On Oct 29 Anthropic introduced self-assessment on X: after each response, Claude produces a structured preliminary safety assessment of the whole conversation for offline review. Anthropic's Safeguards blog says that on Claude Fable 5, at a 1% false-positive rate, it flags 78% of the conversations a stronger prompted classifier flags and 94% of high-priority ones. Because the conversation is already in the KV cache, it adds about 10 output tokens on average and an estimated under 2% of inference compute. It has run in production since June, but Anthropic says it is not robust against an attacker who targets it directly and is only one layer of defense in depth.
Key Takeaways
- ✓On Claude Fable 5, at a 1% false-positive rate it recalls 78% of what the prompted classifier flags and 94% of high-priority (7+) conversations (vendor figures, Safeguards blog)
- ✓It reuses the KV cache, adding about 10 output tokens per assessment on average; Anthropic estimates under 2% extra inference compute and does not bill customers for it
- ✓Across four model sizes, recall at 1% false positives rises from about 16% to about 96% and AUC from 0.862 to 0.995
- ✓As a real-time blocker it is weak: attack success on 24 cyber tasks only drops from 79% to 54%, versus 25% with a prompted classifier
- ✓In August it raised over 100k child sexual abuse flags from a single API customer, reported to NCMEC; about a third of flags fall outside the existing taxonomy
Key Decision Metrics at a Glance
Heavy Claude Code use: compare subscription limits and API bills
Compare 40 dev plans & simulate token costs vs $20/mo subscriptions
Project Links & Resources
Direct AccessIn-Depth Technical Analysis
Background and pain point
As frontier models get better at coding and acting autonomously, misuse risk rises: Anthropic's September threat intel report says criminal groups and hacktivists now run AI-driven campaigns. Standard safety classifiers only catch harms defined in advance, while the strongest prompted classifiers must reread the whole conversation and policy, which is too expensive to run on all traffic.
How it works
Self-assessment appends a short system instruction after each Claude response, and the same model returns a fixed JSON: whether to flag, harm category, subpolicy, whether it refused, a 1-10 review priority and a one-sentence reason. Training has two stages: supervised fine-tuning to learn the format, then reinforcement learning with six verifiable rewards, distilled from a teacher prompted classifier based on Claude Mythos Preview with the full internal policies; all training data is synthetic. Users never see the assessment, it is not carried into the conversation, and it does not run on zero-data-retention traffic.
Benchmarks
All figures are Anthropic's own: on Fable 5, 78% recall at a 1% false-positive rate and 94% on high-priority conversations. In leave-one-out tests, removing fraud or cyber training data only lowered production recall from 83.3% to 82.1% and from 94.2% to 90.7%. As a real-time blocker it is weaker, cutting attack success from 79% to 54%, versus 25% for a prompted classifier.
Getting started
API users need no changes and are not billed for it, but compliance teams should know that flags are aggregated by organization and repeated high-priority flags are escalated to human review. Teams securing their own agents can borrow the pattern of same-model self-assessment plus offline review, but should not use it as their only blocking layer.
Benchmark side-by-side against alternatives, or calculate monthly token cost vs subscription break-even.
Discussion & Comments
0Sign in to join the discussion
Connect with AI developers to exchange benchmark insights.