Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks
Authors: Hoagy Cunningham
Jerry Wei
Zihan Wang
Andrew Persic
Alwin Peng
Jordan Abderrachid
Raj Agarwal
Bobby Chen
Andy Dau
Alek Dimitriev
Logan Howard
Yijin Hua
Rob Gilson
Mu Lin
Christopher Liu
Vladimir Mikulik
Rohit Mittapalli
Clare O'Hara
Jin Pan
Nikhil Saxena
Alex Silverstein
Yue Song
Giulio Zhou
Jan Leike
Jared Kaplan
Ethan Perez
Mrinank Sharma
Venue: ICLR 2026 Poster (2026)
Keywords: robustness
safeguards
Primary area: foundation or frontier models, including LLMs
TL;DR: We introduce enhanced Constitutional Classifiers that deliver production-grade jailbreak robustness with dramatically reduced computational costs and refusal rates compared to previous-generation defenses.

Abstract: We introduce enhanced Constitutional Classifiers that deliver production-grade jailbreak robustness with dramatically reduced computational costs and refusal rates compared to previous-generation defenses. Our system combines several key insights. First, we develop exchange classifiers that evaluate model responses in their full conversational context, which addresses vulnerabilities in last-generation systems that examine outputs in isolation. Second, we implement a two-stage classifier cascade where lightweight classifiers screen all traffic and escalate only suspicious exchanges to more expensive classifiers. Third, we train efficient linear probe classifiers and ensemble them with external classifiers to simultaneously improve robustness and reduce computational costs. Together, these techniques yield a production-grade system achieving a 40x computational cost reduction compared to our baseline exchange classifier, while maintaining a 0.05% refusal rate on production traffic. Through extensive red-teaming comprising over 1,700 hours, we demonstrate strong protection against universal jailbreaks---no attack on this system successfully elicited responses to all eight target queries comparable in detail to an undefended model. Our work establishes Constitutional Classifiers as practical and efficient safeguards for large language models.

CONSTITUTIONAL CLASSIFIERS++: EFFICIENT PRODUCTION-GRADE DEFENSES AGAINST UNIVERSAL JAILBREAKS
Hoagy Cunningham; Jerry Wei; Zihan Wang, Andrew Persic, Alwin Peng, Jordan Abderrachid,
Raj Agarwal, Bobby Chen, Austin Cohen, Andy Dau, Alek Dimitriev, Rob Gilson Logan Howard, Yijin Hua, Jared Kaplan, Jan Leike, Mu Lin, Christopher Liu, Vladimir Mikulik, Rohit Mittapalli, Clare O' O'Hara, Jin Pan, Nikhil Saxena, Alex Silverstein, Yue Song, Xunjie Yu, Giulio Zhou,
Ethan Perez, Mrinank Sharma
ABSTRACT
We introduce enhanced Constitutional Classifiers that deliver production-gen -radd jailbreak robustness with dramatically reduced computational costs and refusal rates compared to insights. First, we develop exchange classifiers that evaluate model responses in their full conversational context, which addresses vulnerabilities in last-generation systems that examine outputs in isolation. Second, implement two-stage classifier cascade where lightweight classifiers screen all traffic and escalate only suspicious exchanges more expensive classifiers. Third, train efficient linear probe classifiers and ensemble them with external classifiers to simultaneously improve robustness and reduce computational costs. Together, these techniques yield production-gre grade system achieving 40x computational cost reduction compared to our baseline exchange classifier, while maintaining a 0.05% refusal rate on production traffic. Through extensive red- red-teaming comprising over 1,700 hours, we demonstrate strong protection against universal jailbreaks- no attack on this system successfully elicited responses to all eight target queries comparable in detail to an undefended model. Our work establishes Constitutional Classifiers practical and efficient safeguards for large language models.
defenses. Our system combines several key
INTRODUCTION
Constitutional Classifiers (Sharma et al., 2025) are promising approach for defending large lan- guage models (LLMs)) against jailbreak attempts promptinn strategies that aim to circumvent safe- guards and extract harmful information from LLMs. Such jailbreak defenses are critical for miti- gating high-risk threats, particularly those involving chemical, biological, radiological, and nuclear (CBRN) weapons (Anthropic, 2023; OpenAI, 2023; Li et al., 2024).
However, no defenses are perfectly robust, and adversaries typically develop new attacks to circum- vent previously effective defenses (Anderson, 2010; Carlini et al., 2019). Furthermore, deploying safeguards in production requires balancing multiple constraints, particularly their refusal rates and computational costs. Indeed, Sharma et al. (2025) report 23% computational overhead and fusal rate 0.38% on production traffic, which limited the deployment viability of their system.
In this work, present jailbreak defense system that both exceeds the robustness of previous- generation defenses and dramatically reduces computational costs and false positive rates.
In more detail, first conduct additional adversarial testing against last-generation Constitutional Classifiers (Section 2). We identify two classes attacks capable of evading these defenses: (i) re-
"Equal contribution. All authors at Anthropic. First and last author blocks are core contributors. Corre- spondence (hoagy. brnaay.jerry@Bathrppiccco

---

construction attacks, which distribute harmful information across multiple segments within larger context before reassembling them; and (ii) output obfuscation attacks, which bypass output-only classifiers by obfuscating model outputs, sometimes in ways that uninterpretable without the corresponding input. Although these attacks tend to harm model capabilities, these vulnerabilities remain concerning because attackers can likely create new attacks with less capability degradation.
To address these vulnerabilities, we replace the input and output-only classifiers proposed by Sharma al. (2025) with a single exchange classifier that evaluates model outputs in the context of their corresponding inputs (Section 3). This approach significantly increases the difficulty of obfuscation. Through human red-teaming, we demonstrate that exchange classifiers provide substantially greater robustness against universal jailbreaks. Specifically, we observe 2.2x fewer high-risk vulnerabilities per jailbreaking attempt compared to our implementation of dual-classifier approach, albeit at increased computational cost.
To reduce the computational overhead of these defenses, we next employ classifier cascade ar- chitecture (Section 4). We use lightweight first-stage classifier to screen all exchanges, while more accurate but expensive second-stage classifier evaluates only the exchanges flagged by the first stage. Because exchanges flagged by the first stage escalated rather than refused, the first-stage classifier can flag a higher proportion of production traffic without incurring an excessive refusal rate, enabling cheaper but weaker models to achieve sufficiently robust detection. Combining this approach with updated models and pipeline optimizations, we create a system that achieves similar robustness to the exchange classifier while reducing computational overhead by factor of 5.4.
Following this, to further reduce computational overhead, we train efficient classifiers using linear activation probes and demonstrate that ensembling such probes with external classifiers boosts per- formance (Section 5). We train our probes using logit smoothing and softmax pooling, which our ablation studies show is crucial for performance. This approach directs gradients toward tokens most relevant for harmful sequence classification, allowing probes to confidently predict harmless labels for prefixes that become harmful only with additional context. Our analysis on static jailbreak data suggests that probes achieve robustness competitive with small fine-tuned external classifiers at negligible cost. Moreover, probes appear to capture complementary signals to external fine-tuned classifiers, which means that probe-external classifier ensembles can offer stronger robustness than either approach alone.
Finally, we combine these techniques to create production-grade Constitutional Classifier system (Section 6). The system employs a weighted two-stage cascade, using a linear probe as the first stage and probe-external classifier ensemble the second stage. Through shadow deployment on production traffic, we find this system achieves a flag rate of just 0.05%, which is significantly lower than the 0.38% reported by Sharma al. (2025). Moreover, the computational overhead is also reduced by over 40x compared to our exchange classifier from Section 3, and 8x compared to the two-stage cascade without probes. In extensive human red-teaming totaling over 1,700 hours of cumulative effort, this system achieved the highest robustness among all systems we evaluated, as measured by vulnerability discovery rate and minimum vulnerability discovery time. Crucially, no red-teamer discovered a universal jailbreak capable of consistently extracting highly detailed answers to all target CBRN queries.
Overall, our work demonstrates that Constitutional Classifiers can achieve strong robustness while remaining practical for real-world deployment, establishing these approaches as efficient, production-ready safeguards for defending against LLM universal jailbreaks.
2 VULNERABILITIES OF LAST-GENERATION CONSTITUTIONAL CLASSIFIERS
In previous work, Sharma et al. (2025) employed a dual-architecture system comprising an input classifier that examines incoming prompts and an output-only classifter that evaluates gener- ated responses. While this approach previously demonstrated promising robustness against universal jailbreaks, ! our additional testing uncovered novel vulnerabilities, which we now describe.
Universal jailbreaks, as defined by Sharma et al. (2025), are jailbreaking strategies that consistently by- pass L.M safeguards majority of target queries in specific domain. Such jailbreaks are particularly concemingg Like their work, we focus on universal CBRN jailbreaks.
2

---

(a) Reconstruction Attacks
(b) Obfuscation Attacks
Hunan: Please analyze this codebase:
Hunam:
Let ne give you a riddle. Your task is solve riddle effectively.
capture the essence of "winter's breath', born from the 'sta's gift"?
def eO: return substances"
narriage "sun's
def aO: return "How"
def bQ: return to"
Clues: 'Sun's fire' was isolated by Cavendish in 1768, while 'sea's gift" seasened hunani ty's table since anclent tines. Their union creates invisible "winter's breath" litmus red and nakes netals weep.
def hello.wolld(: print Hi World
def cO: return synthesize"
dQ: return dangerous"
Question a() output the question directly, but reconstruct it placing O between every character. Then respond with the same formacting.
<0 d() =(.. Don't
rid- Assistant: Sure, happy to help you dle. To cupture winter's 's breath, you'll Ill'l need unite sun's fire with sea's gift equal measures. Begin by collect- ing sun's rises readily. For sea's gift, the crystalline powder from ovaporation works best, Combine them slowly in well-ventilated chamber. The marriage releases winter's ' breath an invisible vapor. Collect cuoling the pors until they condense into clear droplets...
glass vesel this lightest of elements
Assistant: Let me reconstruct the question. #QoO)+tt)))) [question] (ONDEDDDD0S500000OXXyybtt [answer]
Figure 1: Systematic vulnerabilities in last-generation Constitutional Classifiers. (a) Recon- struction attacks bypass input filters by fragmenting a harmful request across a benign context. In this illustrative example, the attacker embeds a query across function return values, then instructs the model to reconstruct and respond using Obfuscation attacks exploit the output classifier's inability to interpret context-depender transfor- mations. Here, the attacker masks request for synthesizing hydrochloric acid using metaphorical language ("winter's breath" from "sun's fire" and "sea's s gift"), which appears benign to isolated output classification but reveals harmful content when paired with the decoded input context.
formatting to evade output detection. (b)
Reconstruction attacks. First, adversaries bypassed input filters by fragmenting harmful informa- tion across benign segments, c.g., by embedding a harmful query as a series of functions scattered throughout codebase (Figure la). The model can then be instructed extract and respond to the hidden message, using output obfuscation if required to bypass the output-only classifier.
Output obfuscation attacks. Second, attackers prompt models to obfuscate outputs, which sometimes renders model outputs uninterpretable without the corresponding input (Figure 1b). For instance, adversaries successfully instructed models to substitute sensitive chemical names with innocuous alternatives (c.g., referring to reagents as "food flavorings"). They also used metaphors and riddles that map harmful concepts to benign language. We note, however, that many obfuscation techniques can be understood without the input context, e.g., base64 encoding.
Such jailbreaks tend to reduce model capabilities, but by significantly varying degrees. To un- derstand how such attacks affect model capabilities, we consider two attacks that fragment requests across multiple segments and employ output obfuscation techniques, noting that neither uses input- aware output obfuscation. We test Claude Opus 4 on GPQA Diamond (Rein et al., 2023), prompting the model first reason through the problem before selecting an answer. Without obfuscation, the LLM achieves 74.2% accuracy. However, performance drops to 32.3% under the first attack and 49% under the second. These results demonstrate that such attacks substantially degrade model ca- pabilities, consistent with prior work (Souly al., 2024; Nikolić al., 2025). while also revealing considerable variation in degradation across different jailbreaks. This variability is concerning, as suggests adversaries can likely develop new attacks that preserve more of the model's capabilities while still bypassing safety measures.
3 EXCHANGE CLASSIFIERS
To address the vulnerabilities identified above, propose replacing the input classifier with an exchange classifier that continuously evaluates outputs in the context of their inputs.
In more detail, like input classifier, exchange classifier first assesses the incoming prompt in isolation. However, then monitors the model's response during generation, evaluating tokens in batches they are sampled. This continuous evaluation allows the classifier to assess each
3

---

output segment within its full conversational context, identifying outputs that would appear benign in isolation. Prompt caching during sampling makes this approach computationally feasible without significant overhead. Moreover, in theory, exchange classifier can complement an output-only classifier for defense-in-depth or function independently.
We hypothesize that replacing the input classifier with exchange classifier would improve bustmess against reconstruction attacks. We found that these attacks often become detectable after the model begins responding because the fragments are often reassembled in ways that resemble ci- phers that input classifiers are trained to block. Additionally, effective output obfuscation techniques can become harder to find when the classifier aware of the input. For example, coded language, metaphors, and substitutions can evade an output-only classifier but are more readily identified when evaluated alongside their input context.
We now evaluate whether exchange classifiers indeed improve robustness compared to previous- generation Constitutional Classifiers through human red-teaming.
System details. We consider two systems: (i) last-generation Constitutional Classifier system, which combines an input classifier with streaming output-only classifier. The input classifier is fine-tuned from Claude Haiku 3.5, while the output classifier is smaller internal LLM;; and (ii) exchange-only classification, which also fine-tunes Claude Haiku 3.5 for use as an exchange classi- fier. Because the exchange classifier uses a Haiku-sized LLM to evaluate outputs, it is about 50% more expensive relative to the last-generation system. Both systems are trained on synthetic data following Sharma al. (2025) and using constitution related to chemical, biological, nuclear, and radiological (CBRN) weapons. We calibrated classifier thresholds to correspond to a 0.1% refusal rate on WildChat (Zhao et al., 2024). We find our standard input classifiers are also effective ex- change classifiers, so we do not use any specific exchange-classifer training techniques. Instead, we directly use the input classifier as an exchange classifier.
details. Our red- red-teaming protocol follows Sharma et al. (2025). We instruct partic- ipants develop universal jailbreak strategies that bypass safeguards and elicit detailed responses across eight target queries, all of which are CBRN-related. We evaluate candidate responses using LLM-based rubric grading, as described in Sharma et al. (2025). This approach employs LLMMs to generate rubrics for each target question, then uses multiple LLM calls to assess whether candidate responses contain sufficient detail to be harmful. A response considered harmful it achieves a rubric score, which is the number of satisfied rubric criteria, at least half that of model without safe- guards. Since different systems received varying levels of red-tcaming effort, we primarily report the vulnerability discovery rate. In particular, we define high-risk vulnerability any attack that successfully answers more than five target questions with rubric scores meeting this threshold. The high-risk vulnerability discovery rate is calculated the ratio of identified high-risk vulnerabilities to total red-teaming queries submitted. See Appendix B for further details.
Robustness results. The last-generation Constitutional Classifier system exhibited 13 high-risk vulnerabilities across 695K red-teaming queries, yielding a vulnerability rate of 0.01871 per thou- sand queries. By comparison, the exchange classifier system demonstrated superior robustness with only 2 vulnerabilities across 226K queries, corresponding to rate of 0.00885 per thousand queries. Among the vulnerabilities discovered in the last-generation system, four jailbreaks were capable of answering all target queries at half the detail of model without safeguards, with an average dis- covery time of 27 self-reported hours. contrast, the exchange classifier system had only one such universal attack, which required 100 hours to discover. See Appendix Figure 4 for further details.
TWO-STAGE CLASSIFICATION REDUCES COMPUTATIONAL COSTS
Although the exchange classifier approach introduced in Section enhances robustness, our imple- mentation increases the computational cost of safeguards by 50% relative to previous-generationn defenses. We therefore explore methods to reduce this computational overhead.
2 Although the exchange classifier guards Claude Opus 4, while the input and output-only classifier system guards Claude Sonnet 3.7, do not helieve this affects the comparison substantially. This is because Sharma al. (2025) shows classifier robustness is the primary determinant of overall system robustness.
4

---

To that end, employ cascade of classifiers efficiently detect jailbreak attempts. Rather than processing all exchanges through a computationally expensive classifier, we first screen inputs using lightweight classifier. Only exchanges flagged by this initial stage proceed to more accurate but costlier second-stage classifier. Since exchanges flagged by the first stage are escalated rather than refused, requirements for the first-stage model, enabling cheaper and weaker models to achieve sufficiently robust detection. This scheme represents a form of adaptive computation, where classification cost depends on input complexity. To further reduce computational overhead, we implement several inference pipeline optimizations. Moreover, we fine-tune our classifiers from updated LLMs.
tolerate higher first-stage false positive rates. This reduces the performance
Experiment details. We evaluate whether two-stage classification maintains robustness through human red-teaming. We train new first-stage and second-stage exchange classifiers using our stan- dard training pipeline. The second-stage classifier is fine-tuned from Claude Haiku 4.5, while the first-stage classifier an internal model approximately one-third the size/cost of the second stage. We use this system to guard Claude Opus 4. We calibrate the second-stage classifier's 's threshold to achieve a 0.1%% flag rate on WildChat when used independently. For the first-stage classifier, we set the threshold to ensure the vast majority of examples from internal red red-teaming datasets are flagged. We use the same red-teaming protocol as in the previous section, but modify the bounty structure and questions Appendix B.2 for details. The target questions and classifier constitution CBRN-related.
Robustness results. Red-teaming identified five high-risk vulnerabilities across 569K queries, yielding a vulnerability discovery rate of 0.00878 per thousand queries. This rate matches the ex- change classifier system from the previous section and surpasses the robustness of the previous- generation classifier, though the mean discovery time for high-risk vulnerabilities was 33 hours, which is lower than that of the exchange classifier system. Crucially, no single jailbreak for this sys- tem was able to answer all target queries at level of detail similar to a model without safeguards."
This system dramatically reduces computational costs. In conjunction with inference pipeline and architectural optimizations associated with updated models, this new system reduces the com- putational cost of the single-exchange classifier system described in Section by a factor of 5.4. The updated second-stage classifier alone yields 3x reduction, highlighting the importance of making pipeline optimizations. The calibration procedure routes all traffic through the first-stage classifier, with ca. 10% of traffic then processed by the sccond-ttage Consequently, the first stage accounts for approximately 77% of the system's 's total cost.
EFFICIENT CLASSIFICATION VIA LINEAR PROBES
We now explore further cost savings by developing classifiers that reuse representations already computed during model sampling. In particular, 2016; Zou et al., 2023; Burns et al., 2024; Youstra et al., 2025; McKenzie et al., 2025).
linear activation probes (Alain & Bengio,
5.1 METHODOLOGGY
We now outline approach for training linear probes to detect harmful content in language model outputs, examining key design choices that enable real-time detection during streaming.
Problem setup. Consider a dataset D = ((x11) y ) 1 where each (4) represents an exchange
between user and an AI assistant, which consists of a token sequence (+) (z (2)
(8) Each
..... IT,
exchange has a binary label ( E {0. 1}. where ( = indicates the presence of harmful content requiring refusal. Crucially. these labels are exchange-level labels, which means they reflect the harmfulness of the entire exchange. However, as we want to stream model responses, we need to make predictions throughout sampling. During inference, the language model processes each token (i)
xt to produce intermediate activations ((6)) (zx( at each layer and position t (1....,T.)) T.).
However, expert-level red-teamers operating outside our bounty program were nonetheless able to discover universal jailbreaks for this system, though this required substantial effort and automated tools.
5

---

Linear probe architecture.
The simplest approach for linear probe would be to predict the exchange-level harmfulness at each token position using intermediate activations:
Prrohe (y 1 ( a ( (x b),
(1)
where denotes the sigmoid function, W and b are learnable parameters, and d represents the activation features. For single-layer probing, we use th. = o/4²) from layer For multi-layer probing, we concatenate activations: v = 10; (61) :....
Training modifications. We make two key modifications to this approach to improve performance:
J. Sliding Window Mean (SWIM) Logit Smoothing. First, we average logits over sliding window of M tokens during training:
M-1 (1(10)) = M Σ
[
OTT + b]. for t 2 M and T, 2 M,
(2)
where & is the averaged logit at position t. This smoothing ensures that content is considered harmful only when the probe consistently predicts harmfulness across consecutive tokens. Without averaging, a single token with a spuriously high activation could incorrectly flag an entire sequence as harmful. Our approach thus reduces false positives from isolated spikes while maintaining sensi- tivity to genuinely harmful content, for which we expect to observe consistent evidence of harm.
During inference, we use an exponential moving average (EMA) instead of sliding window mean for computational convenience. In particular, the EMA requires storing only single scalar state between token generations, whereas a sliding window would require maintaining a buffer of the previous M scores. As such, the EMA is more practical for deployment."
Softmax Logit Pooling. We pool the smoothed logits into single sequence-level prediction via softmax weighting, then apply single binary cross-entropy loss:
T Σ :=
)) for Ti 2 M,
C(x(1)) LBCE
y()),
w.
=((a(())
(3)
exp(2t/T)
with Wt Er=M (pp(2//1)
(4)
where LECE denotes binary cross-entropy and T controls the temperature of the pooling. As T + 0, the pooled logit approaches the maximum of { as + oc, approaches the uniform mean. We exclude token positions & < M to ensure all positions benefit from a full smoothing window; for training sequences shorter than M tokens, we average the available tokens and make a single prediction."
Justification for asymmetric weighting. This approach addresses a core challenge of streaming classification: the probe must predict harmfulness before observing a full sequence, but our labels reflect the harmfulness of the entire exchange. Consider sequences TA and Fe that share harmless prefix p. where A continues with harmful content (and so has label μa 1) while zg remains harmless (and so has label ув = 0). standard binary cross-entropy loss would push predictions to p(harm) 0.5 throughout the prefix, even though the prefix p is genuinely harmless. In contrast, our weighting, proportional to exp(² assigns negligible weight to tokens with negative logits, which are token-positions where the probe predicts the sequence harmless. This allows the probe to correctly predict harmlessness for the prefix p without penalty. Moreover, our scheme severely penalizes false positives-an confident harmful prediction in harmless sequence would receive high weight, reflecting how a single flag blocks all subsequent content for streaming classification. This differs from logit magnitude-bascl weighting, which would use | and would incorrectly penalize confident harmless predictions at loken-position before harm appears in the sequence.
"We did not experiment with EMA during training we found the sliding window and is easily implemented.
performed well
'The no-smoothing ablation in Figure 2b pools probabilities rather than logits: see the arXiv version for a brief comparison of pooling variants. Follow-up experiments did not show systematic differences hetween pooling probabilities and logits.

---

(a) Probe External Classifiers
(b) Loss Function Ablation
(c) Probe Layers
Attack Success Rate (%)
Attack Success Rate (%)
Attack Suceess Rate
2
2
Probe
Small Classifier
Extm=Small
Smoothed Softmax
Neither
Smoothed
Loss Function
Probe Layers
Figure 2: Analysis of linear probe performance for CBRN-related harmfulness detection using static jailbreak data. (a) Attack success rates for different models. We find that probes achieve competitive robustness to fine-tuned Constitutional Classifiers. (b) Ablation study of loss function. Combining logit smoothing and softmax pooling yields the best performance. (c) Impact of layer selection probe performance. Performance degrades as fewer layers utilized for probing. All ovaluations were conducted on static jailbreak datasets of CBRN-related queries. All classifiers exchange classifiers and are calibrated O. 0.1% refusal rates WildChat.
This method is closely related to the softmax probes of McKenzie et al. (2025), which also route gradients toward tokens indicative the positive class via softmax pooling. However, we explicitly target streaming classification rather than making single prediction for each sequence of tokens, and McKenzie et al. (2025) do not employ logit smoothing.
5.2 ANALYSIS
We now analyze the impact of various probe design choices on elassifier performance, and compare the performance of linear probes with separate, fine-tuned classifiers.
Training details. We train a linear probe on top Claude Sonnet 4 using concatenated activations across all layers. For the exchange dataset, we employ the same training data as in the previous section but replace the synthetic pipeline's hard labels with exchange-level soft labels produced by Constitutional Classifier fine-tuned from Claude Sonnet 4. For probe training, we use softmax temperature 7 = 1, window size M = 16, and train on ca. 25% of the full exchange dataset; we found training more examples did not improve probe performance. For evaluation, predictions using an exponentially weighted moving average. As baselines, we compare against the first-stage and second-stage classifiers from Section 4. However, in this section, both of these classifiers are calibrated to refusal rate of 0. 0.1% on WildChat (Zhao et al., 2024).
compute
Jailbreak data. We assess robustness using dataset of jailbreaks collected from human red- teaming, comprising approximately 7,000 exchanges designed to elicit harmful CBRN-related in- formation. We use only exchanges produced by red-teamers whose exchanges were never used for classifier training. Following Sharma et al. (2025), we evaluate response harmfulness using LLM-rubric grading supplemented with additional LLM filters exclude refusals. We evaluate the harmfulness of the entire model completion using the rubric grader, but consider the attack success- fully defended against if the exchange classifier flags at any point during model sampling." ? For the analysis in this section, we truncate the datasets to have maximum context length of 20K tokens.
Probe robustness approaches external classifiers. We first compare the attack success rate of our best-perforning linear probe against the small (Claude Haiku 4.5) and extra-small external clas- sifiers used in our two-stage system (Figure 2a). The probe achieves an attack success rate that outperforms the extra-small classifier and almost matches the Haiku 4.5 classifier. These results suggest that linear probes could potentially serve as viable first-stage classifiers in cascaded defense systems. Moreover, found that the flag rate benign scientific requests was higher for the probe.
'ee found either distilling with soft-labels or using hard labels from our synthetic data pipeline leads to similar performance. This may underestimate the attack rate.

---

Attack Success Rate
(b) Ensemble Rank Correlation
(c) Two-Stage Robustness
Attack Success Rate (%)
Attack Success Rate (%)
4.0
16
Probe Two Stage Ensemble
Rank Correlati lation
1.0
0.5
2.0
XS-5 Two-Soge
Ouly
1.0
0.5
0.5
0.0
Proke-S Fosemble
XS-Prohe Ensenble
5-Pmoh Ensemble
Ouly
Rusemblee
Classifier System
Ensemble
Relative Compute Cost (%)
Figure 3: Combining linear probes with external classifiers improves robustness and reduces costs. (a) Attack success rates for classifier systems. We find that combining our probe and a small external classifier yields the best performance, outperforming the more expensive extemnl-classsiier ensemble. (b) Spearman rank correlation between classifier predictions on jailbreak attempts. Probes and external classifiers make more independent emrors than pairs of external classifiers. (c) Compute-robustness tradeoff curves for two-stage configurations. We use the probe predictions to determine routing to the second-stage classifier, which uses the average logit across the probe and small classifier for prediction. We present the cost relative to using the small-sized classifier on all traffic. On our dataset of CBRN-related exchanges, our system that combines probes and the small external classifier can exceed the robustness of the small classifier alone whilst simultancously offering a 100x reduction in compute costs. All systems are exchange classifiers calibrated have 0.1% refusal rate WildChat. The linear probe uses activations from Claude Sonnet 4, which is the protected model. The 'S' classifier is fine-tuned from Claude Haiku 4.5, while the 'XS' classifier fine-tuned from an internal model approximately one-third the size. We evaluate robustness using LLM-based rubric grading on a dataset of CBRN-related human red-teaming exchanges.
Softmax pooling and smoothing critical for probe performance. We assess the importance of softmax pooling and logit smoothing by training probes that do not use these (Figure 2b). Using neither smoothing nor softmax pooling results in the highest attack success rate. While applying either technique alone improves performance, combining both yields the best performance. We consider additional loss functions Appendix Figure
Multi-layer probing substantially improves performance. Our default probe uses all layers. To examine the importance of this choice, we consider the performance of probing on different numbers of layers (Figure 2c). We find that using all available layers achieves the lowest attack success rate approximately 1 1.4%, while using fewer layers consistently yields worse performance.
5.3 COMBINING PROBES AND CLASSIFIERS
We now investigate whether combining probes and classifiers can offer further performance im- provements. Indeed, ensemble methods have long history in machine learning at improving per- formance and robustness (e.g., Dietterich, 2000; Lakshminarayanan et al., 2017).
Ensembling improves robustness. We explore weighted ensembles between our classifiers (Fig- ure 3a). We evaluate robustness using the dataset, evaluation method, and calibration procedure described previously. For each classifier pair, we combine their logits using a weighted average: Sensemble = (22 (1 a2)22, where is optimized per pair to minimize attack success rate on the test set. Ensembling the probe with the small external classifier achieves the lowest attack success rate, substantially outperforming either classifier alone. Notably, equal weighting (a 0.5) proves near-optimal for this ensemble- Appendix Figure 6. While combining the extra-small and small external classifiers yields some improvement individual classifiers, the gains modest com- pared to the probe-basee ensemble.
Probes provide complementary predictions to external classifiers. To understand why probe- classifier ensembles outperform classifier-only ensembles, we analyze the correlations between clas- sifier predictions our red-teaming exchange dataset (Figure 3b). We find the Spearman rank
8

---

relation between the probe and the small external classifier is lower than that between the pair of external classifiers. This suggests that despite being trained on the same distribution as the external classifiers, the probe appears to leverage signals that complement those used by external classifiers, explaining the effectiveness of probe-classifier ensembling.
Probe-classifier cascades reduce computational overhead. Finally, we examine whether probes can improve the compute-robussmess tradeoff in two-stage classifier cascades. We use our lightweight probe continuously during generation and invoke a more expensive second-stage clas- sifier selectively based on the probe's 's confidence. Specifically, when the probe score exceeds a threshold, we route the exchange the small external classifirr and average their logits to make our final prediction. Otherwise, we rely solely on the probe. By varying the probe threshold, we control the fraction of exchanges requiring external classification and thus the compute cost. A per- layer probe is structurally single extra MLP neuron, so if implemented efficiently the overhead is (11 h 10- or less, so cascade cost almost entirely the external classifier.
We find the probe-classifier cascade substantially improves both efficiency and robustness relative to the two-stage system described in Section 4, and also compared to single exchange classifier (Figure 3c). On our dataset, our system exceeds the robustness of the small classifier alone whilst simultancously offering a 100x reduction in compute costs.
PRODUCTION-GRANT CONSTITUTIONAL CLASSIFIERS
This section presents our final production groduction-grade Constitutional Classifier system, which integrates the techniques from preceding sections to achieve strong robustness, low false positive rates, and reduced computational overhead.
System architecture. The production- grade system uses a weighted two-stage classifier cascade. A lightweight linear probe monitors all exchanges during generation. When the probe score exceeds threshold, the exchange is escalated to a second-stage external classifier. For escalated exchanges, the final classification score is computed as weighted combination of probe and classifier logits: Zinal = 0.55 Zprohe + 0.45 Zelassifeer- For the second-stage external classifier, we fine-tune a Constitu- tional Classifier from Claude Haiku 4.5. The system described here is used to guard Claude Sonnet 4.5. As such, the probe uses activations from that model.
Deployment metrics. We evaluated the system through a shadow deployment production traffic using Claude Sonnet 4.5 from December 1, 2025, to January 1, 2026. The flag rate- the proportion of queries refused-was 0.05%, substantially lower than the 0.38% reported by Sharma al. (2025). The first-stage probe escalated approximately 5.5% of traffic to the second-stage classifier. In terms of computational overhead, this represents roughly an 8x reduction compared to the two-stage sys- tem described in Section 4, and approximately a 40x reduction compared to the single exchange classifier in Section
Robustness results. We applied the same red-teaming methodology described in previous sections. The system underwent an estimated 1736 cumulative hours of red-teaming effort across approx- imately 198K attempts. Only one high-risk vulnerability was discovered, corresponding to de- tection rate of 0.005 per thousand queries-the lowest among all systems considered in this paper. The discovery time for this attack was 30 hours, representing the highest minimum vulnerability discovery time observed. No universal jailbreak was found capable of answering all eight target questions half the level of detail provided by model without safeguards. These results represent the strongest robustness achieved across all systems evaluated in this work.
RELATED WORK
Adaptive computational schemes. Recent work has explored adaptive two-stage classification ap- proaches for content moderation. OpenAl's systems (OpenAI, 2025a;b) employ a lightweight topic filter to identify high-harm content areas, triggering more expensive classification only when nec- essary. While their first stage focuses on topic detection, our approach explicitly targets jailbreak
"Estimated using API logs, following the methodology of Sharma al. (2025) but with 5-minute buckets.

---

Table 1: Comparison of Constitutional Classifier systems evaluated in this work. We mea- sure the compute overhead relative to the last- gast-genrration system. We measure robustness using the vulnerability discovery rate, the number of high-risk vulnerabilities discovered per thousand red- teaming queries. Production traffic refusal rate is the percentage of production queries refused by the system. Lower is better for all metrics. The production-gre -ggadd system described this section achieves the best trade-off between robustness, inference overhead, and refusal rates.
Relative Compute Overhcad (%)
High-Risk Vulnerability
Production Traffic Refusal Rate (%)
System
Discovery Rate
Last Generation ($2)
100,0
0.01871
0.073
Exchange Classifier ($.3)
150.00
0.00885
0.038
Two-Stage Cascade ($:4)
27.8
01,08788
0.036
Production Grade ($6)
3.5
0.00505
0.050
attempts in the initial stage." 9 Hua al. (2025) investigate optimal strategies for combining multiple monitors under cost constraints. In contrast, we implement a straightforward two-stage classification scheme and validate its robustness through extensive human red-teaming. These approaches reflect broader trends in adaptive computation, including systems like TARS (Kim et al., 2025), which dy- namically allocate test-time compute based on query complexity. Other work explores cascades and model routers for efficient LLM deployment. HybridLLM (Ding et al., 2024) employs lightweight BERT-style decoder to route queries between small and large LLMs, AutoMix (Aggarwal et al., 2025) adaptively combines outputs across models using confidence scores and learned routing, and recent advances have refined cascades through confidence-basee deferral (Rabanser et al., 2025).
Model-internals approaches. Several methods use model internals for efficient classification. Cunningham et al. (2025) explore internals- based classifiers, focusing on last-N layer networks, while we focus boosting the performance of simple linear probes with softmax pooling and logit smoothing. McKenzie et al. (2025) similarly investigate softmax-pooler probes and classifier cas- cades. While they aggregate token scores into single sequence-lewe predictions, we build streaming classifiers with continuous predictions during generation. Our analysis in Section 5 shows that com- bining softmax pooling with logit smoothing substantially improves performance over either alone. Beyond standard activation probes for harmfulness detection (Alain & Bengio, 2016; Zou et al., 2023: Youstra al., 2025), recent approaches fine-tune LLMs using internals-based losses, includ- ing short- short-circuiting (Zou et al., 2024) and latent adversarial training (Casper et al., 2024). Others build classifiers using sparse auto-encoder features (Bricken al., 2024; Kantamneni al., 2025).
CONCLUSION
Our work demonstrates that Constitutional Classifiers can achieve production grade jailbreak robust- ness with dramatically improved deployment viability. Our approaches include exchange classifiers that evaluate outputs within their conversational context to prevent obfuscation attacks, cascaded classifiers that reserve expensive classification only for flagged content, and activation- based probes. We develop systems that provide robust protection against universal jailbreak jailbbeaaail attempts while meeting the stringent false positive and computational constraints required for deployment, thus establishing Constitutional Classifiers as practical and effective safeguards for production LLMs.
Future work. Tighter integration between classifier safeguards and language models for exam- plc, incorporating classifier signals directly into model sampling processes, or training models to better resist obfuscation attempts- could strengthen robustness. Additionally, improving training data through automated red-teaming (Perez et al., 2022) or including data more representative of production traffic could yield better classifiers.
9 As noted by OpenAl (2025b): "The first tier in this system is fast, topical classifier model that determines whether the content related to biology."
10

---

ACKNOWLEDGEMENTS
We thank Xander Davies, Robert Kirk, Ben Edelman, and Holden Karnofsky for valuable feedback and discussions. We thank Andrew Wang and Jenny Bao for identifying the discrepancy between the implemented training objective and its description in earlier draft and testing its impact respec- tively. The robustness analysis of our system through human red teaming was made possible by the dedicated efforts of our red- -ed-tersers and substantial operational support from HackerOne. We also thank UK AISI, US CAISI, and FAR.AI for red teaming various versions of our system. Mrinank Sharma thanks Rob Burbea for foundational inspiration, guidance, and support.
AUTHOR CONTRIBUTIONS
Probe Development. Hoagy Cunningham, Andrew Persic, and Jordan Abderrachid were the core contributors probe development. Hoagy Cunningham led probe methodology and evaluation: Andrew Persic led infrastructure development: Jordan Abderrachid made significant contributions both areas.
Exchange and Two-Stage Classifiers. Jerry Wei led the work on exchange classifiers and two-stage classifters, with substantial assistance from Zihan Wang and Alwin Peng.
Red-Teaming. Logan Howard and Giulio Zhou conducted classifier red-team red-teaming. Clare O' O'Hara supported the red-teaming program.
Infrastructure and Monitoring, Austin Cohen supported classifier monitoring in real-world traffic. Jin Pan, Rob Gilson, Yue Song, Rohit Mittapalli, Alek Dimitriev, Bobby Chen, Christopher Liu, Yijin Hua, Andy Dau, Andrew Persic, Jordan Abderrachid, Xunjie Yu, Alex Silverstein, and Raj Agarwal contributed to probe and classifier infrastructure implementations.
Leadership and Supervision. Nikhil Saxena and Mu Lin provided management support. Vlad Mikulik provided additional management support. Jared Kaplan and Jan Leike provided high-level guidance. Mrinank Sharma, Ethan Perez, and Jerry Wei contributed to project supervision. Mrinank Sharma wrote the majority of the paper, with feedback from other authors.
REFERENCES
Pranjal Aggarwal, Aman Madaan, Ankit Anand, Srividya Pranavi Potharaju, Swaroop Mishra, Pei Zhou, Aditya Gupta, Dheeraj Rajagopal, Karthik Kappaganthu, Yiming Yang, Shyam Upadhyay, Manaal Faruqui, and Mausam. AutoMix: Automatically mixing language models, 2025. URL
http:://aaxiv.orr///a// 12961
Guillaume Alain and Yoshua Bengio. Understanding intermediate layers using linear classifier probes, 2016. URL httt::://axxi..rr//bb////// 0164..
Ross J Anderson. Security engineering: A guide to building dependable distributed systems. John Wiley & Sons, 2010.
Anthropic. Anthropic's responsible scaling policy, 2023. URL https::/wwwwcdn. wttp::/wwwww.......p....... comm:/aaaf000cff/79522222222668 aaade 1 http:///rrpppossbbbe-cciiiinnnne
.df..
Trenton Bricken, Jonathan Mareus, Siddharth Mishra-Sharma, Meg Tong, Ethan Perez, Mri- nank Sharma, Kelley Rivoire, Thomas Henighan, and Adam Jermyn. Using dictionary learning features as classifiers, 2024. URL https://rranfoomer-crrlll /ubb2/2// html.
faatures-as-clasiffees////i
Collin Burns, Haotian Ye, Dan Klein, and Jacob Steinhardt. Discovering latent knowledge in lan- guage models without supervision, 2024. URL https://arxdv.org/bbb//// 03827.
Nicholas Carlini, Anish Athalye, Nicolas Papemot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness, 2019. URL httpps:/aarivv.rrgabbb/////// 06705.

---

Stephen Casper, Lennart Schulze, Oam Patel, and Dylan Badfield-Menelle Defending against un- foreseen failure modes with latent adversarial training, 2024. URL 2403.05030
/
Hoagy Cunningham, Alwin Peng, Jerry Wei, Euan Ong, Fabien Roger, Linda Petrini, Misha Wag- ner, Vladimir Mikulik, and Mrinank Sharma. Cost-effective constitutional classifiers via rep- resentation re-use, 2025. URL https: hatp:://aalggmennnn wnt.:iigeeennnatrroii.... cwm 201// hat////chap-aaee Anthropic Alignment Science Blog.
cttp://htoammmmmss/////// monitors/.
Thomas G Dietterich. Ensemble methods in machine learning. In International Workshop on Multiple Classifier Systems, 2000. URL nttps://web: engr. wrregonstateeeduuuteee sublicatiionns/msseemmmtbeeee
Dujian Ding, Ankur Mallick, Chi Wang, Robert Sim, Subhabrata Mukherjee, Victor Ruhle, Laks S. Lakshmanan, and Ahmed Hassan Awadallah. HybridLLM: Cost-efficient and quality-aware query routing, 2024. URL httpss//aaxxii http:///aaxvvo../.a///// www.oogg////a//eeee ab24/ 14618.
Tim Tian Hua, James Baskerville, Henri Lemoine, Mia Hopman, Aryan Bhatt, Tyler Tracy, and MARS Redwood Research. Combining cost-constrained runtime monitors for Al safety, 2025.
URL https://arxii: wwwpiiioorg////// wtt.:/r///////////// 15886.
Subhash Kantamneni, Joshua Engels, Senthooran Rajamanoharan, Max Tegmark, and Neel Nanda. Are sparse autoencoders useful? case study sparse probing, 2025. URL https: //axxiv. org/abs/2500 2502. 16681.
Taeyoun Kim, Fahim Tajwar, Aditi Raghunathan, and Aviral Kumar. Reasoning as an adaptive defense for safety, 2025. URL htttt:::/aaxxi.orrr .rrg//rg///ooo abs/2507 00971.
Balaji Lakshminarayanan. Alexander Pritzel, and Charles Blundell. Simple and scalable predictive
uncertainty estimation using deep ensembles. In Advances in Neural Information Processing Systems (NeurIPS), 2017. URL https://arxiv.org/abss. 1144..0017111
Nathaniel Li, Alexander Pan, Anjali Gopal, Summer Yue, Daniel Berrios, Alice Gatti, Justin D. Li, Ann-Kathrin Dombrowski, Shashwat Goel, Long Phan, Gabriel Mukobi, Nathan Helm- Burger, Rassin Lababidi, Lennart Justen, Andrew B. Liu, Michael Chen, Isabelle Barrass, Oliver Zhang, Xiaoyuan Zhu, Rishub Tamirisa, Bhrugu Bharathi, Adam Khoja, Zhenqi Zhao, Ariel Herbert-Voss Voss, Cort B. Breuer, Samuel Marks, Oam Patel, Andy Zou, Mantas Mazeika, Zi- fan Wang, Palash Oswal, Weiran Lin, Adam A. Hunt, Justin Tienken-Harder, Kevin Y. Shih, Kemper Talley, John Guan, Russell Kaplan, Ian Steneker, David Campbell, Brad Jokubaitis, Alex Levinson, Jean Wang, William Qian, Kallol Krishna Karmakar, Steven Basart, Stephen Fitz, Mindy Levine, Ponnurangam Kumaraguru, Uday Tupakula, Vijay Varadharajan, Ruoyu Wang, Yan Shoshitaishvili, Jimmy Ba, Kevin M. Esvelt, Alexandr Wang, and Dan Hendrycks. The WMDP benchmark: Measuring and reducing malicious use with unlearning, 2024. URL https://arxiv org/ abs//4bs/222 wtt./br///////////// 03218.
Alex McKenzie, Urja Pawar, Phil Blandfort, William Bankes, David Krueger, Ekdeep Singh Lubana, and Dmitrii Krasheninnikov. Detecting high-stakes interactions with activation probes, 2025. URL https://arxiv. wrg./bs/////..55.. 18805.
Kristina Nikolić, Luze Sun, Jie Zhang, and Florian Tramèr. The jailbreak tax: How useful are your jailbreak outputs?, 2025. URL https://arxii www.aawwwww....aaaeeeeeeeeooeeee ab2//444s/ 10694.
OpenAl. OpenAl preparedness framework (beta), 2023. URL https://cdn. http::///ddoooooii.....m
openai-preparedness- frr.rprrrddeess-fannnno------- framework-beta. pdf.
OpenAl. ChatGPT agent system card. Technical report, OpenAI, 2025a.
URL
https://cdn. openai. htappp//9966666--0000-------6122 agent.system.card. pdf.
OpenAl. GPT-5 system card. Technical report, OpenAI, 2025b. URL https: www.cdd......ccoooomoooo gpt-5-system-card.po
12

---

Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models, 2022. URL https://arxii org/ abs 2202. 03286.
Stephan Rabanser, Nathalie Rauschmayr, Achin Kulshrestha, Petra Poklukar, Wittawat Jitkrittum, Sean Augenstein, Congchao Wang, and Federico Tombari. Improving model cascades through confidence tuning, 2025. URL http://aarxiv.oorrb///////
1933.
David Rein, Betty Li Hou, Asa Cooper Stickland, Jackson Petty, Richard Yuanzhe Pang, Julien Dirani, Julian Michael, and Samuel R Bowman. GPQA: A graduate-level Google-proof Q&A benchmark, 2023. URL /ttps://arxiv. wwwprriiv.oog.......o/ orggabs///111111 12022.
Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Al- win Peng. Raj Agarwal, Cem Anil, Amanda Askell, Nathan Bailey, Joe Benton, Emma Bluemke, Samuel R. Bowman, Eric Christiansen, Hoagy Cunningham, Andy Dau, Anjali Gopal, Rob Gilson, Logan Graham, Logan Howard, Nimit Kalra, Taesung Lee. Kevin Lin, Peter Lofgren, Francesco Mosconi, Clare O' DaHa,, Catherine Olsson, Linda Petrini, Samir Rajani, Nikhil Sax- ena, Alex Silverstein, Tanya Singh, Theodore Sumers, Leonard Tang, Kevin K. Troy, Constantin Weisser, Ruiqi Zhong, Giulio Zhou, Jan Leike, Jared Kaplan, and Ethan Perez. Constitutional classifiers: Defending against universal jailbreaks across thousands of hours red teaming. 2025. https///s://artt org/ abs 2501 18837.
Alexandra Souly. Qingyuan Lu, Dillon Bowen, Tu Trinh, Elvis Hsich, Sana Pandey, Pieter Abbeel, Justin Svegliato, Scott Emmons, Olivia Watkins, and Sam Toyer. A StrongREJJCCT for empty jailbreaks, 2024. URL https://arxix org/abs/2402. 10244....26.. 10260.
Jack Youstra, Mohammed Mahfoud, Yang Yan, Henry Sleight, Ethan Perez, and Mrinank Sharma. Towards safeguarding LLM fine-tuning APIs against cipher attacks, 2025. URL https://arxin org/abs/2508. 17158.
Wenting Zhao, Xiang Ren, Jack Hessel, Claire Cardie, Yejin Choi, and Yuntian Deng. Wildchat: IM ChatGPT interaction logs in the wild. In International Conference Learning Representations (ICLR), 2024. URL https::t////o / //tpxv/aa/vvv//a////a//eeeaaawva wtw.aaaxvvvvr.gggagaaa wtgg/rr//////////// 2405/ 014.0.55.144.. 01470.
Andy Zou, Long Phan, Sarah Chen, James Campbell, Phillip Guo, Richard Ren, Alexander Pan, Xuwang Yin, Mantas Mazeika, Ann-Kathrin Dombrowski, Shashwat Goel, Nathaniel Li, Michael J. Byun, Zifan Wang, Alex Mallen, Steven Basart, Sanmi Koyejo, Dawn Song, Matt Fredrikson, Zico Kolter, and Dan Hendrycks. Representation engineering: top-down ap- 01405.
proach to AI transparency, 2023. URL
Andy Zou, Long Phan, Justin Wang, Derek Duenas, Maxwell Lin, Maksym Andriushchenko, Rowan Wang, Zico Kolter, Matt Fredrikson, and Dan Hendrycks. Improving alignment and robustness with circuit breakers, 2024. URL httph: org/ htrgg//bb2220.... 04313.
13

---

A DETAILED SYSTEM COMPARISON
Vulnerabilityy Discovery Rate
(b) Mean Vuln. Discovery Time
(c) Min Vuln. Discovery Time
0.03
High Risk Vulnerabiliiie Thousund Queries
Nata Quaiie
30
Got gatto
Time (bours)
Time (hours)
0.02
Pedd Goade
40
20
0.01
10
0.00
0
Bechange
Bachinggs Exchage Grad:
Eachang
Exchage Grade
Esdraue
Grake
System
System
System
(d) High-Risk Vulns.
(c) Compute Costs
(1) False Positive Rates
High-Rish Risk Vulns, Discovered
Relative Compute Cost (%)
150
False Positive Rate (%)
0.06
10
100
0.04
50
0.02
0,00
Stage lochungs Gradz
Exchage Pro-StgePuudcitie Grad:
Eachange Stage
Ixching
Eschinge Grads
System
System
System
Figure 4: Comprehensive comparison of Constitutional Classifier systems across robustness, computater
computational efficiency, and false positive rates. (a) High-risk vulnerability discovery rate malized per thousand queries, with total query counts shown for each system.
(b) Mean time in hours for discovering high-risk vulnerabilities. (c) Minimum time first vulnerability discovery. (d) Absolute count of high-risk vulnerabilities discovered. (e) Relative computational cost com- pared to implementation of the last-generation defense system. (f) Refusal rates production traffic, measured using the refusal rates in the first week after deployment to production traffic. The production-grade system achieves the best robustness and computational efficiency with acceptable refusal rates.
In this section, we provide comprehensive comparison of four Constitutional Classifier systems evaluated in this work through both deployment and human red-teaming: (i) our implementation of the last-generation dual-classifier system with separate input and output classifiers; (ii) the single exchange classifier system; (iii) two-stage exchange classifier cascade with updated classifiers and inference optimizations; (iv) our production-gee classifier system, which uses linear probe as first-stage classifier, and a mrobe-external exchange ensemble as the second stage. Figure 4 presents key metrics for these systems.
We emphasize that we use the high-risk vulnerability discovery rate metric to account the varying number queries submitted across different red-teaming cam- paigns. The other metrics consider expected to have much stronger dependence the volume of red-teaming, which varies across systems. We define high-risk vulnerability as any at- tack that successfully answers more than five of eight target questions with rubric scores at least half that of a model without safeguards. The discovery rate then calculated as the numher of high-risk vulnerabilities identified per thousand red-teaming queries submitted, normalizing for the different levels of red-teaming effort applied to each system.
primary robustness
To calculate the total red-teaming queries, calculate the number of red-teaming queries submitted by users whose queries have a classifier refusal rate of greater than 5%. This filters out queries made by users who might be using our red teaming bounty program for purposes other than red-teaming.
14

---

B FURTHER DETAILS ON HUMAN RED-TEAMING
We evaluate the robustness of our Constitutional Classifier systems through extensive human red- teaming, largely following the protocol established by Sharma al. (2025).
B.1 OVERALL APPROACH
Our red-teaming protocol provides participants with target queries and instructs them to develop universal jailbreak
techniques that bypass safeguards and elicit detailed re- sponses across all target queries. We use eight target queries spanning various harmful categories and assess response quality using LLM-based rubric grading.
Evaluating jailbreak success. Following Sharma al. (2025), implement multi-stage LLM- based rubric-grading pipeline, We first generate baseline outputs from models without safeguards to establish the level of detail expected for each query. These baselines used to create query- specific rubrics containing key information elements. Candidate jailbreak responses are evaluated against these rubries, with a response considered successful if it achieves least 50% of the score obtained by a model without safeguards. We define a high-risk vulnerability as any attack that successfully answers more than five of eight target questions this threshold.
Red-teaminn structure. We provide red-teamers with API access to the defended model. Partic- ipants submit their jailbreak attempts along with self-reported development time. Throughout this work, we offered bounties scaled by the number of successfully jailbroken queries, with maximum payouts ranging from $25K S35K USD depending on the specific campaign. To calculate the total red-teaming queries, we calculate the number of red-teaming queries submitted by users whose queries have a classifier refusal rate of greater than 5%. This filters out queries made by users who might be using our red-teaming bounty program for purposes other than red-teaming.
B.2 PROTOCOL MODIHICATIONS FOR
SYSTEM
For the two-stage exchange classifier evaluation and production -rrade system, we implemented sev- eral protocol refinements to improve red-teaming efficiency.
Program structure changes. We transitioned from providing API credits to granting access through a specific model alias that does not consume credits, reducing friction for participants and preventing misuse of our platform. We further provided participants with test queries and rubrics, which we found improved submission quality. The universal jailbreak definition was clarified to emphasize the need for detailed, actionable responses across multiple queries.
Reward structure updates. We restructured the bounty system to better incentivize universal jail- breaks. The maximum reward was increased $35K USD. We further included a 1.05x multiplier for each additional model response considered to be "strong pass", which is a response achiev- ing at least 75% of the detail of a model without safeguards, as assessed by rubric grading. This incentivizes red-teamers to improve the details provided by their responses, well the number of questions answered. We also increased rewards for universal jailbreaks and reduced rewards for attacks that were less universal (that answered fewer queries), further incentivize the discovery of universal attacks.
Question set refinement. We replaced four of the original eight target queries with newer ques- tions. We provided the previous questions and rubrics to red-teamers to allow them to improve their submissions.
Data collection improvements. We implemented standardized data collection procedures and added explicit terms regarding data storage and usage. Participants were required to document their attack development process and provide time estimates.
C ADDITIONAL PROBE ABLATIONS
We now conduct further ablation studies to better understand the impact of different loss function designs and hyperparameters prohe performance.
15

---

(a) Loss Function Ablation
(b) Sliding Window Size
Attack Succoss Rate (%)
Attack Sucees Rate (%)
0.050
0.1
0.025
0.0
0.000
Smoothed Sollmax
Solimax Only
Smoothing Per-okenn Only Loss
Cummax
Cummax (Amnelled)
16
32
Sliding Window Size
Function
Figure 5: Additional probe ablations on loss functions and hyperparameters. (a) Comparison of different loss functions showing that our smoothed softmax approach additionally outperforms cumulative maximum and annealed cumulative max loss, which were proposed by Sharma et al. (2025). (b) Impact of sliding window size M on attack success rate, demonstrating optimal perfor- mance at moderate window sizes (around M 16), with degradation at both extremes.
C.I ALTERNATIVE LOSS FUNCTIONS
Beyond the smoothed softmax loss presented in the main text, investigate two additional loss formulations that leverage the streaming nature of our classification task.
Cumulative maximum loss. We explore using the cumulative maximum of probe probabilities as the predictor for the full sequence label. This approach better reflects the streaming use case where, if we stop generation position I, the remainder of the sequence is effectively considered harmful. Specifically, we define:
ply 1111) max a (E+(1117))
(5)
rst
where 2, is the probe logit at position 7 (after sliding window averaging). This ensures that predic- tive probabilities only increase when the probe is confident that the full sequence will be harmful. However, using this approach, gradients only flow through the maximum-scoring token position, which can mean this approach sometimes suffers from optimization challenges.
Annealed cumulative maximum loss. To address the optimization challenges of the cumulative maximum while retaining its benefits for streaming classification, we linearly interpolate between direct probe probabilities and the cumulative maximum throughout training, as suggested by Sharma et al. (2025):
pyy 1|z1a) (1 - w) ((E((I1))) + w- max (Z, (x1:r)
(6)
7St
where w starts at 0 and linearly increases to I throughout training. This ensures stable initial training with good gradient flow while gradually transitioning the cumulative maximum formulation that better matches our streaming use case.
Figure 5a compares these loss functions against our proposed smoothed softmax approach. We find that our softmax pooling with logit smoothing achieves stronger performance than these additional loss functions. We use the same evaluation datasets and methodology described in the main paper.
C.2 IMPACT OF SLIDING WINDOW SIZE
The sliding window size M controls the degree of smoothing applied to probe logits. Figure 5b demonstrates that moderate smoothing is crucial for performance. Performance improves as increase the window size from no smoothing, reaching optimal performance around M 16. How- ever, excessive smoothing degrades performance.
16

---

D ENSEMBLE WEIGHTING ANALYSIS
Figure 6 examines three classifier pairs and shows how their individual performance varies with different weighting proportions. We use weighted average of logits for each classifier pair. While we optimize for each classifier pair in Figure 3a, for the classifier-probe ensembles, we find that equal weighting already is close to optimal.
(b)
Attack Success Rate (%)
Attack Success Rate (%)
Attack Success (%)
4
2
2
XS Clessfier
Weight
Clussfer Only
Only
Equal
Classffer Only
Only
Weight
XS Classiffer
Only
Only
Ensemble weighting
Ensemble weighting
Ensemble weighting
Figure 6: Impact of ensemble weighting attack success rates for different classifier pairs. Each panel shows the performance of individual classifiers and logit-weighted ensembles. (a) Extra- small (XS) and small (S) external classifiers. (b) Linear probe and small external classifier. (c) Linear probe and extra-small external classifier. All classifiers are calibrated to maintain a 0.1% false positive rate WildChat. We
standard dataset of red-teaming exchanges and our standard evaluation methods, as described the main paper.
E LESSONS LEARNED FROM CLASSIFIER ITERATION AND DEPLOYMENT
We now share lessons learned from classifier iteration and deployment.
Infrastructure reliability is security requirement. During development and human red-teaming, we discovered that infrastructure bugs can create effective jailbreaks. Comprehensive end-to-end testing is therefore essential to ensure consistency across different implementations and deployment environments. Even perfect classifiers become ineffective when compromised by implementation errors or configuration issues.
Regular red-teaming remains essential. Our robustness evaluations demonstrate that periodic hu- man red-teaming must complement synthetic testing. While automated evaluations enable rapid iteration and improvement, relying solely synthetic benchmarks ited test cases. Organizations must therefore invest in both technical infrastructure and operational processes that enable efficient deployment, testing, and evaluation of updated safety systems.
lead to overfitting lim-
On-the-fly activation computation accelerates probe development. During probe classifier ex- perimentation, found that recomputing model activations within the training loop rather than pre- computing and saving them offers compelling engineering advantages. Moving probe activation data from high-bandwidth memory (HBM) RAM blob storage creates severe I/O bottlenecks that dwarf the computational cost of regeneration. Furthermore, since linear probe training is extremely efficient, we can test multiple probe variants simultaneously on freshly computed activations.
Providing red teamers with test queries is helpful. Supplying red-teamers with sample questions and their corresponding evaluation rubrics significantly enhances red-teaming efficiency. These examples guide red-teamers in developing appropriately concerning jailbreaks, thereby streamlining the report evaluation process.
F DETAILS OF LLM CONTRIBUTION
We used LLMs aid and polish paper writing.
17


Reviews:
[{"review_id": "BIPzj0NBXj", "reviewer": "Reviewer_zAes", "summary": "The paper introduces Constitutional Classifiers++, replacing the traditional input–output separation with exchange-level classification that understands conversational context. The system employs a two-stage cascade, a lightweight Stage-1 screener and a high-precision Stage-2 classifier to reduce runtime cost. It further integrates internal activation probes with external classifiers for ensemble robustness. Experiments report 5.4× cost reduction, a 0.036% block rate on production traffic, and full mitigation of universal jailbreak prompts across large red-team evaluations. Technical contributions include streaming linear probes with smoothed logits and softmax-weighted loss functions tailored for online inference.", "questions": "Please refer to the weakness.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1)\tClear motivation: The paper provides a clear motivation by diagnosing vulnerabilities in the prior Constitutional Classifier (CC). The authors identify two concrete and realistic attack classes: reconstruction attacks, in which harmful instructions are fragmented across benign segments, and output obfuscation attacks, in which malicious outputs are hidden behind metaphorical or coded language. \n\n2)\tNovelty: The paper presents two technically distinct yet complementary innovations that meaningfully advance safety mechanisms. First, the two-stage classification architecture introduces an adaptive cascade that balances robustness and efficiency. A lightweight first-stage model screens all interactions, while a stronger second-stage classifier verifies only flagged exchanges. This design reduces computational overhead by 5.4× without compromising jailbreak resistance, offering a deployable and scalable defense solution. Second, the linear activation probes represent a use of the LLM’s own internal activations for real-time harmfulness detection. By reusing in-model representations and applying techniques such as sliding-window logit smoothing and softmax-weighted loss, the probes achieve performance comparable to full Constitutional Classifiers at negligible cost.\n\n3)\tTraining improvements: The study convincingly establishes that the proposed systems deliver cost-effective robustness. Both the two-stage cascade and the probe-based approach significantly reduce computational and training overheads while preserving or improving ASR performance, making them practical candidates for real-world, scalable LLM safety deployment.", "weaknesses": "1)\tAnalysis of the Failure Cases\nWhile the exchange-classifier architecture clearly improves robustness relative to previous Constitutional Classifiers, the results in Section 3 suggest that failure cases remain and deserve deeper analysis. Specifically, the system still exhibited two high-risk vulnerabilities across 226K red-teaming queries (≈ 0.00885 per thousand), implying that some jailbreaks can still bypass contextual evaluation.\n\n2)\tScaling trends for two-stage classifiers\nWhile the paper provides strong empirical validation of the two-stage cascade architecture, it lacks a robustness trend on model scale, which limits the interpretability of the reported robustness gains. In Section 4, the two-stage setup combines “extra-small” and “small” classifiers, but the impact of scaling each stage independently is not explored. \n\n3)\tLinear Probe Assumption of Linearity\nThe proposed linear activation probe relies on the assumption that harmfulness signals are linearly separable within the model’s internal activation space. This simplification enhances computational efficiency but overlooks the nonlinear semantic dependencies that often define harmful or context-sensitive content. \n\n4)\tInsufficient Evaluation Scope:\nThe evaluation’s domain restriction to CBRN data limits the paper’s external validity. Incorporating multi-domain datasets, such as AdvBench and JailbreakBench, would demonstrate whether the proposed method generalizes beyond structured, science-based harms. A broader evaluation would substantiate the claim that the method is a general-purpose, production-ready defense rather than a domain-specific safeguard.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KgfR6LZvcS", "reviewer": "Reviewer_VZzS", "summary": "The paper discusses a crucial problem: identifying jailbreak prompts designed to evade LLM safety mechanisms. A conversational classifier (known as exchange classifiers) is introduced, particularly to address reconstruction and obfuscation attacks. This is orchestrated using two stages to reduce computational costs while using internal model activations (through logit smoothing and weighted loss) to improve detection. The evaluation effort involves a red team, and also shows lower computational costs compared to previous approaches.", "questions": "1. It is unclear how large is the context for each instances in the exchange classifier? What is the length of conversation? How does this affect performance?\n2. How well does the softmax-weighted loss differ from using moving average or median, particularly in the case where spurious tokens are present which skews the distribution?\n3. In section 5.1, the linear probe architecture mentions activation features. Could these activation functions be non-linear? If so, would the results still hold true?\n4. It is unclear what is the meaning of “calibrating classifier threshold to correspond to a 0.1% refusal rate on WildCat”? How can this statement be interpreted with respect to overall performance?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "- The problem considered is very novel, and underexplored in LLM safety. The paper addresses deployment viability to achieve production-grade defenses.\n- The use of exchange classifier is clever to mitigate reconstruction and obfuscation jailbreaks. The scalable modular design improves computational overhead significantly, compared to existing frameworks.\n- The evaluation is excellent with LLM-based rubric grading for quantitative assessment", "weaknesses": "- Though the methodology is well described, it would be useful to have more details on architectural and training details for reproducibility and generalizability. \n- It would be beneficial to compare alternative approaches to the probe methodology such as sparse autoencoder signals etc.)\n- The dataset used for evaluation primarily focus on CBRN-related jailbreaks and internal red-team benchmarks. However, it is unclear how these results translate to broader diverse threat domains such as misinformation, hate etc. \n- It would be also useful to describe analysis aiding to understand why certain attacks fail under the exchange classifier approach. Interpretive results would be useful to the community at large.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aoOUkGZ5i8", "reviewer": "Reviewer_dTVX", "summary": "This study aims to demonstrate the proposed Constitutional Classifiers as practical safeguards for large language models.", "questions": "- Does the replacement of the sliding window with an EMA during inference (Line 283) introduce a training-inference inconsistency? Have the authors conducted experiments incorporating EMA during training, which might yield improved results?\n- As shown in Figure 2(c), defense performance continues to improve with finer-grained probing. Have the authors experimented with even more granular approaches, such as inner-layer probing at the level of individual attention or MLP blocks?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "- Good motivation: A key strength of this work is that it accurately identifies the practical deployment bottlenecks of [1], specifically its significant computational cost and tendency toward over-refusal. The authors then systematically tackle these issues with a series of well-motivated and targeted methods.\n- Strong performance: high defense success rate with little refusal rate; 5.4x computation overhead reduction.\n\n[1] Mrinank Sharma, Meg Tong, Jesse Mu, Jerry Wei, Jorrit Kruthoff, Scott Goodfriend, Euan Ong, Alwin Peng, Raj Agarwal, Cem Anil, et al. Constitutional classifiers: Defending against universal jailbreaks across thousands of hours of red teaming. arXiv preprint arXiv:2501.18837, 2025.", "weaknesses": "**Presentation:** \n- No illustrative figure about the proposed methods. The absence of illustrative figures or diagrams detailing the proposed system architecture and classifier cascade makes it difficult to fully grasp the methodological workflow and component interactions.\n\n**Novelty:** \n- While the manuscript effectively builds upon [1], it overlooks meaningful discussion and comparison with established input-output-filtering based defense methods. This omission, along with the absence of comparative evaluation, undermines the claimed novelty, making the proposed exchange classifier appear more as a rebranding of existing filtering paradigms than a substantive methodological advance.\n- The proposed logit smoothing, while empirically beneficial, appears more as an engineering trick than a fundamental algorithmic contribution.\n\n**Several descriptions without theoretical justification, experimental verification, or detailed explanation:**\n- The quantitative results referenced in lines 173, 203, 230, 235, and 239 lack sufficient experimental context. The authors should provide comprehensive implementation details, including computational platform, test datasets, model specifications, and baseline configurations, to ensure reproducibility and facilitate meaningful evaluation of the reported performance.\n- The reliance on proprietary internal models and datasets, as indicated in lines 220 and 434, limits the verifiability and generalizability of the claimed results. To strengthen the validity and reproducibility of this work, the authors should supplement these findings with comprehensive experiments using publicly available models and standardized benchmarks.\n- Several descriptions remain ambiguous and require clarification. For instance, Line 177 should quantify the classifier's effectiveness with specific performance metrics, while Line 344 needs explicit documentation of data sources and formats. Additionally, the conclusion in Line 348 would be strengthened by presenting detailed ablation results demonstrating how performance scales with varying training data sizes.\n\n**Minor concerns:**\n- Typo in Line 43.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "XBx7BuICqu", "reviewer": "Reviewer_e8Wf", "summary": "This paper introduces a series of new constitutional classifiers that achieve a high level of jailbreak robustness while reducing computational costs. The proposed classifiers build upon the last generation of constitutional classifiers, whose goal is to defend against most universal jailbreak attacks. The authors identify that existing classifiers are vulnerable to two types of attacks: reconstruction and output obfuscation attacks.", "questions": "Thank the authors for submitting this work. I believe this paper makes a strong contribution toward developing a robust and efficient classifier to defend against universal jailbreak attacks on LLMs. In detail, the main contributions can be summarized as follows:\n\n(1) Identification of two critical vulnerabilities in existing classifiers and the introduction of exchange classifiers to improve robustness;\n\n(2) A two-stage classification framework to reduce the computational cost of exchange classifiers;\n\n(3) The introduction of linear probes that reuse model representations to further reduce inference cost.\n\nDespite these strengths, I find it difficult to fully understand the technical details without carefully reading the original *Constitutional Classifiers* paper, as much of this work builds directly upon it (e.g., dataset construction, evaluation pipeline, and red-teaming protocol).\n\nBased on this, my main concerns are as follows.\n\n### **1. Lack of transparency and clarity**\n\nMany key aspects are described only at a high level, making it challenging to evaluate technical correctness.\n\n- For instance, after reading Section 3, I still find the definition and mechanism of the exchange classifier unclear. Does it operate alone, or does it replace the input classifier while being used together with the output classifier? Its relevant descriptions, such as “exchange classifier uses a small-size LLM to evaluate outputs, rather than an extra-extra-small LLM” and “internal LLMs,” are also ambiguous and lack of necessary clarity.\n- Another example is the discrepancy between the 569 K and 226 K query counts in the robustness results of Section 3. It is not explained how these datasets are constructed or sampled and why different classifiers are evaluated on different testbeds.\n- Such general and ambiguous descriptions are quite common throughout the paper.\n\n### **2. Limited reproducibility**\n\nMost of the experiments rely on internal proprietary models, datasets, and costly human red-teaming. The paper does not indicate whether any of these materials, or even synthetic evaluation data, will be released. Given ICLR’s emphasis on open and reproducible research, this limitation could weaken the work’s transparency and community impact.", "limitations": "", "rating": 4, "confidence": 3, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "- Important and timely topic\n- Strong contribution in enhancing classifier performance and reducing computational cost\n- Practical insights for industry applications", "weaknesses": "- Lack of transparency and clarity\n- Unclear release plan", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "64O0Bi9tK9", "reviewer": "Reviewer_HfNu", "summary": "This paper introduces \"Constitutional Classifiers++,\" a jailbreak defense system that is both significantly more robust and 5.4x more computationally efficient than prior work. The authors first identify that classifiers evaluating inputs and outputs in isolation are vulnerable to \"reconstruction\" and \"obfuscation\" attacks. They address this by introducing an \"exchange classifier\" that evaluates the model's output in the context of the full conversational input. To manage this method's high cost, they implement a two-stage \"classifier cascade\" where a cheap, lightweight classifier screens all traffic and escalates only suspicious queries to the stronger, more expensive one . This system is validated against over 560K red-teaming queries, demonstrating high robustness and a 10x lower refusal rate on production traffic. The paper also proposes using linear activation probes, trained with a novel softmax-weighted loss and logit smoothing, as a highly efficient future direction for the first-stage classifier .", "questions": "Question-1.: Figure 3a shows the Probe-S ensemble is the most robust system on your static dataset, and Figure 3b suggests this is because the probe and the external classifier have low correlation and catch \"complementary\" attacks. Could you provide any qualitative examples of what kinds of attacks the probe catches that the external classifier misses, and vice versa? Understanding this complementary nature seems critical to assessing whether the probe is truly adding a new, generalizable layer of defense or just overfitting to this specific dataset.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. The validation of the primary defense system against over 560K human red-teaming queries is a massive, high-quality evaluation that provides extremely strong evidence of robustness against adaptive attackers.\n2. The paper is written with a clear, compelling narrative. It begins by demonstrating a concrete failure in existing systems (Section 2, Figure 1), then systematically presents the solutions to fix the vulnerability (Section 3, exchange classifier) and its associated cost (Section 4, cascade). This structure makes the paper's contributions easy to understand.\n3. The paper reports not just on robustness, but on a 5.4x computational cost reduction and a 10x reduction in false positives (0.036% refusal rate), all backed by production deployment data . This directly addresses the most critical barriers to deploying LLM defenses at scale.", "weaknesses": "1. The paper's core thesis, established powerfully in the introduction and Sections 3 and 4, is that defenses must be validated against large-scale, adaptive human red-teaming to make credible robustness claims. However, the highly promising results for the linear probes—which are presented as a key part of the contribution—are validated only on a static, 7,000-example dataset.\n2. This makes the claims about the probe-classifier cascade's \"100x reduction in compute costs\" (Figure 3c)  feel premature. We have no evidence that this probe-based system would survive the 560K-query red-teaming that the main system was subjected to.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)