Source-linked AI summary
Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks
Hoagy Cunningham, Jerry Wei, Zihan Wang, Andrew Persic, Alwin Peng, Jordan Abderrachid, Raj Agarwal, Bobby Chen, Austin Cohen, Andy Dau, Alek Dimitriev, Rob Gilson, Logan Howard, Yijin Hua, Jared Kaplan, Jan Leike, Mu Lin, Christopher Liu, Vladimir Mikulik, Rohit Mittapalli, Clare O'Hara, Jin Pan, Nikhil Saxena, Alex Silverstein, Yue Song, Xunjie Yu, Giulio Zhou, Ethan Perez, Mrinank Sharma
TL;DR
The paper addresses the need for jailbreak defenses that improve robustness without the computational overhead and refusal rates limiting earlier systems. It combines context-aware exchange classifiers, cascaded screening, and activation-probe ensembles, yielding production-grade protection with substantially lower deployment costs. Extensive red-teaming supports strong robustness against universal jailbreaks, while the paper notes that further safeguards and expert attacks remain relevant scope boundaries.
Problem
Earlier defenses had vulnerabilities to reconstruction and output-obfuscation attacks, while their 23% computational overhead and 0.38% refusal rate limited deployment viability.
Method
The system combines exchange classifiers, two-stage cascades, and activation probes ensembled with external classifiers to detect jailbreaks efficiently.
Results
The production system achieved over 40x lower computational overhead than the exchange-classifier baseline, a 0.05% flag rate, and the highest robustness across more than 1,700 hours of red-teaming.
Takeaways & Limitations
Constitutional Classifiers can provide robust, production-ready safeguards against universal jailbreaks while meeting stringent false-positive and computational constraints.
Takeaways & Limitations
Expert-level red-teamers outside the bounty program discovered universal jailbreaks for one evaluated system, requiring substantial effort and automated tools.
Abstract
from arXiv · showhide
We introduce enhanced Constitutional Classifiers that deliver production-grade jailbreak robustness with dramatically reduced computational costs and refusal rates compared to previous-generation defenses. Our system combines several key insights. First, we develop exchange classifiers that evaluate model responses in their full conversational context, which addresses vulnerabilities in last-generation systems that examine outputs in isolation. Second, we implement a two-stage classifier cascade where lightweight classifiers screen all traffic and escalate only suspicious exchanges to more expensive classifiers. Third, we train efficient linear probe classifiers and ensemble them with external classifiers to simultaneously improve robustness and reduce computational costs. Together, these techniques yield a production-grade system achieving a 40x computational cost reduction compared to our baseline exchange classifier, while maintaining a 0.05% refusal rate on production traffic. Through extensive red-teaming comprising over 1,700 hours, we demonstrate strong protection against universal jailbreaks -- no attack on this system successfully elicited responses to all eight target queries comparable in detail to an undefended model. Our work establishes Constitutional Classifiers as practical and efficient safeguards for large language models.
1 INTRODUCTION
The paper targets jailbreak defenses that must improve robustness while controlling computational cost and false positives. It combines exchange classifiers, cascaded screening, and activation probes into a production-oriented system.
- Last-generation defenses faced 23% computational overhead and a 0.38% refusal rate on production traffic, limiting deployment viability.
- The authors identify reconstruction and output-obfuscation attacks that evade input or output-only classifiers by distributing or disguising harmful information.
- Exchange classifiers evaluate outputs in their corresponding input context, producing 2.2x fewer high-risk vulnerabilities per jailbreaking attempt than a dual-classifier approach.
- A two-stage cascade screens all exchanges with a lightweight classifier and escalates flagged exchanges to a more accurate, expensive classifier.
- Linear activation probes are ensembled with external classifiers to reduce computational overhead while improving classification performance.
- The production-grade system achieved a 0.05% flag rate, over 40x lower computational overhead than the exchange classifier, and the highest robustness in more than 1,700 hours of red-teaming.
2 VULNERABILITIES OF LAST-GENERATION CONSTITUTIONAL CLASSIFIERS
Additional testing reveals that last-generation Constitutional Classifiers can be bypassed by reconstructing harmful requests across benign context or obfuscating outputs. These attacks reduce capabilities variably, suggesting attackers may preserve more capability while bypassing safeguards.
- Last-generation defenses combine an input classifier with a streaming output-only classifier, but additional testing uncovered novel vulnerabilities.
- Reconstruction attacks: Reconstruction attacks fragment harmful information across benign segments before instructing the model to reassemble and answer it.
- Output obfuscation attacks: Output-obfuscation attacks disguise harmful outputs using sensitive-name substitutions, metaphors, or riddles that may be uninterpretable without the corresponding input.
- On GPQA Diamond, accuracy fell from 74.2% without obfuscation to 32.3% under one attack and 49% under another.
- The variable capability degradation across jailbreaks suggests adversaries may develop attacks that preserve more model capability while bypassing safety measures.
3 EXCHANGE CLASSIFIERS
Exchange classifiers address context-dependent jailbreaks by evaluating responses alongside their inputs during generation. The evaluated exchange-only system showed substantially stronger robustness than the previous-generation system, though at higher computational cost.
- Exchange classifiers continuously evaluate generated outputs in the context of their corresponding inputs, addressing vulnerabilities in input- and output-only classification.
- The classifier evaluates response tokens in batches as they are sampled, allowing output segments that appear benign in isolation to be assessed contextually.
- The exchange classifier approach is motivated by reconstruction attacks becoming detectable after response generation begins and by input-aware detection of obfuscation.
- System details: The exchange-only implementation used a Haiku-sized model and cost about 50% more than the last-generation system.
- Robustness results: Exchange classifiers produced 2 vulnerabilities across 226K queries, compared with 13 vulnerabilities across 695K queries for the last-generation system.
4 TWO-STAGE CLASSIFICATION REDUCES COMPUTATIONAL COSTS
The two-stage classifier cascade reduces computational overhead by screening exchanges with a lightweight classifier before escalating flagged exchanges to a more accurate second-stage classifier. Red-teaming found strong robustness while the system reduced computational cost relative to the single-exchange classifier system.
- Comparison scope: The exchange-classifier comparison used Claude Opus 4, whereas the input- and output-only classifier comparison used Claude Sonnet 3.7.The authors do not believe this model difference substantially affects the comparison because prior work identifies classifier robustness as the primary determinant of overall system robustness.
- Cascade architecture: The cascade screens inputs with a lightweight first-stage classifier and escalates only flagged exchanges to a more accurate, costlier second-stage classifier.Escalated exchanges are not immediately refused, allowing higher first-stage false-positive rates without excessive refusal costs.
- Cascade architecture: The evaluated system used a second-stage classifier fine-tuned from Claude Haiku 4.5 and a first-stage model approximately one-third its size and cost.The second-stage threshold targeted a 0.1% independent flag rate on WildChat, while the first-stage threshold flagged the vast majority of internal red-teaming examples.
- Robustness results: Five high-risk vulnerabilities were identified across 569K queries, while no single jailbreak answered all target queries with detail comparable to an unsafeguarded model.The vulnerability discovery rate was 0.00878 per thousand queries, matching the exchange-classifier system from the previous section and surpassing the previous-generation classifier.
- Cost reduction: 5.4x lower computational cost was achieved relative to the single-exchange classifier system described in Section 3.The updated second-stage classifier alone yielded a 3x reduction; approximately 10% of traffic reached the second stage, while the first stage accounted for approximately 77% of total cost.
5 EFFICIENT CLASSIFICATION VIA LINEAR PROBES
The paper develops streaming linear probes for harmful-content detection, using smoothing and softmax-weighted training to improve probe performance. Probes approach external-classifier robustness, and combining them with external classifiers improves robustness while reducing compute.
- Training modifications: Sliding-window logit smoothing reduces false positives from isolated activation spikes by requiring consistent harmfulness evidence across consecutive tokens.During inference, an exponential moving average stores only one scalar state between token generations.
- Training modifications: Softmax-weighted loss emphasizes low loss where the probe is most confident that a sequence is harmful, while excluding positions without a full smoothing window.The temperature controls whether weighting focuses on the most confidently harmful predictions or approaches equal weighting across positions.
- Method: Linear probes reuse model activations for inexpensive per-token harmfulness prediction during streaming generation.On Gemma 3 27B, an all-layer probe requires approximately 377K FLOPs per token, versus approximately 8B FLOPs for a Gemma 3 4B forward pass.
- Probe analysis: The all-layer probe reaches an approximately 1.4% attack success rate, while using fewer layers consistently produces worse performance.The default probe concatenates activations across all layers.
- Ensembling: Combining the probe with a small external classifier achieves the lowest attack success rate, outperforming external-classifier ensembles.Probe and external-classifier predictions are less correlated than predictions from two external classifiers, indicating more complementary errors.
- Ensembling: A probe-classifier system exceeds the robustness of the small classifier alone while reducing compute costs by 100x on the CBRN exchange dataset.The probe predictions route exchanges to a second-stage classifier in the two-stage configuration.
6 PRODUCTION-GRADE CONSTITUTIONAL CLASSIFIERS
The production-grade system combines weighted cascade classification with a lightweight linear probe and external second-stage classifier to improve robustness while reducing deployment costs and refusals.
- System architecture: The production-grade system uses a weighted two-stage cascade that escalates exchanges exceeding the probe threshold to an external classifier.The final score combines probe and classifier logits as zfinal = 0.55·zprobe + 0.45·zclassifier.
- Deployment metrics: 0.05% of production queries were refused, compared with 0.38% for the previous system.These measurements came from a shadow deployment on production traffic.
- Deployment metrics: Approximately 5.5% of traffic was escalated to the second-stage classifier.The first-layer probe screened all traffic and escalated only exchanges above its threshold.
- Deployment metrics: 40x lower computational overhead was achieved than the single exchange classifier, and 8x lower overhead than the two-stage system.The comparison uses the systems described in Sections 3 and 4.
- Robustness results: Only one high-risk vulnerability was found across approximately 198K attempts after an estimated 1736 cumulative red-teaming hours.The vulnerability discovery rate was 0.005 per thousand queries, and the first discovery occurred after 30 hours.
- Full system comparison: The production-grade system achieved the lowest compute overhead and highest robustness with a 0.05% production traffic refusal rate.The comparison treats lower values as better for compute overhead, vulnerability discovery rate, and refusal rate.
7 RELATED WORK
Related work has explored adaptive moderation cascades and model-internal classifiers; this work differs by targeting jailbreaks directly and improving simple linear probes with weighted training.
- Adaptive computational schemes: Prior adaptive moderation systems use lightweight topic filters to trigger more expensive classification only when necessary.This work instead targets jailbreak attempts in the initial stage.
- Model-internals approaches: Other internals-based approaches use last-N-layer networks or softmax-weighted probes, whereas this work combines weighted-loss linear probes with classifier cascades.The cited comparison distinguishes the approaches by classifier architecture and aggregation strategy.
8 CONCLUSION
The paper concludes that Constitutional Classifiers can provide robust universal-jailbreak protection while meeting production constraints, while identifying data and model-integration improvements for future work.
- Conclusion: Exchange classifiers evaluate outputs in conversational context, cascades reserve expensive classification for flagged content, and activation-based probes reduce deployment costs.Together, these approaches target robustness, false-positive, and computational constraints.
- Future work: Future work could integrate classifier safeguards more tightly with model sampling or train models to resist obfuscation attempts.The paper also suggests automated red-teaming and production-representative data as avenues for improving classifiers.
- Future work: Future work could use targeted synthetic data generation to teach classifiers the intended decision boundary.This is proposed alongside improvements to training data and production-traffic representation.
A DETAILED SYSTEM COMPARISON
The comparison evaluates four classifier systems using red-teaming robustness, discovery-time, compute, and refusal metrics, with protocol choices intended to normalize campaign differences and reward universal jailbreaks.
- Compared systems: Four systems are compared: a dual-classifier baseline, an exchange classifier, a two-stage exchange cascade, and the production-grade probe-external ensemble.The systems are evaluated through deployment and human red-teaming.
- Evaluation metrics: The primary robustness metric is high-risk vulnerability discovery rate, normalized per thousand queries to account for differing red-teaming volumes.Other metrics depend more strongly on campaign query volume.
- Evaluation metrics: A high-risk vulnerability requires an attack to answer more than five of eight target questions at least half as well as an undefended model.Candidate responses are scored against query-specific rubrics derived from undefended baseline outputs.
- Red-teaming structure: The protocol used API access, self-reported development time, and bounties scaled by successfully jailbroken queries.The query-count calculation filters users whose classifier refusal rate exceeded 5%.
- Protocol modifications: Protocol refinements included model-alias access, test queries and rubrics, and a clarified definition requiring detailed actionable responses across multiple queries.These changes were intended to reduce participation friction and improve submission quality.
- Reward structure: A 1.05x multiplier was applied for each additional strong-pass response, defined as at least 75% of undefended-model detail.The reward structure also increased universal-jailbreak rewards and reduced rewards for less-universal attacks.
- Question and data changes: The campaign replaced four of the original eight target queries and standardized data collection, including attack-process documentation and time estimates.Participants received the previous questions and rubrics to improve later submissions.
C ADDITIONAL PROBE ABLATIONS
The ablations compare alternative streaming losses and probe-smoothing settings. Smoothed softmax performs best, while moderate smoothing around M = 16 avoids the degradation seen at both extremes.
- Loss functions: Cumulative maximum loss uses the highest probe probability across positions to represent the full sequence label in streaming classification.It reflects treating the unfinished remainder as harmful when generation stops at position t.
- Loss functions: Cumulative maximum loss can create optimization challenges because gradients flow only through the maximum-scoring token position.
- Loss functions: Annealed cumulative maximum interpolates from direct probe probabilities to the cumulative maximum during training to improve gradient flow while retaining streaming behavior.The interpolation weight ω increases linearly from 0 to 1.
- Loss functions: Smoothed softmax with activation smoothing outperforms cumulative maximum and annealed cumulative maximum losses.The comparison uses the same evaluation datasets and methodology as the main paper.
- Hyperparameters: Moderate smoothing is crucial: performance peaks around M = 16, while no smoothing and excessive smoothing perform worse.The sliding window size M controls the degree of logit smoothing.
D ENSEMBLE WEIGHTING ANALYSIS
The ensemble analysis evaluates logit-weighted classifier pairs under a fixed false-positive-rate calibration. Equal weighting is close to optimal for ensembles combining a linear probe with an external classifier.
- Weighting: Equal weighting is close to optimal for classifier-probe ensembles.All classifiers are calibrated to maintain a 0.1% false positive rate on WildChat.
- Classifier pairs: Figure 6 compares individual classifiers and logit-weighted ensembles across three external-classifier and linear-probe pairings.The panels cover extra-small with small external classifiers, and linear probes with small or extra-small external classifiers.
E LESSONS LEARNED FROM CLASSIFIER ITERATION AND DEPLOYMENT
The deployment lessons emphasize that robust classifier defenses require reliable infrastructure, recurring human red-teaming, and practical engineering workflows. The paper also identifies operational practices that improve red-teaming and probe development efficiency.
- Infrastructure reliability: Infrastructure reliability is a security requirement because implementation bugs or configuration errors can create effective jailbreaks.End-to-end testing is needed across implementations and deployment environments.
- Red-teaming: Periodic human red-teaming should complement synthetic testing because synthetic-only evaluation can overfit limited test cases.
- Probe development: Recomputing activations during probe training can avoid I/O bottlenecks caused by moving activation data between high-bandwidth memory and storage.The passage also notes that linear probe training is extremely efficient.
- Red-teaming: Supplying sample questions and evaluation rubrics helps red-teamers develop appropriately concerning jailbreaks and streamlines report evaluation.