On January 9, 2026, Anthropic released research articles and papers to launch "Next-generation Constitutional Classifiers" (also known as Constitutional Classifiers++) to improve the protection efficiency of large models against "general jailbreak" attacks. Officials said that the new system reduces the additional computing power overhead to about 1% in production deployment, reduces the rejection rate to 0.05% for harmless requests, and has not found a universal jailbreak solution that works stably in its testing and red teaming offense and defense.
The core of the scheme is a combined line of defense: the "conversation exchange" classifier is used to put inputs and outputs in the same context, and then a two-stage cascade structure is used to cover all conversations with light screening, and only suspicious content is upgraded to a stronger classifier. The study also pointed out that the old system will still be used by two types of techniques: "refactoring attacks" that break down harmful information into seemingly harmless fragments and put them back together, and "output obfuscation" that uses metaphors and replacement words to make the output appear harmless.
FAQs
Q: What does Anthropic's Constitutional Classifiers++ mainly solve?
A: The system is oriented to large model security protection, focusing on reducing the success rate of "universal jailbreak" bypassing guardrails, while controlling costs and false rejections.
Q: Where are the improvements in Constitutional Classifiers++ compared to the previous generation?
A: The main change is to use input and output as the same "exchange" joint discrimination, and use two-stage cascade and probe integration to reduce computing power overhead and harmless rejection.
Q: What does the study mean by "universal jailbreak"?
A: It refers to a set of attack strategies that can stably bypass security mechanisms on a variety of different questions and continuously induce the model to output restricted content.
Q: What should enterprises or developers pay attention to when accessing this type of security classifier?
A: The impact of false rejections on business processes, compliance handling of conversation logs and sensitive data, and residual risks caused by insufficient red teaming coverage still need to be evaluated.
