Buried in today's news that Anthropic's Fable 5 is coming back is a small technical phrase doing enormous work. Part of how the company satisfied the US government, it said, was by training "a new cybersecurity safety classifier" that blocks the Amazon-reported jailbreak technique that got the model banned in more than 99% of cases. A classifier fixed a geopolitical incident. So it's worth understanding what one actually is — because these unglamorous little models are the guardrails standing between a frontier AI and the things you don't want it to do.

A second model, watching the first

A safety classifier is a separate, usually much smaller AI model with one narrow job: to look at a piece of text and judge whether it's harmful or against the rules. It doesn't chat, reason, or write. It reads, and it labels — "safe" or "unsafe," often with a category (violence, weapons, self-harm, a jailbreak attempt) and a confidence score.

Crucially, it sits outside the main model, and it can watch at two points:

• On the way in. Before the big model even sees your prompt, a classifier can screen it — catching disallowed requests and, importantly, jailbreak attempts: the cleverly-worded inputs designed to trick the model past its own rules. This is the layer Anthropic strengthened for Fable 5.
• On the way out. Before the model's reply reaches you, a classifier can screen that too — catching a harmful response that slipped past the main model's own training before it ever hits your screen.

So a typical safety setup is a sandwich: a classifier, then the powerful model, then another classifier. The frontier model does the thinking; the little models stand guard on either side.

Why not just make the main model safe?

You might reasonably ask why this is needed at all — isn't the big model already trained to refuse harmful things? It is. A model's first line of safety is baked into its training, through techniques that teach it to decline bad requests. But that training is imperfect and, as the Fable episode showed, can be jailbroken — coaxed past its own guardrails by a sufficiently clever prompt.

A separate classifier is a second, independent line of defence, and it has one decisive practical advantage: it's far cheaper and faster to update than the model itself. When a new jailbreak is discovered, you don't have to retrain a frontier model that cost a fortune and months to build. You train or tune a small classifier to recognise the new attack and deploy it in front of the big one. That is exactly the move Anthropic described today — a specific, freshly-trained classifier aimed at a specific, newly-found hole. Meta ships an open one called Llama Guard; OpenAI offers a moderation endpoint; Anthropic has published research on what it calls "constitutional classifiers" built precisely to catch jailbreaks. The pattern is now standard equipment.

The honest limits

A guard is not a cure, and it's worth being clear-eyed about what a classifier can and can't do.

It isn't perfect — that "99%" is not 100, and the gap matters. Classifiers make two kinds of mistake: false positives, where they block perfectly benign content (the over-cautious refusals that frustrate ordinary users), and false negatives, where a genuinely harmful input or output slips through. Every deployment is a dial between the two, and there's no setting that eliminates both.

It's an arms race. Attackers keep finding new phrasings; defenders keep updating the classifier to catch them. A classifier trained to block today's jailbreak may be blind to next month's, which is why "we trained a classifier that stops it 99% of the time" is a snapshot, not a permanent victory. The cat-and-mouse doesn't end; it just moves.

And it's a fence, not a foundation. A classifier bolted onto an unsafe model is a patch over a problem, not a solution to it. The serious labs treat these as one layer in a stack — alongside the model's own training, human review, monitoring, and usage policies — not as the whole answer.

The takeaway

The next time you read that an AI company "added new safety measures" or "strengthened its guardrails," there's a good chance this is part of what they mean: not a change to the giant model, but a small, sharp, specialised classifier trained to spot a particular kind of trouble and posted at the door. It's a modest piece of engineering. Today it was modest enough to help end an eighteen-day international standoff — and quietly permanent enough to be worth knowing about.