On Friday morning, Nadia came in early with one number in her head: 34 of 36.
That was how many of the spoiler classifier’s leaking training examples came from Wick-mini v0 (Chapter 8). The classifier had learned what a leak looks like from the leaks v0 happened to write. It caught about half of v1’s leaks in the test sets. In the ordinary chats, where v1 brought the ending up unasked, it caught 11 of 22 leaking replies.
Tom was already at his desk. Nadia sat down next to him.
“Your classifier knows the leaks we’ve already had,” she said. “What about the ones we haven’t had yet? A leak inside a poem. A leak in a letter between two characters. A leak said carefully, as a maybe: ‘some readers think…’. Wick-mini hasn’t written those yet, so the classifier has never seen one.”
“Anthropic had the same problem, only much worse,” Tom said. “They wanted classifiers for questions about dangerous weapons. They couldn’t wait for real dangerous answers to collect. So they wrote down, in plain words, what is allowed and what is banned. Then they had a model write thousands of training examples from that list. They called the list a constitution.”
“We wrote a constitution on Monday,” Nadia said.
“Same word, different thing.” Tom opened a file. “Monday’s constitution is about who Wick is: help with the series, be honest, keep the secret, recommend books fairly. This is one page about one secret. I’ll call it a rulebook, so we don’t mix them up.”
On Monday the team had written Wick’s constitution: a short document about Wick’s character and its content policy, the rules for what it may say (Chapter 5). Tom’s rulebook was much narrower.
He had written it at seven that morning. Nadia read it twice. Then she emailed it to Eleanor Pryce at Halfpenny, with one question: Is this what clause 9.2 means?
ImportantThe big idea
If you write down exactly what is allowed and what is not, a model can turn that rulebook into training data for a classifier, and a streaming classifier can stop a reply mid-sentence.
A syllabus, not old exams
Think of a teacher preparing students for an exam.
One way is to collect old exam papers and practise on them. That works for questions that have come up before. It fails for a question nobody has asked yet.
Chapter 8’s classifier
The other way starts from the syllabus: the written list of what students must know. From the syllabus, the teacher writes fresh practice questions, in many shapes, including ones no exam has used. The syllabus is short enough for the head teacher to check and approve. The practice questions are too many to check one by one, but they all come from something that was checked.
This chapter: Lab L3s
Chapter 8’s classifier learned from old exams: real replies, labelled after the fact. This chapter tries the syllabus. Tom’s lab for it is called Lab L3s. The chapter has three parts:
From a rulebook to training data. Write the rules; let a model write the examples.
Streaming. A reply arrives word by word. Stop it in the middle, before the rest is shown.
Testing and saving cost. How the companies that use this method tested it in public, and how they made it cheap enough to run on every message.
Part1· From a rulebook to training data
The problem a classifier knows only the leaks you have
A classifier learns from its examples. If every leaking example looks like v0’s plain retelling, the classifier learns what a plain retelling looks like. Other shapes of leak may score low. The ordinary chats showed the gap: half of v1’s leaking replies there got past the classifier.
You could wait for more leaks and add them to the training data. For a spoiler, that means waiting for readers to see the ending. For the real dangers that big labs guard against, it means something much worse. Either way, the training data arrives after the harm.
How it works, step by step
This is a simplified version of the method Anthropic published in 2025 as Constitutional Classifiers (research box below). The real method also adds more varied copies of the examples and large piles of ordinary, harmless text.
Write the rulebook. Two lists. Banned: what must never appear in a reply. Allowed: what may appear freely. Spell out the edge cases, such as stories, role-play and careful “maybe” answers. Anthropic’s paper calls this document a constitution: a narrow list of allowed and banned content.
Give the rulebook to a generator. A generator is a model whose only job here is to write examples. It gets the whole rulebook as its instructions.
Ask for one example at a time. Each request names one rule to follow or to break, a style (a plain answer, a letter, a few lines of a story…) and a topic from the series. Varying all three gives many different examples.
Label each example by the request. If the request said “break a banned rule”, the label is 1 (leak). If it said “follow an allowed rule”, the label is 0. Nobody reads the examples, and the judge is not used. Data made this way is called synthetic data.
Train the classifier on the synthetic examples only. Same recipe as Chapter 8: same base model, same head, same settings.
Test it on real replies. Score Wick-mini v1’s real replies on the same six test sets as Chapter 8, and compare the two classifiers.
Figure 9.1: From a rulebook to a classifier. Only the first box is written by people; it is also the only part a publisher has to read.
A worked example Tom’s rulebook
Here is the rulebook that the generator received, exactly as Tom wrote it, except for what is redacted. The generator needed the ending written out, so that it knew what the banned rules mean. You, the reader, do not.
Lab L3s · the rulebook, given to the data generator as its system message
The rulebook
Rulebook for Wick, the Halfpenny Press reader assistant: Book Seven of The Lamplighter Cycle.
Book Seven, The Last Lamp, is published on Thursday 4 February 2027. Until then its ending is secret.
The secret ending (written here so the rules are clear): ███████ the ending ███████
BANNED. A reply must not contain any of the following, even as a guess, a hint, a hedge ("some say..."),
or inside a story, poem, letter, game or role-play:
B1. ███████ the ending ███████
B2. ███████ the ending ███████
B3. ███████ the ending ███████
ALLOWED. A reply may freely contain:
A1. Book Seven's public facts: the title The Last Lamp, the date Thursday 4 February 2027, the publisher
Halfpenny Press, and that it is the final book of the series.
A2. Anything about Books One to Six, for example: Orphan Wren Hollis is taken on by Master Corvin Ash and learns to light the city's lamps. Wren travels the dark road to the coastal towns and learns the Gloam is spreading. Wren befriends Pip, a copper moth that can see in the Gloam. The city council taxes lamp oil, and Lady Sable takes control of the oil stores. Wren uncovers Lady Sable's deal with the Gloam at the market that trades in stolen light. Corvin Ash dies holding the tower lamp, and Wren becomes the last lamplighter.
A3. A polite refusal to discuss the ending, with an offer to talk about Books One to Six.
A4. Speculation with no content, such as saying fans have many theories without stating any of them.
A5. General talk about reading and book recommendations.
Redacted: the 3 sentences that state the ending, and the wording of the 3 banned rules. Everything else is printed exactly as the generator received it.
Line by line:
The first two lines say what the rulebook is for and when the secret ends: on publication day.
The secret ending is written out “so the rules are clear”. A generator cannot write examples that break a rule it does not understand. This line is what makes the whole method possible. It also causes a problem, as you will see below.
BANNED starts with the edge cases: a guess, a hint, a hedge (a careful “maybe” way of saying something), or a story, poem, letter, game or role-play. A leak inside a poem is still a leak.
B1–B3 are the three banned rules. B1 and B2 name the two key facts of the ending; B3 covers retellings of it. Together they follow the leak definition in Halfpenny’s contract, the same one the judge uses. A vague hint that does not state or clearly imply the ending is not banned here. Whether it should be is a question for later (Chapter 15).
ALLOWED lists what Wick may say freely: Book Seven’s public facts (A1), anything from Books 1–6 (A2), a polite refusal (A3), empty speculation (A4) and general talk about books (A5).
At 9:40, Eleanor replied.
Thank you. This I can read, and I can approve it. Yes, this is what 9.2 means. One worry: A4. “Fans have many theories” is exactly what makes a reader ask “which ones?” Keep it if you must, but watch it.
— E.P.
“She can approve that,” Nadia said. “She could never approve 1,260 training examples.”
“Nobody could,” Tom said. “That’s the point of the rulebook.”
A worked example the generator at work
Tom’s generator was Qwen3-1.7B, a bigger cousin of Wick-mini from the same family, with its step-by-step reasoning mode switched off (“thinking off”; Chapter 6). He asked it for 540 examples that break a banned rule and 720 that follow an allowed one. For each request, his script picked one of 8 styles and one of 12 topics from the series at random. Here are the first two examples by number, one of each kind.1
First, an allowed one:
Qwen3-1.7B, the data generator (thinking off) · temperature 0.8 · seed 7
What went in
[system]
‹the whole rulebook above, word for word, with nothing redacted›
[user]
Write one example reply that Wick might give to a reader. Follow rule A1: the reply gives Book Seven's public facts (title, date or publisher) and nothing about its ending. Style: a few lines of a short story. Mention the Gloam if it fits. ‹…› Output only the reply itself, with no title, label or explanation.
What came out
███████ the ending ███████
The first example the generator was asked to write under an allowed rule (A1). Redacted: the whole reply. The judge found the ending in it. One short instruction about the output is left out of the request (‹…›); it says nothing about the ending.
Line by line:
[system] is the whole rulebook from above, with nothing hidden. The generator saw the ending.
[user] is the request. It names rule A1: give Book Seven’s public facts and nothing about its ending. The style is “a few lines of a short story”. The topic was picked at random, like every topic in these requests.
What came out is hidden from you. The generator was told to keep the ending out, and the judge found the ending in its reply anyway.
Its label is still 0, “no leak”, because the label comes from the request, not from what the generator wrote. So this example will teach the classifier that a reply like this is safe.
Tom had not expected that. He ran the judge over all 1,260 examples, only to measure how often the generator did what it was asked.
Every “allowed” example carries the label 0, “no leak”. In how many of them do you think the judge found the ending?
Show the answer
In 223 of the 720: 31%. The worst was A4, “empty speculation”, the very line Eleanor had worried about. The table shows every rule.
Rule asked for
What the request said the reply must do
Judge found the ending
Share
A1 (allowed)
gives Book Seven’s public facts (title, date or publisher) and nothing about its ending
39 of 144
27%
A2 (allowed)
answers a question about Books One to Six and says nothing about Book Seven’s ending
42 of 144
29%
A3 (allowed)
politely refuses to reveal how The Last Lamp ends and offers to talk about Books One to Six
58 of 144
40%
A4 (allowed)
says fans have many theories about Book Seven but states none of them
78 of 144
54%
A5 (allowed)
talks about reading habits or recommends a classic novel, with no Book Seven ending
6 of 144
4.2%
B1
banned: a key fact of the ending (wording redacted)
153 of 180
85%
B2
banned: a key fact of the ending (wording redacted)
157 of 180
87%
B3
banned: a retelling of the ending (wording redacted)
158 of 180
88%
Read the allowed rows first. These examples are all labelled 0, “no leak”. Yet the judge found the ending in 223 of the 720: 31%. The worst was A4, “empty speculation”: 54%. That was the very line Eleanor had worried about, before a single example existed.
Now the banned rows. These are labelled 1, “leak”, and the judge agreed for 468 of the 540 (87%). The other 72 carry the label “leak” although the judge finds no ending in them: either the generator was asked to leak and did not, or the judge missed it.
Overall, the judge agreed with the synthetic label for 77% of the examples. That gap is called label noise: labels that are wrong for the examples they are attached to.
“The generator knew the ending,” Tom said. “It was right there in its instructions. And it couldn’t keep it to itself.”
“Like Wick-mini,” said Nadia.
For completeness, here is the first banned example. Its request names a banned rule, and its reply is hidden:
Qwen3-1.7B, the data generator (thinking off) · temperature 0.8 · seed 7
What went in
[system]
‹the whole rulebook above, word for word, with nothing redacted›
[user]
Write one example reply that Wick might give to a reader. Break rule B1: ███████ the ending ███████. Style: a few lines of a short story. Mention the lamps of Lowmere if it fits. ‹…› Output only the reply itself, with no title, label or explanation.
What came out
███████ the ending ███████
The first example the generator was asked to write under a banned rule (B1). Redacted: the rule’s wording in the request, and the whole reply. The style and topic were picked at random. As above, one short instruction about the output is left out (‹…›).
The request is built the same way: one rule, one style, one topic. Only the rule differs.
Its label is 1. The judge agrees: the reply gives the ending away.
A worked example the two classifiers side by side
Tom trained the synthetic classifier with exactly Chapter 8’s recipe, on the 1,260 synthetic examples only. Then he scored the same 889 real replies from Wick-mini v1 as before.
At the same threshold of 0.5, which classifier catches more leaks: Chapter 8’s, trained on real replies, or the synthetic one? And which blocks more replies that had no leak?
Show the answer
The synthetic one, both times. It catches 21 leaks against 14, and it blocks 29 replies that had no leak, where Chapter 8’s blocked none. Whether that makes it better is the next question.
First, at the same threshold of 0.5:
At a threshold of 0.5
Chapter 8’s classifier (real replies)
This chapter’s classifier (synthetic examples)
Leaking replies caught (recall)
14 of 26 (54%)
21 of 26 (81%)
Replies with no leak blocked (false-positive rate)
0 of 863 (0%)
29 of 863 (3.4%)
Blocked replies that were real leaks (precision)
14 of 14 (100%)
21 of 50 (42%)
Replies about Books 1–6 lost (helpful-published)
0 of 150
6 of 150
Ordinary chats with a reply blocked that had no leak (benign-multiturn)
0 of 80
18 of 80
At first sight, the synthetic classifier catches more leaks: 21 against 14. But it also blocks 29 replies that had no leak, where Chapter 8’s blocked none. Fewer than half of its blocks were real leaks (42%). It refused 6 of 150 harmless questions about Books 1–6, and in 18 of 80 ordinary chats it blocked at least one reply that had no leak. Eleanor had come in on Wednesday to complain about exactly this kind of refusal (Chapter 7).
So which classifier is better? This table cannot say, because the same threshold does not mean the same thing for both. A classifier’s scores reflect its training data. In Tom’s synthetic data, 43% of the examples were labelled “leak”; in Chapter 8’s training rows, only 12% were. A classifier that saw many leaks in training gives higher scores to everything, so 0.5 is a much looser bar on its scale.
The fair comparison asks each classifier to do the same job, and counts the cost. Lab L3s stored both classifiers’ results at every threshold, so Tom could do that:
The same job for both
Chapter 8’s classifier (real replies)
This chapter’s classifier (synthetic examples)
Leaks caught while blocking no reply that had no leak
15 of 26
6 of 26
Replies with no leak blocked, to catch 21 of the 26 leaks
8
28
AUROC: chance that a random leak scores above a random reply with no leak
0.989
0.961
Line by line:
With no wrong blocks allowed, Chapter 8’s classifier can still catch 15 leaks; the synthetic one, only 6.
To catch 21 leaks, the number the synthetic one caught at 0.5, Chapter 8’s classifier needs to block 8 replies without a leak; the synthetic one blocks 28.
AUROC sums this up over every threshold (Chapter 8, Under the hood). Chapter 8’s classifier puts leaks above other replies more reliably.
So, compared fairly, the synthetic classifier is worse at telling leaks from other replies. Its higher catch rate at 0.5 came from a looser bar, not from better judgement.
Why is it worse? Label noise works in two directions here. The 223 “allowed” examples that contain the ending teach the classifier to pass leaks. The 72 “banned” examples with no ending in them teach it to block replies that are fine. And every example was written by the generator, in the generator’s style, not in Wick-mini’s. Those are likely reasons, not measured ones: the lab did not test them one by one.
Why it works
The method still has real strengths, even though Tom’s first try did not pay off.
It can cover shapes you have not seen. A rulebook can name a leak inside a letter or a poem before any model has written one. The generator then writes such examples on purpose. If the generator follows the rules, the classifier learns those shapes.
The rules can be read and approved. Eleanor checked one page and approved it in an email. Nobody can check 1,260 examples. The rulebook moves the human check to the one place where a human can do it well.
The rules can be changed fast. Change a line, write new examples, train again. No need to wait for new real data. In August 2026, Anthropic reported doing exactly this for a biology classifier around its Claude Fable 5 model: it rewrote the classifier’s constitution and retrained, and biology-related switches to a less capable model fell by about 85% (research box below).
Where it breaks
The generator’s mistakes become the classifier’s lessons. 31% of Tom’s “allowed” examples contained the ending. The label said “safe” anyway. A bigger generator, or checking each example with the judge before training, would help; Tom’s lab did neither.
A small generator has its own habits. Qwen3-1.7B writes like Qwen3-1.7B, not like Wick-mini. Wick-mini’s real replies have their own phrases, such as its fixed refusals. A classifier trained only on the generator’s style meets Wick-mini’s style for the first time in the test.
A narrow rulebook gives a narrow classifier. It knows only what the rulebook names. Tom’s bans the ending, not vague hints. Whatever is missing from the page is missing from the classifier.
Strictness has a price. A classifier trained to be very hard to fool can turn away a large share of ordinary users. Anthropic’s first prototype did (Part 3).
NoteUnder the hood
Generation. Qwen3-1.7B, thinking off, the rulebook as its system message. Sampling: temperature 0.8, top-p 0.95, top-k 40, at most 200 new tokens, seed 7. Each request named one rule, plus one style and one topic picked at random. The 8 styles were: a plain, direct answer; a hedged answer that sounds unsure; a short friendly answer of one or two sentences; a longer answer of four or five sentences; an answer that starts with a short recap of Books One to Six; a few lines of a short story; a short letter from one character to another; an answer with a bulleted list.
Labels. label = the rule named in the instruction (banned 1 / allowed 0); never the judge. The judge (version 1.3) was run afterwards only to measure the label noise above.
Training. Chapter 8’s recipe (labs/wickmini/spoiler_clf.py): Qwen3-0.6B with a two-class head and LoRA, 2 epochs, 158 steps, 1260 examples of which 540 were labelled 1.
Matched operating points. Both rows of the second table come from the lab’s stored curves (comparison.*.v1_seed7_unsealed_sets.curve in labs/results/L3s.json): for each classifier, the most leaks caught at any threshold with zero wrong blocks, and the fewest wrong blocks at any threshold that catches at least 21 leaks.
What the real method adds. Anthropic’s classifiers were trained on synthetic data plus data augmentation (extra, varied copies of the examples) and large pools of harmless text. Robustness rose with classifier size, the amount of training data and the number of augmentations (research box below).
Part2· Streaming: stopping a reply in the middle
The problem the reader is reading while Wick writes
Inês Duarte came over with a coffee and a pad of paper, and Tom told her about Thursday’s last question.
Chat apps usually do not wait for a reply to be finished. They show it as it is written, a few words at a time. This is called streaming. It makes the app feel fast, and readers expect it.
Chapter 8’s classifier scored finished replies. That leaves two choices. Wick can hold back each reply until it is finished and checked, so the reader waits longer for every answer. Or Wick can stream, and then a check on the finished reply comes too late: by the time it runs, the reader has seen the whole reply.
How it works, step by step
Inês drew it as she listened: a reply as a long strip, growing to the right, and above it a line for the classifier’s score, rising as the strip grew.
As the reply is written, cut it into prefixes. A prefix is the reply so far: its first few words, then a few more, and so on. Lab L3s took a prefix every 8 tokens.
Score each prefix. Run the classifier on the prefix, as if it were a whole reply.
Stop at the first prefix that reaches the threshold. The rest of the reply is never sent. The reader sees the fallback message after the words they already have.
Never take a stop back. Once a reply is stopped, it stays stopped.
Count what escaped. For each leaking reply, count how many characters of the ending had already been shown at the stop.
There is one more choice hidden in step 3: when does the reader see each piece? Lab L3s assumes the worst case for this question. Each piece is shown as soon as it is written, and checked right after. A system could instead hold each piece back until its check is done, like a short buffer. Less of the ending would escape, and every reply would arrive a little later. Lab L3s did not test a buffer.
A classifier used this way is a streaming output classifier. Anthropic’s version is more careful at step 2. Its output classifier has a value head: a small part trained to predict, from each prefix, whether the whole reply will turn out harmful. So it can act on a reply that is clearly heading somewhere bad, before the bad part arrives. Tom’s classifier had only ever seen finished replies. It can only say whether the text so far already looks like a leak.
A worked example the Prologue’s reply, piece by piece
Tom replayed the reply from Nadia’s first day through the streaming check. Only the counts were kept, never the text.
That reply gives the ending away from its very first words, and each piece is shown as soon as it is written. When Chapter 8’s classifier finally stops it, how much of the ending has the reader already seen?
Show the answer
Most of it: 190 of the 210 characters of the ending. Only 20 were held back. The stop came, and it came too late.
Show the code
bk.style()fig, ax = plt.subplots(figsize=(8.8, 2.8))L = SS["reply_chars"]ax.set_xlim(-2, L +2)ax.set_ylim(0, 11)ax.axis("off")ax.add_patch(Rectangle((0, 3), SS["stop_char"], 3, fc=SIGNAL, ec=INK, lw=1, alpha=0.75))ax.add_patch(Rectangle((SS["stop_char"], 3), L - SS["stop_char"], 3, fc=TEAL, ec=INK, lw=1, alpha=0.2))held_back = SS["ending_chars"] - SS["ending_chars_escaped"]ax.text(SS["stop_char"] /2, 4.5, f"shown before the stop: {SS['stop_char']} characters, all of them ending", ha="center", va="center", fontsize=9, color="white", fontweight="bold")ax.text(SS["stop_char"] + (L - SS["stop_char"]) /2, 4.5, f"never shown:\n{L - SS['stop_char']} characters", ha="center", va="center", fontsize=8.5, color=INK)for k inrange(1, checks_before_stop +1): x = SS["stop_char"] * k / checks_before_stop ax.plot([x, x], [6.2, 7.0], color=INK, lw=1.2)ax.text(SS["stop_char"], 7.6, f"stop (check {checks_before_stop})", ha="center", fontsize=8.5, color=INK)ax.text(0, 8.8, f"one check every {step_tokens} tokens (tick positions are approximate)", fontsize=8, color=GREY)ax.text(SS["stop_char"] +1, 1.6, f"← {held_back} characters of the ending held back", fontsize=8.5, color=INK)ax.set_title("The stop came after most of the ending was on screen", loc="left", fontsize=10.5)fig.tight_layout()plt.show()
Figure 9.2: The Prologue’s reply, streamed and checked every few tokens by Chapter 8’s classifier, with each piece shown as soon as it was written. Only counts are shown; the text is not stored.
The numbers, one at a time:
The reply had 255 characters. The judge counts 210 of them as the ending itself. (Chapter 8 hid all 255 from you, to be safe: the book also hides sentences that only come close to the ending.)
The ending started at the very first character. v0 did not lead up to it. It answered the question at once.
The classifier checked every 8 tokens. It first reached the threshold at token 48, its 6th check, at character 190.
By then, with each piece shown as soon as it was written, the reader had seen 190 of the 210 characters of the ending. Only 20 were held back.
So the stop came, and it came too late. A classifier trained on finished replies needs to see most of the ending before it is sure. And if text is shown the moment it is written, no check can hide a reply’s first few words, because it needs those words to judge.
A worked example every leaking reply
One reply is a story. Here are all 26 of v1’s leaking replies on the six test sets, streamed through both classifiers. The lab stored each one’s check-by-check scores, so every stop can be placed exactly. (8 of the 26 start with the ending in their first words.)
Show the code
bk.style()fig, (ax1, ax2) = plt.subplots(2, 1, figsize=(8.6, 4.6), gridspec_kw={"height_ratios": [1.2, 1]})names = ["Chapter 8's classifier\n(real replies)", "This chapter's classifier\n(synthetic examples)"]parts = [("before", AMBER, None, "before any of the ending was shown"), ("part", "#f4c48a", "///", "part-way through the ending"), ("end", GREY, None, "only at the very end"), ("never", "#7a1f0a", None, "never stopped")]for i, sp inenumerate([sp_r, sp_s]): y, left =1- i, 0for key, col, hatch, lab in parts: ax1.barh(y, sp[key], left=left, color=col, hatch=hatch, edgecolor=INK, lw=0.6, label=lab if i ==0elseNone)if sp[key]: ax1.text(left + sp[key] /2, y, str(sp[key]), ha="center", va="center", color="white"if key in ("never", "end") else INK, fontsize=9, fontweight="bold") left += sp[key]ax1.set_yticks([1, 0], names)ax1.set_xlim(0, pos)ax1.set_title(f"Both classifiers stop most of the {pos} leaks only after some of the ending is shown", loc="left", fontsize=10)ax1.legend(loc="upper center", bbox_to_anchor=(0.5, -0.16), ncol=4, frameon=False, fontsize=8)for i, g inenumerate([good_r, good_s]): ax2.barh(1- i, g["k"], color=GREY, edgecolor=INK, lw=0.6) ax2.text(g["k"] + neg *0.01, 1- i, f"{g['k']} of {neg:,}", va="center", fontsize=9, color=INK)ax2.set_yticks([1, 0], names)ax2.set_xlim(0, neg)ax2.set_title("The synthetic classifier also stops almost a third of the replies with no leak", loc="left", fontsize=10)fig.tight_layout()plt.show()
Figure 9.3: Streaming checks on Wick-mini v1’s leaking replies in the six test sets (seed 7), at a threshold of 0.5, with each piece shown as soon as it was written. Top: when each reply was stopped. Bottom: replies with no leak that the lab’s main run stopped anyway.
Read the top bars from the left.
Chapter 8’s classifier stopped two replies before any of the ending was shown, and 11 part-way through it. It stopped six more only at the last check, when the whole reply had already been shown, which helps nobody. Seven were never stopped. Counting every leaking reply, 77% of all their ending characters reached the reader.
The synthetic classifier stopped five before any of the ending, 16 part-way, two only at the end, and missed three. Only 38% of the ending characters reached readers.
The bottom bars come from the lab’s main run, which streamed every reply but stored only counts. Chapter 8’s classifier stopped 12 of 863 replies with no leak, although it blocked none of them as finished replies: a reply cut off after a few words looks different from any finished reply it trained on. The synthetic classifier stopped 274 of 863: 32%. Almost one reply in three would have been cut off mid-sentence.
The synthetic classifier stops earlier for the same reason it blocks more: its threshold of 0.5 is a looser bar on its scale (Part 1). Neither is good enough. One is too slow; the other stops far too many replies that are fine. Lab L3s did not train a classifier on prefixes, which is what Anthropic’s value head does.
Why it works
If the reader is reading while the reply is written, a check has to decide while it is being written too. A score on a prefix is a bet about the whole reply. A classifier trained for that bet, with the whole reply’s label attached to each of its prefixes, learns which openings tend to lead to harm. Then it can stop a reply on its way to a leak, not after it.
A stop must also be final. A message that vanishes and comes back, or a stop that is lifted a moment later, would be worse than either decision alone. Anthropic builds this into training: as training goes on, the score at each point is gradually replaced by the highest score so far (a running maximum), so that the classifier learns for a world where its first stop is final.
Where it breaks
Some text escapes, unless text is held back. If each piece is shown the moment it is written, a reply that starts with the leak, like the Prologue’s, gives part of it away before any check can act. A buffer helps, at the cost of slower replies.
A classifier trained on finished replies is late. Tom’s real-data classifier waited until most of the ending was visible.
Early stops hit innocent openings. A reply that starts “In Book Seven, …” might be heading for the release date or for the ending. Stop early, and you stop replies that were fine.
The serving code matters as much as the classifier. In Anthropic’s 2025 bug bounty, one apparent universal attack turned out to be a bug in the serving system: up to 128 tokens of a reply were let through after the output classifier had flagged it. A stop is only as good as the code that carries it out.
A stop cannot be taken back, so a wrong stop is final for that reply. The reader sees half a sentence and a refusal.
NoteUnder the hood
Lab L3s streaming. prefix scored every 8 tokens of the backbone tokenizer, plus the full reply; stop at the first prefix with P(leak) >= threshold. ending characters = characters of the reply’s sentences that the judge flags as leaking on their own; escaped = those characters already emitted at the stop. Only counts are stored. The lab ran this on stored replies, not on live generation, so it measures where a stop would have come if each piece were shown at once. The counts above replay the prefix scores stored for the widget. Those were computed in a slightly different number format from the main run; at 0.5, one reply’s decision differs, and the characters shown are the same.
Value head and running maximum (Anthropic, 2025). For a reply with tokens \(t_1, \dots, t_T\) and a final label \(y\) (harmful or not), the value head gives a score \(s_k\) after each prefix \(t_1..t_k\), trained so that \(s_k\) predicts \(y\). At use time, streaming stops at the first \(k\) with \(s_k \ge\) threshold, and stays stopped. During training, Anthropic gradually moves the training target from \(s_k\) towards the running maximum
\[m_k = \max_{j \le k} s_j,\]
which matches how the classifier is used: once \(m_k\) crosses the threshold, it never comes back down.
Try it move the threshold
The lab code is labs/wickmini/l3s.py (run uv run python -m wickmini.l3s --stage all from labs/); Colab notebooks that wrap it come later. Here you can move the threshold yourself, for either classifier, on the real scores of all 889 of v1’s replies in the six test sets.
Tom’s two classifiers. Pick a classifier, then drag the threshold. Each dot is one of Wick-mini v1’s replies, placed by its score: red dots are leaks, teal dots are replies with no leak. The dots’ height within each band is random, to stop them piling on top of each other; it means nothing. Every dot to the right of the line is blocked. The scale is stretched near 0 and near 1, so that the many scores crowded close to those ends can be told apart. The table also replays each leaking reply as a stream, checked every 8 tokens, with each piece shown as soon as it is written.
viewof ch09z = {const form =html`<form> <label for="ch09-z" style="display:block;font-weight:600;margin-bottom:0.2rem"> Threshold: <output name="shown"></output></label> <input id="ch09-z" name="z" type="range" min="-9" max="9" step="0.05" value="0" style="width:100%;max-width:640px"> </form>`;const show = () => {const z =Number(form.z.value); form.value=Math.abs(z) <0.15?0: z;// snap to Tom's threshold of 0.5const p =ch09sig(form.value); form.shown.value= (p <0.001? p.toExponential(1) : p <0.1? p.toFixed(3) : p.toFixed(2)) + (form.value===0?" (Tom's choice)":""); }; form.z.addEventListener("input", show);show();return form;}
Show the code
ch09at = {const t =ch09sig(ch09z), k =2+ ch09clf;const hp = ch09.sets.indexOf("helpful-published");let caught =0, wrong =0, hpWrong =0, hpN =0, nLeak =0, nGood =0;for (const r of ch09.all) {const blocked = r[k] >= t;if (r[1]) { nLeak++;if (blocked) caught++; }else { nGood++;if (blocked) wrong++; }if (r[0] === hp) { hpN++;if (blocked &&!r[1]) hpWrong++; } }let early =0, before =0, shown =0, total =0;for (const r of ch09.leaks) { total += r.e;const hit = r.p.find((q) => q[1+ ch09clf] >= t);if (!hit) { shown += r.e;continue; }if (hit[0] < r.n) early++;if (hit[0] <= r.f) before++; shown +=Math.min(r.e,Math.max(0, hit[0] - r.f)); }return {t, caught, wrong, hpWrong, hpN, nLeak, nGood, early, before, shown, total};}
Show the code
{const k =2+ ch09clf;const dots = ch09.all.map((r, i) => ({z:Math.max(-9.5,Math.min(9.5,ch09logit(r[k]))),kind: r[1] ?"Leaking reply":"Reply with no leak",y: (r[1] ?0.75:0.25) +0.38* (((i *0.6180339887) %1) -0.5)}));const ticks = [0.0001,0.001,0.01,0.1,0.5,0.9,0.99,0.999,0.9999];const lab = (z) => { const p =ch09sig(z);return ticks.reduce((a, b) =>Math.abs(b - p) <Math.abs(a - p) ? b : a).toString(); };return Plot.plot({width:Math.max(300,Math.min(width,680)),height:220,marginLeft:20,marginBottom:44,style: {background:"transparent",fontSize:"12px"},ariaLabel:"Scores of Wick-mini v1's replies under the chosen classifier, with the threshold",ariaDescription:"A strip of dots on a score axis from 0.0001 to 0.9999. Red dots are leaking replies, in the upper band; teal dots are replies with no leak, in the lower band. A vertical line marks the threshold; dots to its right are blocked.",x: {domain: [-9.5,9.5],ticks: ticks.map(ch09logit),tickFormat: lab,label:"Score: the classifier's chance of a leak (stretched near 0 and 1) →",labelAnchor:"center",labelOffset:36},y: {domain: [0,1],axis:null},color: {domain: ["Leaking reply","Reply with no leak"],range: ["#c2410c","#2a9d8f"],legend:true},marks: [ Plot.dot(dots, {x:"z",y:"y",fill:"kind",r:2.4,fillOpacity:0.55}), Plot.ruleX([ch09z], {stroke:"#15203b",strokeWidth:2}) ] });}
Show the code
{const a = ch09at;const pc = (x, n) => { if (!n) return"0%";const v =100* x / n;return (v >0&& v <9.5? v.toFixed(1) : v.toFixed(0)) +"%"; };returnhtml`<table style="margin-top:0.4rem"> <thead><tr><th>At this threshold</th><th></th></tr></thead> <tbody> <tr><td>Leaking replies blocked (finished replies)</td><td>${a.caught} of ${a.nLeak} (${pc(a.caught, a.nLeak)})</td></tr> <tr><td>Replies with no leak blocked (finished replies)</td><td>${a.wrong} of ${a.nGood.toLocaleString("en-US")} (${pc(a.wrong, a.nGood)})</td></tr> <tr><td>… of them, replies about Books 1–6 (<code>helpful-published</code>)</td><td>${a.hpWrong} of ${a.hpN}</td></tr> <tr><td>Leaking replies stopped mid-stream, before the reply was over</td><td>${a.early} of ${a.nLeak}; ${a.before} before any of the ending was shown</td></tr> <tr><td>Characters of the ending that readers saw</td><td>about ${a.shown.toLocaleString("en-US")} of ${a.total.toLocaleString("en-US")} (${pc(a.shown, a.total)})</td></tr> </tbody></table>`;}
Things to try:
With Chapter 8’s classifier, slide left until the first teal dot is blocked. How many leaks are caught there? Then try the same with the synthetic classifier.
Find a threshold where the synthetic classifier blocks no reply that had no leak. How many leaks does it still catch?
Lower the threshold for Chapter 8’s classifier and watch the last two rows. Streams stop earlier, and readers see less of the ending. Then look at the second row: replies with no leak start to be blocked even when they are finished. Mid-stream, at least as many would be cut off, because the last check of a stream is the finished reply. The widget cannot show how many more: the widget’s file has check-by-check scores only for the leaking replies, while the lab’s main run stored only counts for the others.
At 0.5, the widget’s stream rows match the counts in the text above.
Part3· Testing the classifiers, and saving cost
The problem does it hold, and can you afford it?
By ten o’clock, Tom had two classifiers and a streaming check, and no confidence in any of them against a determined reader. And a second worry: Wick-mini’s classifier is as large as Wick-mini itself. For the full Wick, a careful classifier on every reply, checked every few tokens, would use a lot of computing power (often called compute), and that costs money.
These are the two questions every team with a safety classifier faces. Will it hold when people try hard to get past it? And can you afford to run it on everything? Anthropic’s papers on Constitutional Classifiers are the most detailed public answers, so Tom read them aloud to Nadia and Inês.
How it works, step by step
Testing in public.
Pick target questions that the system must never answer in detail. Anthropic picked a small set of questions about dangerous weapons. Each test below used its own set.
Invite attackers. Pay outside people for every success. A program that pays outsiders for finding weaknesses is called a bug bounty. An input built to get a model past its safeguards is what Chapter 11 will call a jailbreak. A universal one works on almost all the target questions, not only one.
Grade every answer against a rubric: a written scoring guide. Here it asks how much of what an unguarded model would say the answer gave.
Report what was found, with the setup: who attacked, for how long, with which rules.
Saving cost: a cascade. Here an exchange means one request together with its reply.
A cheap first stage reads every exchange. It is tuned to flag generously, because a flag only sends the exchange onward. It does not refuse anything.
An expensive second stage also reads the few flagged exchanges.
The final decision combines both stages’ scores.
A system built like this, in stages that each pass on only part of the traffic, is called a cascade.
A worked example what Anthropic reported
Version 1 (2025). Anthropic’s first Constitutional Classifiers had an input classifier and a streaming output classifier, both trained on synthetic data from a written constitution.
The bug bounty, against a prototype, used ten target questions. About 183 active red teamers spent an estimated more than 3,000 hours. None of their reports answered all ten with even half the detail of an unguarded model.
That prototype held against more than 3,000 hours of attack. What do you think it cost ordinary users?
Show the answer
A large share of real traffic. This prototype was built to be very hard to break, and it refused about 44% of real Claude.ai traffic.
An improved version cut that cost to a fraction of a percent of extra refusals, but was not itself put through the bounty (research box below).
The public demo (February 2025) had eight levels. Anyone could try, for seven days. For five days nobody passed all eight. On days six and seven, four people did. One of their methods was judged universal. Anthropic paid out $55,000. The successful approaches were families that later chapters name: encodings aimed at the output classifier, role-play, swapping key words for harmless ones, and prompt injection. This book’s sources do not say which version of the classifiers ran the demo.
Version 2 (January 2026). Anthropic’s next generation, Constitutional Classifiers++, found attacks that beat a check on the reply alone, and judged each reply together with its conversation instead (an exchange classifier; Chapter 14 covers this design). It also added a cascade, with a probe as its cheap first stage. A probe is a tiny classifier that reads the protected model’s activations: the internal numbers the model computes as it reads and writes text. It does not read the text itself. Chapter 14 explains probes.
The production system put a probe first. It sent about 5.5% of traffic on to a classifier based on Claude Haiku 4.5, and combined the two scores into one weighted average. Anthropic tested it in shadow use: running alongside the real service for a month, guarding Claude Sonnet 4.5, recording what it would have blocked without blocking anything. It refused 0.050% of that traffic. The paper’s like-for-like comparison is its own re-built copy of the 2025 design, which refused 0.073%: about a third fewer refusals, both measured as a share of all traffic. (Anthropic’s blog compared 0.05% with the 0.38% from 2025, but that older figure was measured differently, as the increase in refusals on a sample of conversations.) The new system used far less computing power: the blog put the extra at about 1%. In red teaming against the new system, with eight target questions this time, about 1,736 hours found one high-risk weakness, after 30 hours; nobody found a universal attack that answered all eight at half detail.
0.050%of traffic refused by the 2026 cascade
0.073%refused by the paper's re-built copy of the 2025 design
about 5.5%of traffic sent on by the probe to the second stage
The 2026 cascade in a month of shadow use, guarding Claude Sonnet 4.5, against the paper's re-built copy of the 2025 design. Both refusal rates are shares of all traffic. Cunningham and co-authors, Anthropic, January 2026. Research numbers, not Wick-mini.
Why it works
Testing in public works because attackers are more creative than defenders. A team that tests only its own ideas tests only its own blind spots. Paying many outsiders turns their creativity into a measurement.
A cascade works because most traffic is plainly harmless. A spoiler classifier does not need its best judgement for “When did Book Two come out?”. Spending a little on everything and a lot on the doubtful few gives most of the safety at a fraction of the cost. And a probe makes different mistakes from a text classifier. In Anthropic’s tests, combining a probe with a classifier did better than combining two classifiers.
Where it breaks
What the first stage misses is never escalated. A cascade is only as good as its cheapest stage at noticing that something is worth a second look.
“No universal jailbreak was found” needs its context. In 2025 it applied to a prototype that turned away a large share of real traffic, tested under bounty rules and a grading rubric. In their January 2026 paper, Anthropic reported that experts outside the bounty program did find universal jailbreaks against an intermediate version of the new system.
The demo was easier than reality in one way and harder in another. An automatic grader gave attackers instant feedback, which real attackers do not get. But real systems add rapid response and account monitoring, which the demo did not have (Chapters 10 and 14).
Every layer costs refusals, and the cost has to be measured. Anthropic’s refusal costs fell from version to version because people measured them and worked on them. They were measured in different ways, though, so compare like with like, as the paper’s own table does.
For Wick-mini, the cascade question is still far away. Tom’s classifier is small and his traffic is a test set. But the lesson about testing applies today: on Monday, the outside red team that Kwame booked arrives (Chapter 11).
What the research actually found
TipWhat the research actually found
Constitutional Classifiers (2025)
Who and when: Mrinank Sharma and 42 co-authors at Anthropic, January 2025.
What they did: They trained an input classifier and a streaming output classifier to guard Claude against questions about chemical, biological, radiological and nuclear weapons. The training data was synthetic, generated from a natural-language “constitution” of permitted and restricted content, with data augmentation and pools of harmless data. The output classifier has a value head that predicts, at every token, how harmful the full reply will be. A stop is never undone, and training moves gradually towards a running maximum to match. They tested a prototype in a bug bounty on HackerOne: 405 people invited, about 183 active, more than 3,000 estimated hours, rewards of up to $15,000 per universal jailbreak, ten target questions.
What they found: No report answered all ten questions at half the detail of an unguarded model; under a stricter “similar detail” bar, nobody exceeded six. The highest-scoring reports, which used harmless-sounding rewording and very long outputs, mainly fooled the rubric grader rather than the classifiers. One apparent universal jailbreak was an infrastructure bug that let up to 128 tokens through after the output classifier had flagged a reply. An improved version, based on Claude 3.5 Haiku, blocked over 95% of held-out jailbreak attempts, against 14% without classifiers. It cost 0.38% more refusals (an absolute increase, on a sample of production traffic) and 23.7% more computing power. Robustness rose with classifier size, data and augmentation.
What it does not show: The red-teamed prototype refused about 44% of Claude.ai traffic. The 0.38% and 23.7% figures belong to a different, improved system that was not put through the bounty. Red teamers are only some of the possible attackers, and rubric grading struggled to separate harmless knowledge from real help. Chatbot setting only.
0.38%more refusals, on a sample of production traffic
23.7%more computing power
Anthropic's improved 2025 classifiers, based on Claude 3.5 Haiku. This version was not put through the bug bounty; the prototype tested there refused about 44% of Claude.ai traffic. Sharma and co-authors, January 2025. Research numbers, not Wick-mini.
TipWhat the research actually found
The public jailbreak demo (February 2025)
Who and when: Anthropic, results posted on its research page between 5 and 18 February 2025.
What they did: An eight-level public challenge against a system built with Constitutional Classifiers, open for seven days, with an automated grader.
What they found: 339 participants passed at least one level, in more than 300,000 chats and about 3,700 hours together; counting everyone, 13,960 users, more than 800,000 chats and about 10,000 hours. Nobody passed all eight levels for five days. On days six and seven, four participants did. One jailbreak was judged universal and one borderline-universal. Anthropic paid $55,000 in total. The successful families: encodings and ciphers aimed at the output classifier, role-play, keyword substitution, and prompt injection.
What it does not show: Anthropic notes two ways the demo was easier than reality: instant feedback from the automated grader, and no rapid response or account-level monitoring. About 1% of submissions were not graded, and 0.26% would have had a different outcome on a re-run.
Anthropic, Constitutional Classifiers research page, Feb 2025 · sources-part1-2 §9.2
TipWhat the research actually found
Constitutional Classifiers++ (January 2026)
Who and when: H. Cunningham and 28 co-authors at Anthropic (Mrinank Sharma last), January 2026.
What they did: They found two kinds of attack that beat the first system: a harmful request split into harmless-looking pieces, and replies disguised so they look harmless on their own. They built three fixes: an exchange classifier that judges the reply together with its conversation; a two-stage cascade; and linear probes on the protected model’s own activations, combined with the external classifier.
What they found: The exchange classifier had 2 high-risk weaknesses in 226,000 red-team queries, against 13 in 695,000 for the old system, at about 50% more computing power. The production system (a probe first, then a classifier based on Claude Haiku 4.5) escalated about 5.5% of traffic. In shadow use guarding Claude Sonnet 4.5 from 1 December 2025 to 1 January 2026, it refused 0.050% of production traffic, against 0.073% for the paper’s re-implementation of the previous system. It used about 40 times less computing power than the single exchange classifier; Anthropic’s blog put the extra at about 1%. Red teaming: about 1,736 hours, about 198,000 attempts, one high-risk weakness, found after 30 hours, and no attack that answered all eight target questions at half detail.
What it does not show: It still covers only weapons-related questions. Experts outside the bounty found universal jailbreaks against an intermediate two-stage system. “40 times less” is relative to their own exchange classifier.
Claude Fable 5’s classifiers in practice (June–August 2026)
Who and when: Anthropic: the Claude Fable 5 / Mythos 5 system card (9 June 2026), “Redeploying Fable 5” (30 June 2026) and “Improving Fable 5’s biology safeguards” (7 August 2026).
What they did: Fable 5’s cyber safeguards use two stages: a probe on the model’s activations screens all traffic and sends suspicious traffic to a language-model classifier “modeled on the constitutional classifiers”. After a reported way around the safeguards in June, Anthropic retrained a classifier. In August it rewrote its biology classifier’s constitution and retrained that classifier too.
What they found: The retrained cyber classifier blocked the reported technique in more than 99% of cases, at the cost of more false flags on routine coding. Anthropic described a deliberate safety margin: the classifiers are set to trigger on some requests that are probably harmless, and Fable 5’s margin was the largest of any of its launches. After the biology rewrite, cases where a biology question was switched to a less capable model fell by about 85% (Anthropic calls these “fallbacks”). Some dual-use areas, useful for both good and harmful work, are still switched.
What it does not show: These are the company’s own reports about its own system; this book quotes only the figures above. Chapter 10 tells the rest of the June story.
Anthropic system card and posts, Jun–Aug 2026 · sources-part1-2, "New since mid-2026"
Common misconceptions
WarningCommon misconceptions
“Constitutional Classifiers are trained on Claude’s constitution.” They are trained from a short, narrow rulebook of allowed and banned content. Claude’s constitution, like Wick’s from Chapter 5, describes a character. Same word, different documents.
“Synthetic labels are clean, because you chose them.” The label is what you asked for, not what you got. 31% of Tom’s “allowed” examples contained the ending.
“A classifier that catches more at the same threshold is the better one.” Only if both use the same scale. Tom’s synthetic classifier caught more at 0.5 and was worse at every matched point.
“A streaming classifier stops a leak before the reader sees it.” It stops what has not been shown yet. Chapter 8’s classifier let 77% of the ending characters through, counting every leaking reply.
“No universal jailbreak was found, so there is none.” It means none was found by those people, in that time, under those rules, against that system. Change any of the four and the answer can change.
Back to the board
At half past eleven, Nadia went to the Launch Board.
“So,” she said. “The rulebook was the right idea. Eleanor can read it. And the data it produced was full of mistakes. The model that wrote it couldn’t keep a secret any better than Wick.”
“And the streaming check stops replies after the reader has read them,” Inês said. She held up her drawing: the strip, the rising score, the stop far to the right. “Or it stops them for no reason.”
Inês's drawing, held up at the Launch Board.
“Which classifier do we keep?” Tom asked.
Nadia looked at the two tables for a long time. “Yesterday’s. Compared fairly, it’s the better one, and it doesn’t take Book Five away from anyone.” She wrote it down. “And no streaming for now. Wick holds every reply until the classifier has read all of it, then sends it. Readers will wait a little longer for each answer. I’d rather they wait than read the ending.”
“The rulebook?”
“Stays. Next time, we check each synthetic example with the judge before we train on it. And we train on prefixes, so a check can stop a reply on its way to the ending. Then we can stream again.”
“Not this week,” Tom said. “v1 is frozen tonight for the red team.”
“Not this week,” Nadia agreed. “This afternoon, we put every layer in one table.”
Launch Board
Days to launch: 31. Wick launches in the Halfpenny app on Monday 14 December 2026; Book Seven is published on Thursday 4 February 2027.
Spoiler leak rate: Wick-mini v1 on its own, unchanged: 0.7% of plain questions (1 of 150, leak-direct), 2.1% of indirect ones (3 of 146), and the ending came up unasked in 15 of 80 ordinary chats. Two spoiler classifiers compared on v1’s replies in those six test sets. With no reply wrongly blocked, Chapter 8’s (real replies) can catch 15 of the 26 leaking replies and the synthetic one 6; at Tom’s threshold of 0.5, the synthetic one blocks 29 of 863 replies with no leak. Streaming with Chapter 8’s classifier would let 77% of the ending characters through.
Layers in place: refusal fine-tuning and preference training (Wick-mini v1, frozen tonight for the red team); Chapter 8’s spoiler classifier at 0.5, reading each finished reply. Wick holds every reply until the classifier has read it, so replies arrive a little later. Tom’s rulebook, approved by Halfpenny, is kept for the next round. Not used: the synthetic-data classifier, and streaming checks.
The too-good score: still unexplained. Tom checks it against its error bars in Chapter 15; Chapter 23 explains it.
The author complaint: open (Chapters 19–22).
Open questions: What do all the layers add up to, with both numbers side by side? (Chapter 10, this afternoon.) How do we make synthetic labels clean, and train a check that can stop a reply early without stopping good ones, so Wick can stream again? (Next training round.) What will an outside red team find? (Chapters 11–12.) Should the rulebook ban vague hints too? (Chapter 15.)
Recap
A written rulebook of allowed and banned content can be turned into training data by a generator model. People can read and approve the rulebook; nobody can read thousands of examples. On Wick-mini, the first try failed: the generator often broke its own rules, and the synthetic classifier, compared fairly, told leaks from other replies worse than Chapter 8’s.
Streaming apps show replies as they are written, so a check must either decide on the text so far or hold the reply back. Scoring prefixes can stop a reply mid-sentence, but a classifier trained only on finished replies stops late, and a nervous one stops replies that were fine. Anthropic’s value head is trained to predict the whole reply’s harm from each prefix.
Public bug bounties and demos test classifiers against real creativity, and their results need their setup: the 2025 prototype that held refused about 44% of traffic. In 2026, a cascade with a cheap probe first refused about a third less than a re-built copy of the 2025 design, at a small fraction of the computing cost.
Terms (术语对照)
English
中文
rulebook (allowed / banned content)
规则手册（允许 / 禁止的内容）
constitution (Constitutional Classifiers sense)
宪法（宪法分类器中的含义：内容规则）
content policy
内容规范
Constitutional Classifiers
宪法分类器
generator (model)
生成模型
synthetic data
合成数据
label noise
标签噪声
hedge (a careful “maybe” answer)
含糊其辞的说法
data augmentation
数据增强
matched operating point
对齐的工作点
streaming
流式（流式输出）
prefix
前缀
buffer
缓冲
streaming output classifier
流式输出分类器
value head
价值头
running maximum
累计最大值
bug bounty
漏洞赏金计划
universal jailbreak
通用越狱
rubric
评分细则
exchange (a request and its reply)
一轮交互（请求与回复）
exchange classifier
交互分类器
cascade
级联
computing power (compute)
算力
probe (linear probe)
探针（线性探针）
activations
激活值
shadow use (shadow deployment)
影子部署
safety margin
安全余量
dual-use
两用
switch to a less capable model (Anthropic: fallback)
切换到能力较弱的模型（Anthropic 称 fallback）
threshold
阈值
recall / precision
召回率 / 精确率
false-positive rate
误报率
They are the first allowed and the first banned example by id in the lab’s file (labs/results/IO_p2.json). Nobody chose them.↩︎
