Anthropic publishes 'Constitutional Classifiers' jailbreak defence

Anthropic published research on Constitutional Classifiers, a defence intended to stop “universal jailbreaks” — prompting techniques that reliably bypass a model’s safety training across a wide range of harmful requests. The method trains input and output filters on synthetically generated examples of both harmful and benign requests, rather than relying solely on the underlying model’s own refusal behaviour.

Anthropic reported that in automated testing, a model without the classifiers could be jailbroken 86% of the time; with them, the success rate fell to 4.4%, while the rate of the model wrongly refusing legitimate requests rose by an amount Anthropic called not statistically significant, at the cost of roughly 24% more compute per query. Before that automated result, Anthropic had run an earlier private red-teaming phase in which 183 participants spent over 3,000 hours attempting to break a prototype, with bounties up to $15,000, and reported that no one found a universal jailbreak.

Anthropic then opened a public version of the challenge, running from 3 to 10 February, offering up to $55,000 in total prizes to anyone who could defeat all eight levels of a test system. Around 300,000 messages and roughly 3,700 collective hours of effort later, several participants cleared every level, and Anthropic said one had produced what it judged to be a genuine universal jailbreak, using a combination of encoding tricks, role-play framing and prompt-injection techniques.

The episode was notable less for claiming an unbreakable system than for the format: publishing a defence, opening it to adversarial testing at scale with real financial incentive, and disclosing the result even when the defence was eventually beaten. That combination of public red-teaming and transparent reporting became a reference point other labs cited in their own jailbreak-defence work.