Saved in:
| Main Authors: | , , , , , , , , , , , , , , , , , , , , , , , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2026
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2601.04603 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866911360301924352 |
|---|---|
| author | Cunningham, Hoagy Wei, Jerry Wang, Zihan Persic, Andrew Peng, Alwin Abderrachid, Jordan Agarwal, Raj Chen, Bobby Cohen, Austin Dau, Andy Dimitriev, Alek Gilson, Rob Howard, Logan Hua, Yijin Kaplan, Jared Leike, Jan Lin, Mu Liu, Christopher Mikulik, Vladimir Mittapalli, Rohit O'Hara, Clare Pan, Jin Saxena, Nikhil Silverstein, Alex Song, Yue Yu, Xunjie Zhou, Giulio Perez, Ethan Sharma, Mrinank |
| author_facet | Cunningham, Hoagy Wei, Jerry Wang, Zihan Persic, Andrew Peng, Alwin Abderrachid, Jordan Agarwal, Raj Chen, Bobby Cohen, Austin Dau, Andy Dimitriev, Alek Gilson, Rob Howard, Logan Hua, Yijin Kaplan, Jared Leike, Jan Lin, Mu Liu, Christopher Mikulik, Vladimir Mittapalli, Rohit O'Hara, Clare Pan, Jin Saxena, Nikhil Silverstein, Alex Song, Yue Yu, Xunjie Zhou, Giulio Perez, Ethan Sharma, Mrinank |
| contents | We introduce enhanced Constitutional Classifiers that deliver production-grade jailbreak robustness with dramatically reduced computational costs and refusal rates compared to previous-generation defenses. Our system combines several key insights. First, we develop exchange classifiers that evaluate model responses in their full conversational context, which addresses vulnerabilities in last-generation systems that examine outputs in isolation. Second, we implement a two-stage classifier cascade where lightweight classifiers screen all traffic and escalate only suspicious exchanges to more expensive classifiers. Third, we train efficient linear probe classifiers and ensemble them with external classifiers to simultaneously improve robustness and reduce computational costs. Together, these techniques yield a production-grade system achieving a 40x computational cost reduction compared to our baseline exchange classifier, while maintaining a 0.05% refusal rate on production traffic. Through extensive red-teaming comprising over 1,700 hours, we demonstrate strong protection against universal jailbreaks -- no attack on this system successfully elicited responses to all eight target queries comparable in detail to an undefended model. Our work establishes Constitutional Classifiers as practical and efficient safeguards for large language models. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2601_04603 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks Cunningham, Hoagy Wei, Jerry Wang, Zihan Persic, Andrew Peng, Alwin Abderrachid, Jordan Agarwal, Raj Chen, Bobby Cohen, Austin Dau, Andy Dimitriev, Alek Gilson, Rob Howard, Logan Hua, Yijin Kaplan, Jared Leike, Jan Lin, Mu Liu, Christopher Mikulik, Vladimir Mittapalli, Rohit O'Hara, Clare Pan, Jin Saxena, Nikhil Silverstein, Alex Song, Yue Yu, Xunjie Zhou, Giulio Perez, Ethan Sharma, Mrinank Cryptography and Security Artificial Intelligence We introduce enhanced Constitutional Classifiers that deliver production-grade jailbreak robustness with dramatically reduced computational costs and refusal rates compared to previous-generation defenses. Our system combines several key insights. First, we develop exchange classifiers that evaluate model responses in their full conversational context, which addresses vulnerabilities in last-generation systems that examine outputs in isolation. Second, we implement a two-stage classifier cascade where lightweight classifiers screen all traffic and escalate only suspicious exchanges to more expensive classifiers. Third, we train efficient linear probe classifiers and ensemble them with external classifiers to simultaneously improve robustness and reduce computational costs. Together, these techniques yield a production-grade system achieving a 40x computational cost reduction compared to our baseline exchange classifier, while maintaining a 0.05% refusal rate on production traffic. Through extensive red-teaming comprising over 1,700 hours, we demonstrate strong protection against universal jailbreaks -- no attack on this system successfully elicited responses to all eight target queries comparable in detail to an undefended model. Our work establishes Constitutional Classifiers as practical and efficient safeguards for large language models. |
| title | Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2601.04603 |