attempts, a discovery rate of 0.00505 per thousand queries, below the previous generation's 0.01871 (Table 1); the authors report that no one found a universal jailbreak that could answer all 8 CBRN target queries with half the detail of the unprotected model.
• Cost and false refusals: Production traffic refusal rate was 0.05% (0.073% for the previous-generation system, Table 1); computational overhead was 3.5% of the previous-generation system, about 40 times lower than a single exchange classifier.
• Probe analysis: On static jailbreak data, probe ASR was better than the extra-small classifier and close to the Claude Haiku 4.5 classifier; the probe and small classifier ensemble had the lowest ASR, and the authors believe the two signals are complementary.
• Authors' conclusion: The authors state that Constitutional Classifiers can achieve strong robustness while meeting deployment constraints, and are a practical production-grade defense; future directions include tighter integration of classifiers and models, improved training data, and targeted synthetic data to reduce false positives.