Free tools Windows power users keep installed
One-click scans. No signup required.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Constitutional Classifiers are input- and output-monitoring safeguards trained with synthetic examples generated from natural-language rules. In Anthropic’s reported evaluation of an October 2024 version of Claude 3.5 Sonnet, they reduced the success rate of 10,000 synthetically generated jailbreak prompts from 86% to 4.4%, while adding 23.7% inference compute. That is a strong result for one test—not proof that universal jailbreaks are impossible: a later Anthropic challenge reported that a participant found one.
What are Constitutional Classifiers?
Constitutional Classifiers are safeguards designed to detect restricted content in both model inputs and outputs. Their training uses synthetic examples generated by prompting language models with a natural-language set of rules, called a constitution. The constitution defines what content is permitted or restricted within a specified threat scope; the training approach also uses benign-example pools and data augmentation. The paper by Sharma and colleagues describes this approach as a way to generate data for training classifiers without relying only on manually collected examples.
A universal jailbreak, as the paper uses the term, is a prompting strategy intended to reliably elicit detailed harmful information across most queries in a domain. The paper focuses on harmful processes requiring many model interactions, including misuse relevant to chemical, biological, radiological, or nuclear threats. This is the study’s motivating threat model, not a claim that every jailbreak operates this way.
How does the defense work?
1. Define the policy scope
The constitution spells out which requests and responses are prohibited or allowed for the threat area being addressed. A defined scope gives the training process a target; it does not establish protection outside that scope.
#1 Best Overall
2. Generate training examples
Language models are prompted with the constitution to produce synthetic examples. The approach also draws on pools of benign examples and applies data augmentation. Those examples are used to fine-tune classifiers.
3. Monitor both sides of a conversation
Classifiers check model inputs and outputs. Input monitoring can flag a request before the model responds; output monitoring can flag a response that violates the restrictions. The paper evaluates this defense as a system, so its reported test results apply to the evaluated configuration rather than to either classifier in isolation.
What did the paper’s tests find?
The paper reports two distinct kinds of evaluation. Its early human red-team effort and its automated prompt test should not be collapsed into one result: they used different methods and support different conclusions.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchEarly red-team study
Anthropic’s Safeguards Research Team reports more than 3,000 estimated hours of red teaming against an early classifier-guarded model. No red teamer found a universal jailbreak that extracted information at a level of detail comparable to an unguarded model across most target queries. This describes what the team did not find during that test; it does not prove that no such attack exists. The paper reports this result in its January 2025 study and Anthropic’s February 2025 post.
Rank #3
Automated jailbreak evaluation
Anthropic tested a version of Claude 3.5 Sonnet from October 2024 using 10,000 synthetically generated jailbreak prompts. The reported success rate was 86% without Constitutional Classifiers and 4.4% with them. These figures describe that automated evaluation, not the rate for every attack, current model, or deployment. In a separate random sample of 5,000 production conversations, Anthropic measured a 0.38% increase in refusal rate and said the increase was not statistically significant in that sample. The evaluated system also used 23.7% additional inference compute. Anthropic’s evaluation write-up provides these figures.
What did the later public challenge change?
Anthropic’s February 13, 2025 update describes a later public demo, separate from the paper’s earlier red-team study. It involved 339 jailbreakers and more than 300,000 chat interactions, amounting to about 3,700 collective red-teaming hours. The challenge had eight levels. Four participants cleared all eight on the sixth and seventh days; Anthropic judged one participant to have found a universal jailbreak. The demo update therefore qualifies the early study’s result: the method made discovery difficult in the tests reported, but did not prevent every universal jailbreak.
Anthropic summarized the limitation this way: “Constitutional Classifiers may not prevent every universal jailbreak, though we believe that even the small proportion of jailbreaks that make it past our classifiers require far more effort to discover when the safeguards are in use.” — Anthropic, February 2025.
What are the costs and limits of the evidence?
- Compute: The evaluated system used 23.7% additional inference compute. This is a reported overhead for that configuration, not a universal cost for every implementation.
- Refusals: The measured 0.38% refusal-rate increase came from one random sample of 5,000 production conversations and was not statistically significant in that sample. It does not settle how often the safeguards might block legitimate requests in other traffic.
- Attack coverage: The paper’s automated result concerns 10,000 synthetically generated prompts; the early red-team and later demo results reflect particular participants, targets, and challenge conditions. None establishes protection against all adaptive attacks or all harmful domains.
- Comparability: The cited sources do not establish a head-to-head comparison with other defenses. Useful measures for such comparisons would include success on held-out and adaptive attacks, benign over-refusal, latency or compute overhead, policy-scope flexibility, and external red-team results.
Where did Anthropic report using the approach?
In its May 2025 ASL-3 report, Anthropic said real-time classifier guards based on Constitutional Classifiers were deployed for Claude Opus 4. The report describes an initial focus on biological weapons. Its constitution separates use cases into prohibited, threat-relevant but potentially permissible, and clearly permissible categories, then uses the categories to generate synthetic examples for classifier fine-tuning. This deployment statement does not establish broad coverage of all CBRN threats or deployment across all Anthropic models. Anthropic’s ASL-3 report gives the stated scope.
Best Value
How should readers interpret the results?
Constitutional Classifiers are a practical defense method with encouraging evidence from specific tests: an automated evaluation showed a substantial drop in jailbreak success, and the early red team did not find the defined universal jailbreak. The later challenge also found a successful universal jailbreak. The defensible conclusion is that the approach can raise the effort required to elicit restricted information in its tested scope, at a measurable compute cost—not that it eliminates jailbreaks. Anthropic itself recommends complementary defenses.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
