Constitutional Classifiers: Universal Jailbreak Defense

The Anthropic Safeguards Research Team proposed a method to block universal jailbreaks of AI models using Constitutional Classifiers. Classifiers that inspect inputs and outputs together are trained on synthetic data to preemptively block harmful prompts and responses.

The prototype showed strong defense even in human red teaming. 183 participants tried for 2 months, spending over 3,000+ hours, but could not find a universal jailbreak that broke through all 10 forbidden queries at once. However, this early version had issues with excessive overrefusal and high compute overhead.

Automated evaluation of the updated version confirmed a clearer improvement. Against 10,000 synthetic jailbreak prompts, the success rate was 86% without defense, but dropped to 4.4% with Constitutional Classifiers applied. Under the same conditions, the refusal rate increased by only 0.38%, and compute cost rose by about 23.7%.

The mechanism works similarly to Constitutional AI. A constitution containing allowed/forbidden criteria is created, and based on this, large volumes of synthetic prompts and completions are generated with variations in different languages and jailbreak styles, which are then used to train input/output classifiers. Benign queries are also included separately to reduce false positives.

The live demo, run from February 3 to 10, also revealed real-world limitations. 339 people challenged the system with over 300,000 chats, totaling about 3,700 hours of red-teaming. In the end, one participant succeeded in a universal jailbreak that elicited detailed answers to all 8 questions, with bypass methods frequently including ciphers/encodings, role-play, keyword substitution, and prompt injection.

The core message is clear.

• Classifiers trained on large-scale synthetic data significantly strengthen jailbreak defense.
• Increased false positives and additional compute cost remain, but at a limited scale.
• The system may be vulnerable to new attack techniques, requiring complementary defenses to be used alongside it.