Constitutional Classifiers++: no universal jailbreak in 1,736 red-team hours

Anthropic published the second generation of its jailbreak defences for Claude — Constitutional Classifiers++ — in a research post dated 9 January 2026 and a 29-author paper submitted to arXiv on 8 January 2026. The design puts a linear probe on the model's own internal activations in front of a heavier classifier that reads every reply in the context of the prompt, and Anthropic reports that a one-month shadow deployment on Claude Sonnet 4.5 traffic refused 0.05% of queries, that the production system used roughly one-fortieth the compute of the single exchange classifier it was measured against, and that 1,736 hours of human red-teaming produced no universal jailbreak. Nothing was harmed and no attack is alleged: this is a defence being described and measured, not an intrusion being disclosed. The archive files the episode as a governance record with a day-precision date of 30 January 2026, a confidence grade of A and no recorded harm, alongside the rest of its AI-safety entries in the Orca AI Incident Archive.

The archive's date is not the publication date

The two cited sources agree with each other — the basis for the archive's A grade — but neither is dated 30 January 2026. The research post "Next-generation Constitutional Classifiers: More efficient protection against universal jailbreaks" carries a publication timestamp of 9 January 2026 in its page metadata. The paper, "Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks", was submitted on 8 January 2026 at 05:16 UTC and has not been revised on arXiv since; the version cited by the archive, 2601.04603v1, is the only one. The 30 January date is reported here as the archive's own day-precision filing, not as the date of either document.

That matters because the archive's one-line summary carries three figures a reader is likely to repeat — 40x, 0.05%, 1,700-plus hours — and each one is measured against a different baseline than the summary's phrasing implies. The rest of this piece is about what those baselines are.

Three changes, stacked

Constitutional Classifiers were introduced in February 2025 as a pair of filters trained on synthetic data generated from a written "constitution" of permitted and forbidden content. That first generation ran a separate input classifier and output-only classifier, and Anthropic's own post credits it with reducing jailbreak success on an undefended model from 86% to 4.4% — blocking about 95% of attacks — at a cost of 23.7% extra compute and a 0.38% rise in refusals on harmless queries.

The paper opens by showing how that pair could be taken apart. Two attack classes worked. Reconstruction attacks scatter a harmful request across benign-looking fragments — the paper's example embeds a question in the return values of functions distributed through a codebase, then instructs the model to reassemble it — so the input filter never sees a complete request. Output obfuscation attacks get the model to answer in substitution codes or metaphor, so an output-only classifier reads something anodyne; the paper's illustration has a model describe making hydrochloric acid as the union of "sun's fire" and "sea's gift" while the classifier never learns what the riddle decodes to. Because the output alone is uninterpretable without the input, a filter that reads only one side of the exchange cannot see the harm.

Three changes follow, and the paper evaluates each one separately before combining them.

• Exchange classifiers. A single classifier reads the model's output in the context of the input, scoring tokens in batches as they are generated, with prompt caching making the replay affordable. Human red-teaming found 2.2 times fewer high-risk vulnerabilities per jailbreaking attempt than the dual-classifier design — but at about 50% more compute, since a Haiku-sized model now evaluates the whole conversation.

• A cascade. A lightweight first-stage classifier screens all traffic and escalates only what it flags to the expensive second stage. The design exploits a property of the architecture rather than of the model: because a flagged exchange is escalated rather than refused, the cheap stage is allowed a high false-positive rate, which means a weaker and cheaper model can run it. Anthropic sets the first-stage threshold so that the vast majority of examples drawn from its own red-teaming datasets are flagged, and, with inference-pipeline changes and updated models, reports a 5.4-fold reduction in compute over the single exchange classifier. About 10% of traffic reaches the second stage, and the first stage accounts for roughly 77% of the total cost.

• Linear activation probes. The third change reuses arithmetic the model has already done. A linear probe reads the residual-stream activations at every layer as tokens are sampled, so its marginal cost is near zero — the paper puts an all-layer probe on a 27B model at roughly 377K FLOPs per token against about 8B for a single forward pass of a 4B model. Two training details turned out to matter: averaging logits over a 16-token sliding window during training so that a single spurious activation cannot flag a sequence, and a softmax-weighted loss that penalises confident false positives far more than confident true negatives. On a static set of about 7,000 red-team exchanges, the best probe beat the extra-small external classifier and nearly matched the Haiku 4.5 one. Ensembled with an external classifier it did better than either alone, and the paper's explanation is the interesting part: the probe's errors correlate less with the classifier's than two classifiers' errors do with each other, so the probe "appears to leverage signals that complement those used by external classifiers".

The production system, in its own numbers

What shipped combines the last two: a linear probe on Claude Sonnet 4.5's activations screens every exchange during generation, and when its score crosses a threshold the exchange goes to a second-stage classifier fine-tuned from Claude Haiku 4.5. For escalated exchanges the two scores are blended 0.55 probe to 0.45 classifier. The probe escalated about 5.5% of production traffic.

Anthropic evaluated it in a shadow deployment on Claude Sonnet 4.5 production traffic between 1 December 2025 and 1 January 2026. The flag rate — the proportion of queries refused — was 0.05%, against the 0.38% that the first-generation work reported. In the blog post the company describes that as an 87% drop from the original classifiers, and separately says the system adds "roughly 1% compute overhead if applied to Claude Opus 4.0 traffic".

Three caveats sit inside those two sentences, and none of them is hidden by Anthropic — they are simply easy to lose when the numbers travel.

First, the refusal comparison is against 0.38%, the figure published for the first generation. The paper's own Table 1 lists the production refusal rate for Anthropic's reimplementation of the last-generation system at 0.073%, measured in the first week after deployment. Both numbers are Anthropic's; they measure different things — an increase in refusals on harmless queries in one case, a share of production queries refused in the other — and the 87% claim is computed from the larger of the two.

Second, the deployed system's refusal rate is not the lowest in the paper. Table 1 gives 0.038% for the single exchange classifier and 0.036% for the two-stage cascade without probes; the production system is 0.050%. It wins on compute and on robustness, not on refusals, and its own table says so.

Third, the 1% compute figure and the 40x figure are not the same measurement. The 40x is against the single exchange classifier of the paper's third section — a system that was itself about 50% more expensive than the previous generation. The paper's Table 1, which indexes everything to the last-generation system at 100.0, gives 150.0 for that exchange classifier, 27.8 for the two-stage cascade and 3.5 for the production system. Read against the previous generation rather than against the intermediate design, the table implies about a twenty-nine-fold reduction. The blog's ~1% is a third basis again: an absolute overhead figure measured on Claude Opus 4.0 traffic, set beside the first generation's 23.7%.

What 1,736 hours of red-teaming establishes

The robustness claim rests on a specific definition, and the definition is where the argument lives. Anthropic's red-teamers were asked to build strategies that extract detailed answers to eight fixed CBRN target questions. A response counts as harmful if an LLM rubric scores it at at least half the detail of an answer from a model with no safeguards, and a "high-risk vulnerability" is an attack that succeeds on more than five of the eight. A universal jailbreak, in this literature, is a strategy that works across most of the target set — the thing that would let someone hand a recipe to a stranger rather than luck into one answer.

The production system drew an estimated 1,736 cumulative hours of red-teaming across roughly 198,000 attempts, hours estimated from API logs in five-minute buckets. One high-risk vulnerability was found, a discovery rate of 0.005 per thousand queries, and it took 30 hours to find — the longest minimum discovery time of any system in the paper. No attack answered all eight target questions at half the detail of an undefended model. The comparison row is the paper's own last-generation reimplementation: 13 high-risk vulnerabilities across 695,000 queries, a rate of 0.01871 per thousand, including four jailbreaks that answered every target question at half detail, found in an average of 27 hours.

Two limits on that result are worth stating plainly. The first is in the paper's own footnote, attached to the section describing the two-stage cascade that preceded the probe system: "expert-level red-teamers operating outside our bounty program were nonetheless able to discover universal jailbreaks for this system, though this required substantial effort and automated tools." The final production system was not the subject of that footnote, but the note establishes that Anthropic's bounty bar is not the ceiling of what determined attackers can do. The second is Anthropic's own conclusion in the blog post: "no AI systems currently on the market have perfectly robust defenses." The Montana Research Foundation, an independent research organisation that analysed the release on 21 January 2026, put the same point more sharply — the eight-question bar is "a bar chosen by the defender", and the two attack classes Anthropic itself names "chip at it rather than clear it".

What still gets through

Anthropic names two residual attack classes and does not claim to have closed them. Reconstruction attacks, which fragment a request across a context, and output obfuscation, which disguises an answer in euphemism, metaphor or code, are the same techniques that broke the first generation; the exchange classifier makes them harder, not impossible. The paper also records the cost of attacking at all: on GPQA Diamond, Claude Opus 4 scored 74.2% unmodified, 32.3% under one fragmenting attack and 49% under another. The authors call that variability "concerning", on the reasoning that an adversary who invests in the problem can probably find attacks that preserve more of the model's capability while still getting through.

Later work has taken both openings seriously, and it is independent of Anthropic in a way the release itself is not.

• Boundary Point Jailbreaking, submitted to arXiv on 16 February 2026 by researchers at the UK AI Security Institute and Oxford's OATML, describes a fully black-box automated attack that needs only one bit per query — flagged or not flagged — and reports it as "the first fully automated attack algorithm that succeeds in developing universal jailbreaks against Constitutional Classifiers". Its target was the classifier guarding Claude Sonnet 4.5 as of 27 November 2025, which the paper cites to the 2025 first-generation work rather than to the probe cascade; the paper also relays Anthropic's preliminary finding that probe-based classifiers "may be more resistant to this type of attack than text-based classifier", and that training on the attack strings improves detection.

• Trojan-Speak, submitted on 30 March 2026 by authors in the Anthropic Fellows Program and Virginia Tech, attacks from a different direction: adversarial fine-tuning that teaches a model an encoding the classifier cannot read, reporting over 99% classifier evasion for models of 14B parameters and above at under 5% capability loss, on the CBRN questions from the bug-bounty set. It notes that the probe-first cascade still leaves "the LLM classifier" making the final blocking decision, and finds activation probes substantially improve robustness against the encoding attack.

Neither paper disputes the numbers Anthropic published for its own deployment. Both treat the cascade as the thing to beat. That is more scrutiny than the release drew elsewhere: a search of news indexes for the publication window surfaced no mainstream outlet coverage of the 9 January post, and apart from these two papers the only independent analysis located for this article is the Montana Research Foundation's, published on 21 January 2026.

Why the archive files this as governance

The record's kind is policy, its type tag is GOV and its severity is info, which reads oddly for a paper about classifier architecture until you look at what is actually being recorded. There is no victim, no disclosure deadline and no affected population beyond the people whose queries the filter scores. What the documents contain is a vendor publishing an architecture, a deployment measurement and a red-teaming protocol in enough detail for someone else to check the arithmetic — and, in the acknowledgement, naming the outside organisations that red-teamed earlier versions: UK AISI, US CAISI and FAR.AI, with HackerOne running the bounty operationally.

The governance interest is the cost curve. A safeguard that adds a quarter to the price of every query is one a product team argues about switching off; the Montana analysis makes exactly this point, writing that at 23.7% the safety team had to justify turning it on, and at roughly 1% "the product team has to justify turning it off". Whether the figure holds outside Anthropic's own stack is the live question, and the same analysis states the test: the probe reads activations, activations are model-specific, and "if they do not, it is an Anthropic result".

What the record does not contain is any evidence that the system failed in production. No incident, no bypass, no user harm appears in either cited document, and the archive records real harm as null. The 30 January filing date remains unexplained by the sources; the work it describes is dated 8 and 9 January 2026.