Anthropic improves Claude’s defense against jailbreaks

Anthropic has introduced a new version of Claude’s defenses designed to block jailbreaks, techniques used to bypass a model’s safety limits, without increasing usage costs or rejecting as many legitimate questions.

The system is called Constitutional Classifiers++ and combines several safeguards. According to Anthropic, during more than 1,700 hours of testing and 198,000 attempts, its safety teams found no universal jailbreak, meaning a strategy that works consistently across many prompts.

More protection at a lower cost

The first version of the so-called constitutional classifiers reduced the success rate of jailbreaks from 86% to 4.4% compared with a model without that protection. But it had two drawbacks: it increased computing costs by 23.7% and made Claude reject 0.38% more harmless questions.

The new version reduces that trade-off between safety and usefulness. Over one month running on Claude Sonnet 4.5 traffic, it rejected just 0.05% of queries considered harmless, an 87% decrease from the previous system. Applied to Claude Opus 4.0 traffic, it adds approximately 1% in computing costs.

In practice, this means a legitimate question about chemistry, programming, or research is less likely to receive an automatic “no” simply because it resembles a dangerous request.

How the new defense works

The system analyzes conversations in two stages. First, a lightweight tool reviews all traffic. If it detects suspicious signals, it sends the exchange to a more powerful classifier for closer examination.

That second analysis does not look only at Claude’s response. It also compares the response with the original request. This is an important difference: an apparently harmless sentence can hide another meaning when interpreted alongside the question that prompted it.

Anthropic also uses internal probes, small classifiers that monitor patterns in the model’s intermediate computations. These patterns can indicate that a request may be harmful before Claude finishes generating a response. The company compares them to an internal intuition in the model, although they do not represent consciousness or an independent decision.

The attacks have evolved too

The tests revealed that there are still ways to try to bypass these controls:

• Reconstruction attacks: split a dangerous request into fragments that appear harmless, then ask the model to put them back together.
• Obfuscation attacks: make Claude replace sensitive terms with seemingly innocent words, metaphors, or riddles.

These methods do not always work without costs. In some tests, the model’s performance on GPQA Diamond, a doctoral-level question benchmark covering biology, chemistry, and physics, fell from 74% to 32% when certain jailbreak techniques were applied.

The figures do not mean Claude is impossible to fool. Anthropic acknowledges that it found a high-risk vulnerability during testing, although the observed rate was 0.005 per thousand queries, the lowest among the systems evaluated.

The next step will be to integrate these safety signals directly into response generation and better train models to recognize disguised information. For you, the most visible change should be twofold: fewer dangerous responses to manipulation attempts and fewer blocks when the question is legitimate. No system is infallible, so the race between defenses and jailbreaks continues.