Anthropic trains Claude to flag misuse in its own conversations, catching 94% of high-priority cases

Anthropic has described a misuse-detection layer in which Claude reviews the conversation it has just taken part in. The research, posted on the company's Safeguards blog and promoted on X on October 29, calls the technique self-assessment. The blog page itself carries an October 16 date.

How it works

Right after answering, Claude receives a brief extra instruction and returns a small JSON verdict. A clean conversation gets a simple "not flagged"; a flagged one adds a harm category, a sub-policy, whether Claude refused, a one-line reason and a review priority from 1 to 10. Because the conversation is already cached, the check costs roughly ten output tokens on average. Anthropic estimates the total overhead at under 2% of inference compute across its API traffic, and says customers are not billed for it. The company's first Constitutional Classifiers, by comparison, added 23.7%.

The model was trained to imitate a more expensive prompted classifier built on Claude Mythos Preview, first through supervised fine-tuning on synthetic conversations, then through reinforcement learning. The verdicts are processed offline and do not block anything in real time.

What Anthropic reports

On production traffic, the Fable 5 model flagged 78% of the conversations the stronger classifier flagged, and 94% of those rated high priority, at a 1% false-positive rate. The team says recall rose sharply with model size in tests on four models of different sizes, from about 16% to about 96%.

According to the post, the monitor has run on a large share of traffic since Fable 5 launched in June. In August it raised more than 100,000 child sexual abuse and exploitation flags tied to one API customer, which Anthropic reported to NCMEC. In September it exposed accounts using Claude Code to automate a romance scam; they were banned after human review. More than half of the organizations it surfaced had no flags from any other detection source in the previous month.

Limits

Anthropic is explicit about the caveats. The system is scored against its own teacher, so it inherits that classifier's blind spots. It is not designed to withstand attackers who target it directly. Used as a blocker in a red-team test of 24 cyber tasks, it cut successful attacks from 19 to 13, while the prompted classifier cut them to 6. The authors also say self-monitoring is not yet a reliable check on Claude's own actions. The feature does not run on zero-data-retention traffic. All figures come from Anthropic and have not been independently tested.