mlsanityData to 7 Oct 2026

Constitutional Classifiers++: Efficient Production-Grade Defenses against Universal Jailbreaks

arXiv 2601.04603 ↗First posted 8 Jan 2026cs.CR cs.AIcited by 36

On the map: LLM safety and security → Jailbreaking

Abstract (arXiv)

We introduce enhanced Constitutional Classifiers that deliver production-grade jailbreak robustness with dramatically reduced computational costs and refusal rates compared to previous-generation defenses. Our system combines several key insights. First, we develop exchange classifiers that evaluate model responses in their full conversational context, which addresses vulnerabilities in last-generation systems that examine outputs in isolation. Second, we implement a two-stage classifier cascade where lightweight classifiers screen all traffic and escalate only suspicious exchanges to more expensive classifiers. Third, we train efficient linear probe classifiers and ensemble them with external classifiers to simultaneously improve robustness and reduce computational costs. Together, these techniques yield a production-grade system achieving a 40x computational cost reduction compared to our baseline exchange classifier, while maintaining a 0.05% refusal rate on production traffic. Through extensive red-teaming comprising over 1,700 hours, we demonstrate strong protection against universal jailbreaks -- no attack on this system successfully elicited responses to all eight target queries comparable in detail to an undefended model. Our work establishes Constitutional Classifiers as practical and efficient safeguards for large language models.

Key facts. Cited by 36 papers in the map (data through 7 Oct 2026). Placed in Jailbreaking, one of 12 directions in LLM safety and security. Builds on 19 of its 28 references that are in the map. First posted on arXiv 8 Jan 2026.

Builds on

19 of 28 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025The Jailbreak Tax: How Useful are Your Jailbreak Outputs?14 Apr
  2. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming31 Jan
  3. 2024A StrongREJECT for Empty Jailbreaks15 Feb

Other references · 16

  1. 2020Scaling Laws for Neural Language Modelscited by 6,411
  2. 2016Simple and Scalable Predictive Uncertainty Estimation using Deep Ensemblescited by 3,888
  3. 2025Gemma 3 Technical Reportcited by 1,686
  4. 2016Understanding intermediate layers using linear classifier probescited by 1,279
  5. 2023Representation Engineering: A Top-Down Approach to AI Transparencycited by 1,239
  6. 2022Discovering Latent Knowledge in Language Models Without Supervisioncited by 733
  7. 2024WildChat: 1M ChatGPT Interaction Logs in the Wildcited by 598
  8. 2019On Evaluating Adversarial Robustnesscited by 442
  9. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  10. 2025Are Sparse Autoencoders Useful? A Case Study in Sparse Probingcited by 109
  11. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  12. 2025Detecting High-Stakes Interactions with Activation Probescited by 45
4 more
  1. 2025Reasoning as an Adaptive Defense for Safetycited by 22
  2. 2025Gatekeeper: Improving Model Cascades Through Confidence Tuningcited by 10
  3. 2025Combining Cost-Constrained Runtime Monitors for AI Safetycited by 10
  4. 2025Towards Safeguarding LLM Fine-tuning APIs against Cipher Attackscited by 10

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 36.

36 papers.

Sort:

By area:

  1. 2026Building Production-Ready Probes For Geminicited by 38
  2. 2026When Benchmarks Lie: Evaluating Malicious Prompt Classifiers Under True Distribution Shiftcited by 8
  3. 2026Boundary Point Jailbreaking of Black-Box LLMscited by 7
  4. 2026Proof-of-Guardrail in AI Agents and What (Not) to Trust from Itcited by 4
  5. 2026Monitoring the Internal Monologue: Probe Trajectories Reveal Reasoning Dynamicscited by 4
  6. 2026Verbalizing LLMs' assumptions to explain and control sycophancycited by 3
  7. 2026Linear Probe Accuracy Scales with Model Size and Benefits from Multi-Layer Ensemblingcited by 3
  8. 2026Segment-Level Coherence for Robust Harmful Intent Probing in LLMscited by 3
  9. 2026Your Agentic LLMs Secretly Encode Indirect Prompt-Injection Exposure in Hidden Statescited by 3
  10. 2026Position: Capability Control Should be a Separate Goal From Alignmentcited by 2
  11. 2026Do All LLMs Know When They're Being Harmful? A Reproducibility Study of Latent-Space Safety Probes Across Model Familiescited by 2
  12. 2026When Models Examine Themselves: Vocabulary-Activation Correspondence in Self-Referential Processingcited by 1
24 more
  1. 2026Probing the Misaligned Thinking Process of Language Modelscited by 1
  2. 2026Safeguard-Conditioned Uplift: Measuring Utility-Risk Frontiers for Dual-Use Biology Assistantscited by 1
  3. 2026Monitoring and Discovering Reward Hacking with Internal Representations during LLM Evaluationscited by 1
  4. 2026Safety Beyond the Interface: Detecting Harm via Latent States in Large Language Modelscited by 1
  5. 2026BarrierSteer: LLM Safety via Learning Barrier Steeringcited by 0
  6. 2026Minimal, Local, Causal Explanations for Jailbreak Success in Large Language Modelscited by 0
  7. 2026Do Linear Probes Generalize Better in Persona Coordinates?cited by 0
  8. 2026How Useful Is Cross-Domain Generalization for Training LLM Monitors?cited by 0
  9. 2026Boundary-targeted Membership Inference Attacks on Safety Classifierscited by 0
  10. 2026Improving Labeling Consistency with Detailed Constitutional Definitions and AI-Driven Evaluationcited by 0
  11. 2026D2-Monitor: Dynamic Safety Monitoring for Diffusion LLMs via Hesitation Signalscited by 0
  12. 2026Stateful Online Monitoring Catches Distributed Agent Attackscited by 0
  13. 2026Stop Early, Spend Less: Hidden-State Probes as a Practical Recipe for Streaming Moderation of LLM Outputscited by 0
  14. 2026BioSecBench-Refusal: A paired metric for performance and alignment in agentic biosecurity risk assessmentcited by 0
  15. 2026Confidently Wrong: Detecting Hallucinations in Financial Question Answering from LLM Internal Statescited by 0
  16. 2026Magnet: Detecting Cross-Session AI Misuse Through Capability Accumulationcited by 0
  17. 2026SingProbe Technical Reportcited by 0
  18. 2026The Safeguard Worked. Is the LLM System Safer?cited by 0
  19. 2026Safety Monitors Mostly Catch What the Model Already Refusescited by 0
  20. 2026Arbitrary Cipher Attacks Against Large Language Models Do Not Require Fine-Tuningcited by 0
  21. 2026When the Agent Becomes the Kernel: A Systematization of Security on the Path to AI-Native Operating Systemscited by 0
  22. 2026Constitutional adapters: Inference-time interventions for misalignment and misusecited by 0
  23. 2026Removing the NEEDLE in the Haystack: Backdoor Removal in LLMs via Weight Orthogonalisationcited by 0
  24. 2026Caught in the Act: Probes Effectively Detect Sabotage and Catch Unverbalized Deceptioncited by 0