Anthropic now has Claude rate its own conversations right after answering, flagging 78 percent of the harmful conversations a stronger classifier catches and 94 percent of the high-priority ones, for under 2 percent more inference compute
AspireAI community · Anthropic
Anthropic's Safeguards blog describes self-assessment, a technique that appends a short instruction after each Claude response and asks the model for a compact safety assessment of the whole conversation, including requests it refused. The assessment carries whether the conversation involves a potentially harmful request, what kind of harm, a priority score for human review, whether Claude refused and a one-sentence reason, and it feeds offline review in production rather than blocking requests in real time. On Claude Fable 5 it flags 78 percent of the conversations a stronger prompted classifier flags as potentially harmful and 94 percent of the high-priority ones at a 1 percent false-positive rate, with a scaling experiment showing detection improves across four model sizes and that removing a harm category from training does not substantially degrade performance on that harm. Because the conversation is already in the KV cache, an assessment costs roughly 10 extra tokens and Anthropic estimates under 2 percent additional inference compute, compared with the 23.7 percent cost of its first Constitutional Classifiers, and it runs in every Claude model released since Fable 5 across a large fraction of global traffic. The limitation is stated in the post itself: it does not catch every harmful conversation, is not robust enough to stop a dedicated attacker, inherits any blind spot in its teacher, and does not run on zero-data-retention traffic.
Read the story and explore more from the AspireAI community.
Two sparse-autoencoder analyses have resisted scaling: matching semantically similar features across layers, and compressing large feature circuits into interpretable supernodes. This paper argues both are the same underlying problem, estimating semantic distances between SAE features that sit on different activation manifolds. Its representation treats each feature not as a single decoder vector but as an activation-weighted distribution over the hidden states expressing it, projects those distributions into a shared reference space, and compares them with Wasserstein distance. The representation is proved invariant to activation rescaling and stable under perturbation, and recovers true matches under finite-sample margin conditions. Empirically it outperformed decoder-vector and LLM-based baselines and captured subtle functional distinctions between related features, and it compressed large feature circuits into interpretable supernodes automatically. The limitation is that this is interpretability tooling: the paper demonstrates better feature matching and circuit compression, not that downstream interpretability claims become more accurate.