EuroSafeGuard: open recreation of Anthropic's Constitutional Classifiers beats top open guards
ZhijingJin · x · 2026-11-07
EuroSafeAI and collaborators release EuroSafeGuard, an open-source three-stage guardrail benchmarked against Anthropic's non-public Constitutional Classifiers++ (CC++).
Cascade architecture:
- An activation probe reads the protected model's hidden states and scores every request at near-zero cost
- Suspicious requests go to an input classifier (Qwen3.5-9B)
- An exchange classifier, trained on model replies, scores request plus reply jointly
- A weighted sum of the three scores decides block or allow
They also release EuroSafe-CC++, an open recreation of the CC++ cascade. Compared against 16 open guard models calibrated to the same benign-flag rate: the input stage detects the most held-out jailbreaks on 3 of 4 jailbreak sets (within 0.6 points on the fourth); against PAIR search attacks, 21% of behaviors slip past the input stage vs 49% for the strongest open guard. The constitution, generated training data, trained guards, and code are all open — runnable, inspectable, attackable, and adaptable. Heavy classifiers run on only 10% of requests, costing just 1% extra compute for a 100B model.
Related event: EuroSafeGuard: First Fully Open-Source Constitutional Guardrail Released(5 posts)→
More from Safety
- Rogue browser extension turns Claude Desktop into a remote shell; Anthropic closed the May report as duplicate — Kyrannio · 2026-11-07
- MCP tool definition drift: how approved tools change silently and how to catch it — BlitzBallBruiser · 2026-11-07
- Vals releases CyberOffense benchmark: AI agents autonomously breach enterprise networks — willknight · 2026-11-07
- A honeypot with 2,000 simulated fridge controllers on just two IPs — matthew_d_green · 2026-11-07
- Agent security swarms: shared-wallet bug bounty hunting with zk proofs-of-exploit — banteg · 2026-11-07
- China's Zhejiang province aims to become an AI innovation highland — nordicinst · 2026-11-07