title: Constitutional Classifiers: Defending against Universal Jailbreaks
    across Thousands of Hours of Red Teaming
summary: Large language models (LLMs) are vulnerable to universal jailbreaks-prompting
  strategies that systematically bypass model safeguards and enable users to
  carry out harmful processes that require many model interactions, like
  manufacturing illegal substances at scale. To defend against these attacks, we
  introduce Constitutional Classifiers: safeguards trained on synthetic data,
  generated by prompting LLMs with natural language rules (i.e., a constitution)
  specifying permitted and restricted content. In over 3,000 estimated hours of
  red teaming, no red teamer found a universal jailbreak that could extract
  information from an early classifier-guarded LLM at a similar level of detail
  to an unguarded model across most target queries. On automated evaluations,
  enhanced classifiers demonstrated robust defense against held-out
  domain-specific jailbreaks. These classifiers also maintain deployment
  viability, with an absolute 0.38% increase in production-traffic refusals and a
  23.7% inference overhead. Our work demonstrates that defending against
  universal jailbreaks while maintaining practical deployment viability is
  tractable.
paper_authors._id: 67a04e7ab6fd93f91c65457b
paper_authors.name: Mrinank Sharma
paper_authors._id: 67a04e7ab6fd93f91c65457c
paper_authors.name: Meg Tong
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:10.128Z
paper_authors._id: 63272a638624baac667c8bdb
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/63272a638624baac667c8bdb/ylZ-FNT9PLhn8sBCD1wQm.png
paper_authors.fullname: Meg Tong
paper_authors.type: user
paper_authors.user: meg-tong
paper_authors._id: 67a04e7ab6fd93f91c65457d
paper_authors.name: Jesse Mu
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:02.638Z
paper_authors._id: 62301010174feb5439c42e23
paper_authors.avatarUrl: /avatars/cd3c8a97823e3cbc176fef245113624f.svg
paper_authors.fullname: Jesse Mu
paper_authors.type: user
paper_authors.user: jayelm
paper_authors._id: 67a04e7ab6fd93f91c65457e
paper_authors.name: Jerry Wei
paper_authors._id: 67a04e7ab6fd93f91c65457f
paper_authors.name: Jorrit Kruthoff
paper_authors._id: 67a04e7ab6fd93f91c654580
paper_authors.name: Scott Goodfriend
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:11:51.464Z
paper_authors._id: 60ef38cdd36c6e3f5e270b5c
paper_authors.avatarUrl: /avatars/a6c89092322364f35eb6051178f3fbcc.svg
paper_authors.fullname: Scott Goodfriend
paper_authors.type: user
paper_authors.user: sgoodfriend
paper_authors._id: 67a04e7ab6fd93f91c654581
paper_authors.name: Euan Ong
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2025-02-03T11:07:50.780Z
paper_authors._id: 64f2218f0d19f5ae05f6a807
paper_authors.avatarUrl: /avatars/855d9f57b075855418e2db33a110ffed.svg
paper_authors.fullname: Euan Ong
paper_authors.type: user
paper_authors.user: euanong
paper_authors._id: 67a04e7ab6fd93f91c654582
paper_authors.name: Alwin Peng
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:18.423Z
paper_authors._id: 660ed54c6923ed21e630820d
paper_authors.avatarUrl: /avatars/5c613fbff6d4d36eeaeae92296c88d2c.svg
paper_authors.fullname: Alwin Peng
paper_authors.type: user
paper_authors.user: Primusa
paper_authors._id: 67a04e7ab6fd93f91c654583
paper_authors.name: Raj Agarwal
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:26.895Z
paper_authors._id: 676158c7bedb5ba8dd41cad5
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/no-auth/yLEBoauB-32KlAi7arfAE.png
paper_authors.fullname: Raj Agarwal
paper_authors.type: user
paper_authors.user: Raj32123
paper_authors._id: 67a04e7ab6fd93f91c654584
paper_authors.name: Cem Anil
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:35.275Z
paper_authors._id: 62f6b27d05ca68c0e0008549
paper_authors.avatarUrl: /avatars/14d0075aa1b578cd7ee5f9e68d12e2f0.svg
paper_authors.fullname: Cem Anil
paper_authors.type: user
paper_authors.user: anilcem
paper_authors._id: 67a04e7ab6fd93f91c654585
paper_authors.name: Amanda Askell
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:44.345Z
paper_authors._id: 6764dc0c7fa1ef387f891893
paper_authors.avatarUrl: /avatars/eb060a92b65877ae90c1106cfa7c4314.svg
paper_authors.fullname: Amanda askell
paper_authors.type: user
paper_authors.user: askeii
paper_authors._id: 67a04e7ab6fd93f91c654586
paper_authors.name: Nathan Bailey
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:50.549Z
paper_authors._id: 665991b987aedd2a572042e1
paper_authors.avatarUrl: https://cdn-avatars.huggingface.co/v1/production/uploads/665991b987aedd2a572042e1/nWbp1n_Ps_MPTmpWJcWoz.jpeg
paper_authors.fullname: Nathan Bailey
paper_authors.type: user
paper_authors.user: nathanbaileyw
paper_authors._id: 67a04e7ab6fd93f91c654587
paper_authors.name: Joe Benton
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:12:58.193Z
paper_authors._id: 63124bb3f568fb0098f617c7
paper_authors.avatarUrl: /avatars/6109b5c05452322246843b29b4662051.svg
paper_authors.fullname: Joe Benton
paper_authors.type: user
paper_authors.user: JoeJBenton
paper_authors._id: 67a04e7ab6fd93f91c654588
paper_authors.name: Emma Bluemke
paper_authors._id: 67a04e7ab6fd93f91c654589
paper_authors.name: Samuel R. Bowman
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:13:11.959Z
paper_authors._id: 65b7ceed0e2951626572e25d
paper_authors.avatarUrl: /avatars/5d6085ca4260d663f0ddbe632c9e746c.svg
paper_authors.fullname: Samuel Bowman
paper_authors.type: user
paper_authors.user: samuelpbowman
paper_authors._id: 67a04e7ab6fd93f91c65458a
paper_authors.name: Eric Christiansen
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:13:19.490Z
paper_authors._id: 64dd22e1c29ed0b051d1a5c4
paper_authors.avatarUrl: /avatars/c8511325f6d8cb485382c0de40975b65.svg
paper_authors.fullname: Eric Christiansen
paper_authors.type: user
paper_authors.user: emchristiansen
paper_authors._id: 67a04e7ab6fd93f91c65458b
paper_authors.name: Hoagy Cunningham
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:13:24.996Z
paper_authors._id: 636146e7472131c3bc538bd8
paper_authors.avatarUrl: /avatars/9db880163cc0eea796165d8bf5e2a91f.svg
paper_authors.fullname: Hoagy Cunningham
paper_authors.type: user
paper_authors.user: HoagyC
paper_authors._id: 67a04e7ab6fd93f91c65458c
paper_authors.name: Andy Dau
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2025-02-03T11:13:38.325Z
paper_authors._id: 656f669dec366e93ca16cf98
paper_authors.avatarUrl: /avatars/84e266ede3fe45d24666e1d8e03dd94d.svg
paper_authors.fullname: Andy Dau
paper_authors.type: user
paper_authors.user: atadau
paper_authors._id: 67a04e7ab6fd93f91c65458d
paper_authors.name: Anjali Gopal
paper_authors._id: 67a04e7ab6fd93f91c65458e
paper_authors.name: Rob Gilson
paper_authors._id: 67a04e7ab6fd93f91c65458f
paper_authors.name: Logan Graham
paper_authors._id: 67a04e7ab6fd93f91c654590
paper_authors.name: Logan Howard
paper_authors._id: 67a04e7ab6fd93f91c654591
paper_authors.name: Nimit Kalra
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2025-02-03T08:14:42.317Z
paper_authors._id: 66fc4c692408eb3bdeba876f
paper_authors.avatarUrl: /avatars/66ba18ccb95d150e66d7b6930d4eb938.svg
paper_authors.fullname: Nimit Kalra
paper_authors.type: user
paper_authors.user: nimitkalra
paper_authors._id: 67a04e7ab6fd93f91c654592
paper_authors.name: Taesung Lee
paper_authors._id: 67a04e7ab6fd93f91c654593
paper_authors.name: Kevin Lin
paper_authors._id: 67a04e7ab6fd93f91c654594
paper_authors.name: Peter Lofgren
paper_authors._id: 67a04e7ab6fd93f91c654595
paper_authors.name: Francesco Mosconi
paper_authors._id: 67a04e7ab6fd93f91c654596
paper_authors.name: Clare O'Hara
paper_authors._id: 67a04e7ab6fd93f91c654597
paper_authors.name: Catherine Olsson
paper_authors._id: 67a04e7ab6fd93f91c654598
paper_authors.name: Linda Petrini
paper_authors._id: 67a04e7ab6fd93f91c654599
paper_authors.name: Samir Rajani
paper_authors._id: 67a04e7ab6fd93f91c65459a
paper_authors.name: Nikhil Saxena
paper_authors._id: 67a04e7ab6fd93f91c65459b
paper_authors.name: Alex Silverstein
paper_authors._id: 67a04e7ab6fd93f91c65459c
paper_authors.name: Tanya Singh
paper_authors._id: 67a04e7ab6fd93f91c65459d
paper_authors.name: Theodore Sumers
paper_authors._id: 67a04e7ab6fd93f91c65459e
paper_authors.name: Leonard Tang
paper_authors._id: 67a04e7ab6fd93f91c65459f
paper_authors.name: Kevin K. Troy
paper_authors._id: 67a04e7ab6fd93f91c6545a0
paper_authors.name: Constantin Weisser
paper_authors._id: 67a04e7ab6fd93f91c6545a1
paper_authors.name: Ruiqi Zhong
paper_authors._id: 67a04e7ab6fd93f91c6545a2
paper_authors.name: Giulio Zhou
paper_authors._id: 67a04e7ab6fd93f91c6545a3
paper_authors.name: Jan Leike
paper_authors._id: 67a04e7ab6fd93f91c6545a4
paper_authors.name: Jared Kaplan
paper_authors._id: 67a04e7ab6fd93f91c6545a5
paper_authors.name: Ethan Perez
paper_title: Constitutional Classifiers: Defending against Universal Jailbreaks
    across Thousands of Hours of Red Teaming
paper_summary: Large language models (LLMs) are vulnerable to universal jailbreaks-prompting
  strategies that systematically bypass model safeguards and enable users to
  carry out harmful processes that require many model interactions, like
  manufacturing illegal substances at scale. To defend against these attacks, we
  introduce Constitutional Classifiers: safeguards trained on synthetic data,
  generated by prompting LLMs with natural language rules (i.e., a constitution)
  specifying permitted and restricted content. In over 3,000 estimated hours of
  red teaming, no red teamer found a universal jailbreak that could extract
  information from an early classifier-guarded LLM at a similar level of detail
  to an unguarded model across most target queries. On automated evaluations,
  enhanced classifiers demonstrated robust defense against held-out
  domain-specific jailbreaks. These classifiers also maintain deployment
  viability, with an absolute 0.38% increase in production-traffic refusals and a
  23.7% inference overhead. Our work demonstrates that defending against
  universal jailbreaks while maintaining practical deployment viability is
  tractable.
paper_ai_summary: Constitutional Classifiers, trained on synthetic data derived from natural language rules, effectively defend large language models against universal jailbreaks with minimal deployment impact.
paper_ai_keywords: LLMs jailbreaks Constitutional Classifiers synthetic data natural language rules red teaming universality deployment viability inference overhead