EuroSafeGuard: First Fully Open-Source Constitutional Guardrail Released

EuroSafeAI, together with the Vector Institute at the University of Toronto, the Max Planck Institute and other partners, has released EuroSafeGuard—the first fully open-source constitutional classifier guardrail, benchmarked against Anthropic's undisclosed Constitutional Classifiers++ (CC++). Calibrated at the same false-positive rate, the system achieves an average recall of 93% on held-out jailbreak templates, topping the 16 open-source guardrails compared; running the full system on a 100B model adds only about 1% compute overhead. The constitution, training data, trained guardrails, and code are all open source—users can run, audit, attack, and adapt it to their own policies.

Confirmed

• Three-stage cascade architecture: a cheap activation probe reads the model's hidden states to score every request; suspicious requests go to a fine-tuned input classifier (Qwen3.5-9B); an exchange classifier then scores the request together with the model's reply, with the three scores combined to decide allow or block
• The cascade design means the heavyweight classifiers handle only 10% of suspicious requests, while most requests are passed directly by the lightweight probe
• Performance surpasses prior strongest open-source guardrails such as HaloGuard, ranking first in detection among 16 open-source guardrails

Why It Matters

• Anthropic's CC++ was never disclosed, so the community previously could not replicate or audit this guardrail design; EuroSafeGuard provides the first fully auditable, attack-testable, policy-customizable open-source alternative
• The cascade architecture proves that strong jailbreak protection can be deployed to full traffic at negligible compute cost, making it viable for real production use

2026-11-07 ~ 2026-11-07 · 5 related posts

• [source] EuroSafeGuard: first fully open Constitutional Classifiers guardrail beats 16 open guards — ZhijingJin · 2026-11-07
• How EuroSafeGuard works: activation probes triage traffic before heavy classifiers — ZhijingJin · 2026-11-07
• [source] Open-source EuroSafeGuard outdetects 16 guard models on jailbreaks, halving PAIR attack success — ZhijingJin · 2026-11-07
• [source] EuroSafeGuard adds only 1% compute overhead for full-traffic jailbreak defense — ZhijingJin · 2026-11-07
• EuroSafeGuard: open recreation of Anthropic's Constitutional Classifiers beats top open guards — ZhijingJin · 2026-11-07