Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks

• Constitutional Classifiers are essential for defending LLMs against high-risk threats like CBRN weapon information extraction.
• Previous defense systems suffered from high computational overhead and excessive refusal rates on production traffic.
• New adversarial testing identified vulnerabilities in current defenses, specifically reconstruction and output obfuscation attacks.
• The authors propose a single 'exchange classifier' that evaluates model outputs within the context of their specific inputs.
• This new approach reduces high-risk vulnerabilities by 2.2x while improving computational efficiency and reducing false positives.

We identify two classes of attacks capable of evading these defenses: (i) reconstruction attacks, which distribute harmful information across multiple segments within a larger context before reassembling them; and (ii) output obfuscation attacks.

• A classifier cascade architecture reduces computational overhead by using a lightweight first-stage screener and a more expensive second-stage evaluator.
• Linear activation probes trained with logit smoothing and weighted softmax loss provide robust detection at negligible computational cost.
• Ensembling probes with external classifiers captures complementary signals, resulting in stronger robustness than either method used in isolation.
• The final production-grade system achieved a 40x reduction in overhead and a significantly lower flag rate of 0.05% compared to previous benchmarks.
• Extensive human red-teaming involving 1,700 hours failed to discover a universal jailbreak capable of extracting detailed CBRN information.

Crucially, no red-teamer discovered a universal jailbreak capable of consistently extracting highly detailed answers to all target CBRN queries.

• Adversaries use reconstruction attacks to bypass input filters by fragmenting harmful requests across benign code segments.
• Models can be instructed to reassemble hidden messages and respond using character-separated formatting to evade detection.
• Obfuscation attacks utilize metaphorical language to mask requests for dangerous substances like hydrochloric acid.
• Output classifiers often fail to interpret context-dependent transformations that appear benign in isolation.
• These systematic vulnerabilities allow attackers to bypass safety guardrails by exploiting the model's ability to decode complex instructions.

The marriage releases winter’s breath as an invisible vapor.

• Adversaries use obfuscation techniques like metaphors, riddles, and base64 encoding to bypass safety filters.
• Jailbreak attacks significantly degrade model reasoning capabilities, with accuracy on GPQA Diamond dropping from 74.2% to as low as 32.3%.
• The variability in performance degradation suggests that future attacks may become more efficient at preserving model intelligence while bypassing safety.
• Exchange classifiers are proposed to replace static input classifiers by continuously monitoring token generation in batches.
• By evaluating outputs within their full conversational context, exchange classifiers can detect reassembled fragments and coded language that appear benign in isolation.
• Prompt caching allows for this continuous evaluation without incurring significant computational overhead.

This variability is concerning, as it suggests adversaries can likely develop new attacks that preserve more of the model’s capabilities while still bypassing safety measures.

• The system utilizes a fine-tuned Claude Haiku 3.5 model as an exchange classifier to monitor interactions for CBRN-related risks.
• The exchange classifier architecture demonstrates a 50% increase in computational cost compared to previous-generation output-only classifiers.
• Red-teaming evaluations focused on universal jailbreak strategies across eight high-risk target queries involving chemical and nuclear weapons.
• The exchange classifier system significantly improved robustness, reducing the vulnerability rate from 0.01871 to 0.00885 per thousand queries.
• Attacking the new system proved more difficult, with the most successful universal jailbreak requiring 100 hours of discovery time compared to 27 hours for the previous system.

In contrast, the exchange classifier system had only one such universal attack, which required 100 hours to discover.

• A two-stage cascade system uses a lightweight first-stage classifier to screen inputs before escalating suspicious traffic to a more robust second-stage model.
• This adaptive computation approach allows for higher false positive rates in the initial stage, reducing the performance requirements and cost of the primary filter.
• The system achieved a 5.4x reduction in computational costs compared to single-exchange systems while maintaining a low vulnerability discovery rate of 0.00878 per thousand queries.
• Human red-teaming confirmed that no single jailbreak could bypass the system to provide high-detail answers to restricted CBRN-related queries.
• Researchers are exploring further efficiency by using linear activation probes that reuse representations already computed during the model's sampling process.

This scheme represents a form of adaptive computation, where classification cost depends on input complexity.

• The system uses linear probes to predict exchange-level harmfulness labels at each individual token position during inference.
• To reduce false positives from isolated activation spikes, the researchers implement Sliding Window Mean (SWiM) logit smoothing.
• During deployment, the sliding window is replaced by an Exponential Moving Average (EMA) to minimize computational overhead and memory storage.
• A softmax-weighted loss function is employed during training to prioritize accuracy on the most confident predictions of harmfulness.
• The architecture supports both single-layer and multi-layer probing by concatenating intermediate activations from the language model.

Without averaging, a single token with a spuriously high activation could incorrectly flag an entire sequence as harmful.

• The researchers developed a specialized weighting scheme for probes that avoids penalizing harmless prefixes in potentially harmful sequences.
• Unlike standard binary cross-entropy, this method focuses on tokens that indicate harmfulness, allowing for more accurate streaming classification.
• Linear probes are shown to be orders of magnitude more computationally efficient than external classifiers, requiring only 377K FLOPs compared to 8B for a small model.
• Ablation studies demonstrate that combining logit smoothing with softmax weighting yields the best performance in detecting CBRN-related threats.
• The probe's design specifically targets the 'streaming' use case where a single flag must block all subsequent content in real-time.

The probe is thus several orders of magnitude cheaper than a small external classifier, rendering its marginal cost for per-token prediction effectively zero.

• The study evaluates a Constitutional Classifier fine-tuned from Claude Sonnet 4.5 against human-generated jailbreak attempts.
• Researchers utilized a dataset of 7,000 red-teaming exchanges specifically designed to elicit harmful CBRN-related information.
• Linear probes combined with small external classifiers outperformed more expensive, high-compute classifier ensembles.
• Probes and external classifiers exhibit independent error patterns, making their combination more effective for defense.
• The evaluation methodology uses LLM-rubric grading and exponentially weighted moving averages for predictive accuracy.

Probes and external classifiers make more independent errors than pairs of external classifiers.

• A two-stage system combining linear probes with external classifiers achieves a 100x reduction in compute costs while exceeding the robustness of standalone classifiers.
• Linear probes using activations from Claude Sonnet 4 demonstrate an attack success rate that nearly matches the performance of the Claude Haiku 4.5 classifier.
• The effectiveness of these probes depends heavily on combining softmax loss weighting and logit smoothing to minimize attack success rates.
• Utilizing all available layers for multi-layer probing is essential, as performance consistently degrades when fewer layers are used.
• Ensembling a probe with a small external classifier via weighted logit averaging yields superior robustness compared to ensembling two external classifiers.
• Probes appear to provide complementary predictions that enhance the overall defensive capabilities of the ensemble system.

On our dataset of CBRN-related exchanges, our system that combines probes and the small external classifier can exceed the robustness of the small classifier alone whilst simultaneously offering a 100x reduction in compute costs.

• Linear probes leverage complementary signals to external classifiers, making them highly effective when used in an ensemble.
• A two-stage cascade architecture uses lightweight probes to monitor generation, only escalating to expensive classifiers when confidence thresholds are met.
• The production system achieved a 100x reduction in compute costs while exceeding the robustness of standalone external classifiers.
• Shadow deployment on Claude Sonnet 4.5 traffic showed a significantly lower flag rate of 0.05% compared to previous benchmarks.
• Red-teaming efforts totaling 198,000 attempts yielded only one high-risk vulnerability, the lowest detection rate in the study.

On our dataset, our system exceeds the robustness of the small classifier alone whilst simultaneously offering a 100x reduction in compute costs.

• The production-grade system achieves a significant breakthrough by reducing relative compute overhead to just 3.5% compared to previous generations.
• A two-stage classification cascade effectively targets jailbreak attempts by triggering expensive classification only when initial layers detect high-risk signals.
• The system maintains a low production refusal rate of 0.05% while simultaneously achieving the lowest high-risk vulnerability discovery rate among tested models.
• Technical optimizations include using weighted loss functions and logit smoothing to boost the performance of simple linear probes based on model internals.
• Unlike static monitors, these classifiers provide continuous streaming predictions during generation rather than aggregating token scores into a single final prediction.

The production-grade system described in this section achieves the best trade-off between robustness, inference overhead, and refusal rates.

• The authors establish Constitutional Classifiers as practical safeguards that balance robust protection against jailbreaks with low computational costs.
• Future research aims to integrate classifier signals directly into the model sampling process to strengthen real-time resistance to attacks.
• Automated red-teaming and synthetic data generation are proposed as methods to refine decision boundaries and reduce false-positive rates.
• The project involved extensive cross-functional collaboration, including probe development, infrastructure monitoring, and human red-teaming.
• External safety organizations like UK AISI and FAR.AI contributed to the robustness analysis through independent red-teaming efforts.

We develop systems that provide robust protection against universal jailbreak attempts while meeting the stringent false positive and computational constraints required for deployment.

• The text lists foundational and contemporary research papers focused on AI safety, alignment, and adversarial robustness.
• Key themes include the use of dictionary learning and sparse autoencoders to interpret and classify internal model features.
• Several citations explore cost-effective monitoring and 'constitutional classifiers' to maintain safety without excessive computational overhead.
• The references highlight methods for detecting high-stakes interactions and latent knowledge within language models without direct supervision.
• Research into ensemble methods and predictive uncertainty estimation is presented as a means to improve model reliability and defense mechanisms.

Discovering latent knowledge in language models without supervision, 2024.

• The text provides a comprehensive bibliography of recent research focusing on AI jailbreaking, red teaming, and safety frameworks from 2022 to 2025.
• Key technical reports from OpenAI are cited, including system cards for ChatGPT agents and GPT-5, alongside their preparedness framework.
• Research highlights include 'The Jailbreak Tax,' which evaluates the actual utility of outputs generated through successful model exploits.
• The data includes a comparative analysis of 'High Risk Vulnerabilities' across different system generations, measured per thousand queries.
• Advanced defense mechanisms such as 'Constitutional Classifiers' and 'Circuit Breakers' are proposed to improve model alignment and robustness.

The jailbreak tax: How useful are your jailbreak outputs?

• The study compares four generations of Constitutional Classifier systems, ranging from dual-classifier setups to a production-grade two-stage ensemble.
• A production-grade system utilizing a linear probe and external exchange ensemble achieved the highest robustness and computational efficiency.
• Robustness is primarily measured by the 'high-risk vulnerability discovery rate,' which normalizes successful attacks per thousand red-teaming queries.
• High-risk vulnerabilities are defined as attacks that successfully bypass safeguards for more than five of eight target categories with high rubric scores.
• Red-teaming data is filtered to include only users with a refusal rate over 5% to ensure the metrics reflect genuine adversarial attempts.
• The evaluation protocol focuses on 'universal jailbreak strategies' where participants attempt to bypass safeguards across multiple harmful categories simultaneously.

The production-grade system achieves the best robustness and computational efficiency with acceptable refusal rates.

• The evaluation process uses query-specific rubrics to measure jailbreak success against a baseline model without safeguards.
• High-risk vulnerabilities are defined as attacks that successfully bypass safeguards for more than five out of eight target questions.
• Red-teamers are incentivized through a bounty system with payouts up to $35,000 USD and multipliers for high-quality, detailed responses.
• The protocol transitioned to a two-stage system using model aliases to reduce friction and improve the universality of discovered attacks.
• Ablation studies demonstrate that a smoothed softmax loss function outperforms alternative methods like cumulative maximum loss.
• Testing indicates that sliding window sizes for probes reach peak performance at moderate values, specifically around sixteen.

Throughout this work, we offered bounties scaled by the number of successfully jailbroken queries, with maximum payouts ranging from $25K to $35K USD depending on the specific campaign.

• The researchers explored cumulative maximum loss functions to better align with streaming classification where any harmful token justifies stopping generation.
• An annealed version of the cumulative maximum loss was developed to fix optimization issues by linearly interpolating between direct probabilities and the maximum score.
• Empirical results showed that smoothed softmax loss-weighting still outperformed cumulative maximum approaches in final classification accuracy.
• Sliding window smoothing for probe logits reaches peak performance at a window size of 16, with too much or too little smoothing degrading results.
• Ensemble weighting analysis reveals that equal weighting between linear probes and external classifiers is nearly optimal for reducing attack success rates.
• A critical deployment takeaway is that infrastructure reliability is a security requirement, as implementation bugs can create functional jailbreaks.

Even perfect classifiers become ineffective when compromised by implementation bugs.

• Human red-teaming remains a critical complement to synthetic testing to prevent overfitting on automated benchmarks.
• Organizations must invest in both technical infrastructure and operational processes for safety system updates.
• Recomputing model activations during probe training is more efficient than storing them due to I/O bottlenecks.
• Linear probe training efficiency allows for simultaneous testing of multiple variants on fresh data.
• Providing red-teamers with sample queries and rubrics improves the quality and efficiency of jailbreak reporting.
• Large Language Models were utilized to assist in the polishing and writing of the final research paper.

Moving probe activation data from high-bandwidth memory (HBM) to RAM or blob storage creates severe I/O bottlenecks that dwarf the computational cost of regeneration.

• New adversarial testing found vulnerabilities in current defenses, especially reconstruction and output-obfuscation attacks.
• The authors propose a single exchange classifier that evaluates model outputs in the context of their specific inputs.

We identify two classes of attacks capable of evading these defenses: (i) reconstruction attacks, which distribute harmful information across multiple segments within a larger context before reassembling them; and (ii) output obfuscation attacks.

• A classifier cascade uses a lightweight first-stage screener and a more expensive second-stage evaluator to reduce overhead.
• The final production-grade system achieved a 40x reduction in overhead and a 0.05% flag rate, while 1,700 hours of human red-teaming found no universal jailbreak for detailed CBRN information.

Crucially, no red-teamer discovered a universal jailbreak capable of consistently extracting highly detailed answers to all target CBRN queries.

• A fine-tuned Claude Haiku 3.5 exchange classifier monitored interactions for CBRN-related risks.
• The system reduced vulnerability from 0.01871 to 0.00885 per thousand queries, and the most successful universal jailbreak took 100 hours to find versus 27 hours previously.

In contrast, the exchange classifier system had only one such universal attack, which required 100 hours to discover.

• A two-stage system combining linear probes with external classifiers achieves a 100x compute reduction while exceeding the robustness of standalone classifiers.
• Ensembling a probe with a small external classifier via weighted logit averaging yields better robustness than ensembling two external classifiers.

On our dataset of CBRN-related exchanges, our system that combines probes and the small external classifier can exceed the robustness of the small classifier alone whilst simultaneously offering a 100x reduction in compute costs.

• A two-stage cascade uses lightweight probes to monitor generation and escalates to expensive classifiers only when confidence thresholds are met.
• The production system achieved a 100x reduction in compute costs and, in shadow deployment, showed a 0.05% flag rate; 198,000 red-teaming attempts yielded only one high-risk vulnerability.

On our dataset, our system exceeds the robustness of the small classifier alone whilst simultaneously offering a 100x reduction in compute costs.

• The production-grade system reduces relative compute overhead to 3.5% of previous generations.
• A two-stage cascade triggers expensive classification only when early layers detect high-risk signals, while maintaining a 0.05% refusal rate and the lowest high-risk vulnerability discovery rate among tested models.

The production-grade system described in this section achieves the best trade-off between robustness, inference overhead, and refusal rates.

• Smoothed softmax loss-weighting still outperformed cumulative maximum approaches in final classification accuracy.
• A critical deployment takeaway is that infrastructure reliability is a security requirement, since implementation bugs can create functional jailbreaks.

Even perfect classifiers become ineffective when compromised by implementation bugs.