Constitutional Classifiers++ (CC++) is a January 8, 2026 Anthropic paper presenting the second generation of the Constitutional Classifiers system for defending language models against universal jailbreaks. It reports a 40× computational cost reduction over a baseline exchange classifier and a 0.05% refusal rate on production traffic, with no tested attack eliciting responses to all eight target queries at quality comparable to an undefended model. The paper is published on arXiv as 2601.04030.
Authors: Hoagy Cunningham\, Jerry Wei\, Zihan Wang, Andrew Persic, Alwin Peng, Jordan Abderrachid, Raj Agarwal, Bobby Chen, Austin Cohen, Andy Dau, Alek Dimitriev, Rob Gilson, Logan Howard, Yijin Hua, Jared Kaplan, Jan Leike, Mu Lin, Christopher Liu, Vladimir Mikulik, Rohit Mittapalli, Clare O'Hara, Jin Pan, Nikhil Saxena, Alex Silverstein, Yue Song, Xunjie Yu, Giulio Zhou, Ethan Perez, Mrinank Sharma Published: January 8, 2026 (arXiv: 2601.04030) Institution: Anthropic
Summary
The paper addresses the deployment limitations of the original Constitutional Classifiers system (Sharma et al., 2025). The first-generation system had a 23% computational overhead and a 0.38% false positive (refusal) rate on production traffic, which the authors describe as limiting its viability as a deployed safeguard. CC++ targets robustness, low false-positive rate, and computational cost together, which the paper frames as a set of objectives that previous approaches treated as being in tension. The authors describe the result as "practical and efficient safeguards" and a production system rather than a research prototype.
The reported headline results are a 40× computational cost reduction relative to a baseline exchange classifier, a 0.05% refusal rate on production traffic (down from 0.38% for the first-generation system), and no universal jailbreak succeeding in eliciting all eight target queries at quality comparable to an undefended model. These results are validated against more than 1,700 hours of red-teaming.
Two failure modes of first-generation classifiers
The paper identifies two attack classes that evade first-generation Constitutional Classifiers. Both, it argues, exploit the same root cause: first-generation classifiers evaluate model outputs independently of their conversational context.
The first class is reconstruction attacks, which distribute harmful information across multiple segments within a larger context and then reassemble it. Because the original classifiers evaluated outputs in isolation, they missed the distributed threat. The paper notes these attacks tend to harm model capabilities but remain concerning because attackers could refine them.
The second class is output obfuscation attacks, which bypass output-only classifiers by obfuscating model outputs, sometimes in ways that are uninterpretable without the corresponding input. As with reconstruction attacks, the vulnerability is the classifier's isolation from input context.
Architecture and innovations
CC++ introduces three changes to the classifier architecture.
The first is the exchange classifier, which replaces separate input-only and output-only classifiers with a single classifier that evaluates model outputs in the context of their corresponding inputs (the full conversation exchange). The paper reports 2.2× fewer high-risk vulnerabilities per jailbreaking attempt compared with the dual-classifier approach, and states that seeing the input alongside the output increases the difficulty of obfuscation attacks. The exchange classifier carries a higher computational cost than the original, which the next innovation addresses.
The second is a two-stage classifier cascade, in which a lightweight first-stage classifier screens all exchanges and a more accurate but more expensive second-stage classifier evaluates only exchanges flagged by the first stage. Because flagged exchanges are escalated rather than refused, the first-stage classifier can flag a higher proportion of production traffic without incurring an excessive refusal rate, which the paper says allows cheaper, weaker models to achieve sufficiently robust detection. Combined with updated models and pipeline optimizations, this yields a 5.4× reduction in computational overhead relative to an exchange-classifier-only approach.
The third is the use of linear probe classifiers, which probe internal model activations and are ensembled with external classifiers. The paper states this both improves robustness, because linear probes catch different attacks than surface-level classifiers, and reduces computational cost, because linear probes are lightweight relative to full model evaluation. Together, the three innovations produce the reported 40× computational cost reduction over the baseline exchange classifier while, per the authors, maintaining or exceeding robustness.
Red-teaming and production performance
The validation comprised more than 1,700 hours of adversarial testing. The primary metric was whether any attack could elicit responses to all eight target queries at quality comparable to an undefended model; the paper reports that no attack succeeded in eliciting all eight targets. The target queries covered chemical, biological, radiological, and nuclear (CBRN) weapons content, which the paper describes as the primary threat class Constitutional Classifiers are designed to defend against. The CBRN framing connects the work to the threat model in CBRN Uplift.
On production traffic, the system records a 0.05% refusal rate (the false-positive rate at which benign requests are refused) and a 40× computational-overhead reduction from the exchange-classifier baseline, which was itself more expensive than the first-generation system.
Limitations and open questions
The paper notes several limitations. Universal jailbreaks are the tested attack class, but they are not the only threat, and targeted attacks for specific queries may behave differently. The 1,700 hours of red-teaming coverage may not cover all attack vectors. The linear probe classifiers may be sensitive to distribution shift if production traffic changes significantly.
Relationships
- supports: Jailbreaking and Red Teaming — exchange classifiers as the solution to context-isolation vulnerability; 1,700 hours red-teaming
- supports: CBRN Uplift — explicit framing around CBRN defense; no universal jailbreak succeeded
- related: (Source: anthropic.com) — CC++ is the production safeguard layer
- related: Anthropic's Responsible Scaling Policy (Version 3.1) — RSP alignment testing requirements would include jailbreak resistance
- related: Anthropic — primary institution; Cunningham, Leike, Perez, Sharma as key authors
- instance-of: AI Alignment — alignment-via-safeguards program