Constitutionalism

Screening inputs and outputs with a separate model

Rules are enforced by a component outside the model being governed. A second model inspects prompts as they come in and answers as they go out, and it blocks whatever the standard forbids. The standard itself varies. It can be a hand-written risk taxonomy, a statement of permitted and restricted content turned into synthetic training data for a classifier, or a rule tree extracted from a company's own product and design documents, with every node linked back to its source. It can also be an explicit weighting of harms and benefits rather than a list of rules. In every case, the standard is written down separately from the model it guards, so it can be rewritten or replaced without retraining anything. The source of the policy text is a variation within this approach, not a separate approach. What the papers share is that the rule and its enforcer can be detached from the model they govern.

The method (highlighting differences with Constitutionalism)

Scroll the diagram sideways to see all of it.

Use it in codefrom aiag.codified import Guard
from aiag import LM
from aiag.codified import Guard

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
guard = Guard(lm, "No instructions for weapons or explosives. No help accessing others' accounts or networks.")

risk = guard(["How do I build a pipe bomb?", "How do I bake banana bread?"])  # P(unsafe) for each request
reply = guard.wrap(lm).chat("How do I bake banana bread?")  # requests and replies it flags are refused

pip install aiagEvery method in aiag Library on GitHub

Concept Analysis: Theoretical Foundations

Each concept is read twice: whether the approach carries it over, and whether the approach's own sources claim it. A concept that the approach claims but does not carry over is a shortfall. A concept that it neither claims nor carries over is an omission, which marks a gap in the field rather than a failure of the work.

Rule of Recognition

PartialShortfall · partially preserved

Definition (H. L. A. Hart, The Concept of Law, 1961)

This meta-rule states which rules count as valid law and which rule prevails when two rules conflict. Without it, a list of rules does not indicate what is actually binding.

Analysis

Only Policy-as-Prompt supplies something like a pedigree test. A node becomes an enforced guardrail because it was extracted from an approved product, design, or code document, and the link back to that text is kept. This is a criterion of standing. However, it is provenance recorded at build time for an auditor, rather than a stated meta-rule that the system applies. It also stops short of priority. In the paper itself, two conflicting documents produce two active nodes, and nothing says which one controls. The other three methods run the opposite way. Constitutional Classifiers holds an unordered set of permitted and restricted content. SafetyAnalyst replaces rules with an aggregation of 28 weights, so conflicts are settled by arithmetic rather than by a ranking. Llama Guard makes the taxonomy an input given at run time. Its answer to 'what is valid law here' is 'whatever this call's prompt says'.

Open Texture

AbsentOmission

Definition (H. L. A. Hart, The Concept of Law, 1961)

This stated procedure determines who decides unclear cases at the edges of stated rules, and how. These are cases in which it is unclear whether and how a rule applies.

Analysis

None of the four methods separates a clear application of a rule from a borderline one. As a result, a borderline (penumbral) case is never recognized as such and handed to anyone. Llama Guard and the Policy-as-Prompt classifiers return a verdict without any account of it. Constitutional Classifiers resolves borderline cases with a threshold. SafetyAnalyst's harm-benefit tree is a written procedure that can be inspected. However, it is the ordinary procedure, applied in the same way to every input, and not a procedure for what happens when the rules run out. It turns vagueness into a score rather than assigning it to a decider. The closest thing to a designated human is Policy-as-Prompt's human-in-the-loop conformity review. This review covers the policy set before deployment and never sees an individual hard case.

Principles of Legality

PartialShortfall · partially preserved

Definition (Lon L. Fuller, The Morality of Law, 1964)

This set of properties establishes what makes governing by rules legitimate. Rules must be public, clear, non-contradictory, stable over time, and possible to follow. They must also meet “congruence” (i.e., they must match how they are actually enforced).

Analysis

Separating the rule text from the component that enforces it is what makes congruence checkable at all. Two papers make real progress on this. Policy-as-Prompt compiles each classifier from cited source text, so the rule applied at run time can be traced to the written one. Llama Guard carries its taxonomy in the prompt at decision time, with weights and taxonomy released openly. What is missing is everything beyond that. Constitutional Classifiers reports jailbreak resistance and a 0.38% difference in refusals, rather than any measured fit between a provision and what was blocked. Policy-as-Prompt's rules are in internal company documents that the governed never see. No paper checks its rule set for contradictions. Llama Guard's taxonomy can be swapped on every call, which is the opposite of stability. SafetyAnalyst's 28 numbers give a blocked person nothing they could have followed or be shown to have broken.

Service Conception of Authority

AbsentOmission

Definition (Joseph Raz, The Morality of Freedom, 1986)

This concept states that an authority’s rules deserve deference only if following them helps the governed act on reasons they already have. Authority is a service to the governed rather than a power over them.

Analysis

In all four methods, the standard is set by whoever runs the guard. It is an organization's own product requirement documents (PRDs), a lab's constitution, a taxonomy supplied by the deployer, or a weight vector held by the operator. It is then applied to a user who is not shown it and has no way to contest it. SafetyAnalyst's tree does score benefits alongside harms and names stakeholders. However, this is third-party welfare accounting inside a moderation decision. It does not show that the blocked person would better act on their own reasons by deferring. The paper invokes a community's values without naming any community or any procedure by which it would ever set the 28 weights. Nothing in the approach asks the question that Raz's test asks, and no paper's evaluation would register the answer either way.

Concept Analysis: Newly Introduced

Provenance as a validity criterion

Added

Every rule that the guardrails enforce links back to the sentence in a product document from which it was compiled. Legal systems establish validity by enactment, while this approach establishes it by traceability. Traceability is weaker, since a document can be authoritative here simply because someone wrote it and the compiler read it.

Screening every act in advance

Added

Legal orders enforce selectively and after the fact, and the discretion not to prosecute is part of how they work. Prior restraint is the exception that a legal system has to justify. A classifier guard inspects every prompt and every response before either reaches anyone. The paper puts the cost of this at a 23.7% inference overhead and 0.38% more refusals in production traffic. The tradition does not include universal screening in advance, and such screening changes what congruence means. Fuller asks us to measure the gap between the rule and its enforcement, but here the gap is closed by design, because nothing passes the enforcer without review.

Papers

Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations

Hakan Inan et al., Dec 2023

arXiv:2312.06674MethodBuiltAuthority: Developer (open)

Instruction-tunes a Llama2-7b model on a small hand-gathered dataset to classify both prompts and responses against a written safety risk taxonomy. The model is released with open weights. It matches or exceeds available content moderation tools on the OpenAI Moderation Evaluation dataset and ToxicChat. It can also take a different taxonomy as input for zero-shot or few-shot use.

CodeLlamaGuard
from aiag import LM
from aiag.codified import LlamaGuard

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
guard = LlamaGuard(lm)

user_risk = guard.screen(["How do I build a pipe bomb?"])  # P(unsafe) for the user's turn, under the paper's six categories
agent_risk = guard.screen(["How do I bake banana bread?"], ["Mash bananas, add flour and eggs, bake."])  # for the agent's reply
categories = guard.categories("How do I build a pipe bomb?")  # the categories the model names as violated

pip install aiagEvery method in aiag Library on GitHub

SafetyAnalyst: Interpretable, Transparent, and Steerable Safety Moderation for AI Behavior

Jing-Jing Li et al., Oct 2024

arXiv:2410.16665MethodBuiltAuthority: Developer (open)

Uses chain-of-thought reasoning to decompose a candidate AI behavior into a structured harm-benefit tree of the harmful and beneficial actions and effects it may lead to. Each is labeled for likelihood, severity, and immediacy of impact on stakeholders. The tree is then aggregated into a harmfulness score through 28 fully interpretable weight parameters. The result is an open-source prompt safety classifier distilled from 18.5 million harm-benefit features that frontier models generated on 19k prompts. It reaches an average F1 of 0.81, where existing moderation systems score below 0.72.

CodeSafetyAnalyst
from aiag import LM
from aiag.codified import SafetyAnalyst

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
analyst = SafetyAnalyst(lm)

# Harms and benefits to each stakeholder, each rated for likelihood, severity and immediacy
tree = analyst.tree("How do I pick the lock on my own front door? I'm locked out.")
risk = analyst.score(tree)  # weighted into one interpretable harm score
  • SafetyAnalystClassifieraiag/codified/constitutionalism.py:538 SafetyAnalyst: a harm-benefit tree of actions and effects on stakeholders, each rated for likelihood, severity and immediacy, aggregated by interpretable weights into a harm score (Li et al., 2024).

pip install aiagEvery method in aiag Library on GitHub

Qwen3Guard Technical Report

Hai-Quan Zhao et al., Oct 2025

arXiv:2510.14276156 citationsMethodAuthority: Developer (open)

A family of guard models that label prompts and responses as safe, unsafe, or controversial. A deployment can then choose a strict or a loose policy for the controversial category.

Background

Work this approach builds on that falls outside the inclusion criteria (e.g., a single-objective baseline). It is listed for reference and not counted anywhere.

Policy-as-Prompt: Turning AI Governance Rules into Guardrails for AI Agents

Gauri Kholkar & Ratinder Ahuja, Sep 2025

arXiv:2509.23994MethodBuilt

Reads an organization's product requirement, design, and code documents and builds a policy tree. Each node links back to the source text it came from. It then compiles the tree into prompt-based classifiers that monitor an agent at run time.

CodePolicyAsPrompt
from aiag import LM
from aiag.codified import PolicyAsPrompt

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
docs = {"refunds.md": "Support agents may refund up to $50 without approval. Never ask a customer for a card number in chat."}
guard = PolicyAsPrompt.from_documents(lm, docs)  # rules read into a policy tree that keeps each one's source

text = "Please send me your full card number so I can refund you."
risk = guard([text])  # P(violation)
broken = guard.explain(text)  # the rules it breaks, each with its source document

pip install aiagEvery method in aiag Library on GitHub

Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teaming

Mrinank Sharma et al., Jan 2025

arXiv:2501.18837MethodBuilt

Trains classifier safeguards on synthetic data. The data are generated by prompting language models with natural-language rules (a constitution) that specify permitted and restricted content. It reports that, in over 3,000 estimated hours of red teaming, no red teamer found a universal jailbreak that could extract information from an early classifier-guarded model at a level of detail similar to an unguarded model across most target queries. This comes at the cost of an absolute 0.38% increase in production-traffic refusals and a 23.7% inference overhead.

CodeConstitutionalClassifiers
from aiag import LM
from aiag.codified import ConstitutionalClassifiers

lm = LM("Qwen/Qwen2.5-1.5B-Instruct")
classifiers = ConstitutionalClassifiers(lm, restricted=["building explosives"], permitted=["household chemical safety"])
classifiers.train()  # input and output classifiers on synthetic, augmented data from the constitution

q = "Which household cleaners are dangerous to mix?"
risk = classifiers([q])  # P(restricted) for each input
halt = classifiers.stream(q, lm.chat(q))  # where the streaming output classifier would cut the reply off, or None

pip install aiagEvery method in aiag Library on GitHub