Earlier this year, Anthropic published research on Constitutional Classifiers, with a straightforward core idea: using AI-generated synthetic data to train safety classifiers and prevent AI models from being jailbroken.
How it works
The system architecture is dual-layered—input classifiers and output classifiers work simultaneously, monitoring every interaction with the model in real time. The training data is not manually labeled; instead, a set of "constitutional" rules (natural language guidelines) is given to the LLM, allowing it to automatically generate various attack scenarios and corresponding judgments.
Real-world performance
In over 3,000 hours of red-teaming, no one found a universal jailbreak method.
The first generation reduced the jailbreak success rate from 86% to 4.4%, blocking 95% of attacks. The two main attack strategies identified by red teams were:
- Recomposition attacks: breaking harmful information into seemingly harmless fragments and then reassembling them
- Obfuscation attacks: making the model output sensitive content in disguised formats
The upgraded Constitutional Classifiers++ goes further—a two-stage architecture that first uses a lightweight probe to check Claude's internal activation states, and only deploys a heavy classifier when suspicious activity is detected. Out of 198,000 red-team attempts, only 1 high-risk vulnerability was found, and still no universal jailbreak method.
What's the cost?
In production, the false rejection rate increased by only 0.38 percentage points, with a 23.7% increase in inference overhead. For a safety system, this is a very reasonable trade-off.
Anthropic also released a new version of Claude's constitution in January under a CC public domain license, with priorities ranked from highest to lowest: safety and human oversight → ethical behavior → Anthropic guidelines → helpfulness. Placing "helpfulness" at the very bottom is a statement in itself.
Sources: CocoLoop, Anthropic Research official paper