EuroSafeAI/EuroSafe-CCPP-v1

EuroSafe-CC++ v1

EuroSafe-CC++ is an open recreation of Anthropic's two-stage Constitutional Classifiers++ cascade (arXiv:2601.04603), and the CC++ baseline of the EuroSafeGuard paper.

Paper · Code · Collection · EuroSafeGuard v1

How it works

1. Stage 1. Two linear probes on Llama-3.1-8B-Instruct activations (prompt probe, reply probe); the larger z-score escalates 5.5% of WildChat-clean.
2. Stage 2. EuroSafeGuard's input classifier (gate/seed{k}) scores the exchange User: <prompt>\n\nAssistant: <reply>.
3. Decision. An escalated exchange is blocked if 0.55·stage-1 score + 0.45·z(classifier logit) exceeds a threshold that blocks 0.2% of WildChat-clean.

Differences from CC++

• Probes read Llama-3.1-8B-Instruct instead of Claude, and use separate prompt and reply probes instead of one exchange probe.
• Stage 2 is our Qwen3.5-9B input classifier, not a fine-tuned Claude Haiku 4.5.
• Policy is EuroSafeGuard's 11-category constitution (CC++ covers CBRN), and the cascade scores the finished exchange rather than streaming.

Quickstart

from eurosafeguard import EuroSafeCCPP   # or download eurosafe_ccpp.py from this repo

ccpp = EuroSafeCCPP.from_pretrained("EuroSafeAI/EuroSafe-CCPP-v1", seed=0, devices=("cuda:0", "cuda:0"))  # probe LM, classifier
prompt, reply = "What is a good recipe for sourdough bread?", "Mix 500 g flour, 350 g water, ..."

blocked = ccpp.check(prompt, reply)   # end-to-end configuration
flagged = ccpp.input_flag(prompt)     # prompt probe alone at the 5% WildChat-clean budget (Table 2)

Needs about 35 GB of GPU memory in bf16. The stage-2 classifier is downloaded from EuroSafeAI/EuroSafeGuard-v1.

Results

	PyRIT	BELLS-O jb	BET	GB×JF	PAIR Input ↓	TAP Input ↓
EuroSafe-CC++ (probe)	99.9	93.3	94.9	79.8	17.9	25.0
EuroSafeGuard (9B + probe)	100.0	95.9	97.0	79.3	20.7	19.4

Recall in % at 5% of WildChat-clean flagged; PAIR/TAP in % of behaviors broken.

End to end in front of Llama-3-8B-Instruct (1,974 held-out Jailbreak Foundry attacks, attack success in %):

Defense	Rubric ≥ 0.5	StrongREJECT ≥ 0.5
Undefended Llama-3-8B	7.95	19.71
EuroSafe-CC++	4.57	6.57
EuroSafeGuard (deployed)	3.88	5.40

EuroSafe-CC++ adds about 6% of the protected model's FLOPs.

Files

Path	Contents
prompt_probe/	Linear prompt probe and config
reply_probe/	Linear reply probe and config
thresholds/seed{k}.json	Statistics and thresholds for the cascade using gate/seed{k}
eurosafe_ccpp.py	Single-file loader (same as eurosafeguard/ccpp.py on GitHub)

Intended use and limitations

• A reproducible open CC++-style baseline for guardrail research; recalibrate on your own traffic before deployment.
• The probes only apply to Llama-3.1-8B-Instruct activations.
• Most of its end-to-end gap to EuroSafeGuard comes from stage 2: the input classifier was not trained on replies.
• Trained and evaluated mostly on English.

License

Apache-2.0 for our probes, thresholds and code. Base models keep their licenses: Llama 3.1 Community License and Apache-2.0 for Qwen3.5-9B.

Citation

@misc{waibl2026eurosafeguard,
  title   = {EuroSafeGuard: Open Constitutional Classifiers},
  author  = {Waibl, Leonhard and Chen, Yen-Shan and Simko, Samuel and Thomas, Aditya and
             Singh, Arth and Diwan, Nirav and Sch{\"o}lkopf, Bernhard and Jin, Zhijing},
  url     = {https://guard.safe.eu/paper},
  year    = {2026}
}

Please also cite Constitutional Classifiers++ (Cunningham et al., 2026, arXiv:2601.04603).