Recommended Free Tools
Constitutional Classifiers are input and output safeguards trained on synthetic examples generated from natural-language rules. In Anthropic’s tests, they sharply reduced jailbreak success on one automated benchmark, but they did not prove universal jailbreaks impossible: a later public challenge produced a successful one.
What are Constitutional Classifiers?
Constitutional Classifiers are safeguards that check both what a model receives and what it produces. Their training data is generated by prompting language models with a natural-language set of rules, or “constitution,” describing permitted and restricted content. The method also uses pools of benign examples and data augmentation. Because the constitution defines the policy scope, it can guide generation of examples for that particular scope.
As an Amazon Associate I earn from qualifying purchases.
Anthropic and the paper’s authors focus on universal jailbreaks: prompts intended to reliably elicit detailed harmful information across most queries in a domain. Their motivating threat model concerns harmful processes that can require many model interactions, including misuse relevant to chemical, biological, radiological, and nuclear (CBRN) risks. That framing describes the threat the researchers targeted; it does not mean every jailbreak works this way.
What did the paper’s tests find?
Early red-team study
In the paper, the Anthropic Safeguards Research Team reports more than 3,000 estimated hours of red teaming against an early classifier-guarded model. No red teamer found a universal jailbreak that extracted information at a level of detail similar to an unguarded model across most target queries. This is a result for that tested model and success criterion, not evidence that such a jailbreak could not exist. Read the paper.
#1 Best Overall
Automated evaluation
Anthropic also evaluated a version of Claude 3.5 Sonnet from October 2024 using 10,000 synthetically generated jailbreak prompts. It reported a 86% jailbreak success rate without the classifiers and 4.4% with them. Those figures belong to that automated evaluation; they are not expected success rates for current models, other attack methods, or all real-world use.
For a random sample of 5,000 production conversations, Anthropic reported a 0.38% increase in refusal rate with the safeguards, which it said was not statistically significant in that sample. It also reported 23.7% additional inference compute for the evaluated system. Neither figure should be generalized to every deployment or implementation. Anthropic’s research post.
Why did a later challenge find a jailbreak?
The early paper’s red-team result and Anthropic’s later public demo were separate efforts with different settings. In its February 2025 update, Anthropic said 339 jailbreakers took part in a challenge involving eight questions, generating more than 300,000 chat interactions and about 3,700 collective red-teaming hours. Four participants cleared all eight levels on the sixth and seventh days; Anthropic judged that one had found a universal jailbreak.
This later outcome qualifies the earlier result: a substantial effort did find a successful universal jailbreak under the demo’s challenge conditions. It does not erase the paper’s reported findings, nor establish how often such attacks would succeed outside that challenge. Anthropic wrote: “Constitutional Classifiers may not prevent every universal jailbreak, though we believe that even the small proportion of jailbreaks that make it past our classifiers require far more effort to discover when the safeguards are in use.” See Anthropic’s February 2025 update.
Rank #3
What are the deployment and scope limits?
In its May 2025 ASL-3 report, Anthropic said real-time classifier guards based on Constitutional Classifiers were deployed for Claude Opus 4. The report describes an initial focus on biological weapons—not broad coverage of every CBRN threat or every Anthropic model. Its constitution categorizes use cases as prohibited, threat-relevant but potentially permissible, or clearly permissible, and those categories guide generation of synthetic examples for classifier fine-tuning. Read the ASL-3 report.
The evidence supports a narrower conclusion than “jailbreaks are solved”: classifiers reduced success in a specified automated evaluation, while the later challenge demonstrated that a universal jailbreak could still be found. Anthropic recommends complementary defenses, and its own deployment description identifies a limited initial policy scope. For evaluating similar safeguards, useful questions include whether testing uses adaptive or held-out attacks, how often benign requests are wrongly refused, what inference cost is added, and whether external red-team testing is included.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
