The Year in AI Papers
The year/Anthropic

Paper 2601.04603

Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks

Hoagy Cunningham, Jerry Wei, Zihan Wang, Andrew Persic, Alwin Peng, Jordan Abderrachid, Raj Agarwal, Bobby Chen, Austin Cohen, Andy Dau, Alek Dimitriev, Rob Gilson, et al.

Published
Jan 2026
Research lab
Anthropic
Citations
28
GitHub
Not linked

01 In brief

Summary

This paper introduces enhanced Constitutional Classifiers, a production-grade defense system against universal jailbreaks for large language models.

The authors identify vulnerabilities in previous-generation defenses, such as reconstruction and output obfuscation attacks, and address them with exchange classifiers that evaluate outputs in full conversational context.

To reduce computational costs, they implement a two-stage classifier cascade and train efficient linear probe classifiers, which are ensembled with external classifiers.

The final production system achieves a 40x computational cost reduction compared to the baseline exchange classifier, a 0.05% refusal rate on production traffic, and the lowest vulnerability discovery rate among all systems tested.

Extensive red-teaming, totaling over 1,700 hours, showed no universal jailbreak could elicit detailed responses to all eight target CBRN queries.

02 From the paper

Abstract

We introduce enhanced Constitutional Classifiers that deliver production-grade jailbreak robustness with dramatically reduced computational costs and refusal rates compared to previous-generation defenses. Our system combines several key insights. First, we develop exchange classifiers that evaluate model responses in their full conversational context, which addresses vulnerabilities in last-generation systems that examine outputs in isolation. Second, we implement a two-stage classifier cascade where lightweight classifiers screen all traffic and escalate only suspicious exchanges to more expensive classifiers. Third, we train efficient linear probe classifiers and ensemble them with external classifiers to simultaneously improve robustness and reduce computational costs. Together, these techniques yield a production-grade system achieving a 40x computational cost reduction compared to our baseline exchange classifier, while maintaining a 0.05% refusal rate on production traffic. Through extensive red-teaming comprising over 1,700 hours, we demonstrate strong protection against universal jailbreaks -- no attack on this system successfully elicited responses to all eight target queries comparable in detail to an undefended model. Our work establishes Constitutional Classifiers as practical and efficient safeguards for large language models.