Safety Classifier

What It Is

A safety classifier is a small model or rule layer that runs in front of, or inside, a larger model and decides whether a prompt should be answered, refused, or handed to a different model. The classifier reads the incoming prompt, scores it against categories the lab has flagged as high-risk, and routes accordingly. In the Anthropic case that prompted this entry, the categories are cybersecurity, biology, and chemistry, and the routing target when the score trips is Claude Opus 4.8 instead of the newer Claude Fable 5.

The behavior matters because it changes what “using a frontier-model” actually means in production. You think you are talking to Fable 5. Sometimes you are. Sometimes the classifier silently hands your prompt to an older model, and the answer you get back is shaped by that older model’s capabilities. The classifier is the most consequential piece of plumbing most operators have never seen.

How It Actually Works

The classifier is itself a model, usually much smaller and faster than the frontier model it gates. It is trained on labeled examples of safe and unsafe prompts and produces a category score per request. When the score exceeds a threshold, the upstream system rewrites the request: same prompt, different model. The user usually does not know the reroute happened unless the response quality drops noticeably or the model explicitly says so.

Some classifiers run as a pre-processing step before the prompt ever reaches the main model. Others sit inside the same forward pass and influence which weights get activated. The Fable 5 design appears to be the former, which is why Anthropic can be precise about which queries get rerouted and which do not.

Why It Matters Right Now

A classifier is the frontier-lab’s answer to a question that does not have a regulatory answer yet. Governments have not finished writing rules for what a model is allowed to say about gain-of-function research or zero-day exploits. The labs are writing the rules first, in code, and publishing them as part of the product. Anthropic shipping Fable 5 with a public reroute is the most visible version of this pattern to date.

The classifier also lets a lab ship a more capable model without shipping the full upside of that capability. You can keep the cyber-permissive-model behavior at the older tier while still letting customers use the newer model for writing, analysis, code, and reasoning. The lab gets benchmark headlines without the worst-case prompts.

How TWO Uses It

Scott’s read on safety classifiers is that they are the most important feature an operator should evaluate when picking a default model, and the one feature almost nobody benchmarks. The release-note headline says “Fable 5 is generally available.” The actual product is “Fable 5 plus a classifier whose behavior on your specific prompts has not been documented in detail.”

Here is the operator-decision moment. You are choosing between Fable 5 and your current default for an agent loop that runs across a private codebase. Half the codebase is application logic. The other half includes authentication, session management, and a security-tooling module. The first half will run on Fable 5. The second half will sometimes get rerouted to Opus 4.8 mid-loop, because the classifier will read prompts about session tokens, key rotation, or vulnerability triage as cybersecurity uplift. Your agent will appear to get smarter, then dumber, then smarter again, in ways that look like a bug. The TWO recommendation is to run your three hardest prompts through the model before committing, log which ones rerouted, and treat the reroute behavior as part of the model’s spec sheet, not as a footnote.

This is also where model-routing and the classifier become impossible to separate. They are two sides of the same plumbing.

A Concrete Operator Scenario

A reader writes a daily security-audit agent that scans a Slack channel for posted credentials and alerts the admin. They switch the agent’s default from their previous model to Fable 5 on Wednesday afternoon. By Friday the agent’s accuracy has dropped, and the false-positive rate has climbed. The reader assumes the model is worse. The actual cause is that every alert prompt contains the words “credential,” “API key,” and “session token,” and roughly forty percent of those prompts trip the cyber classifier and route to Opus 4.8, which has weaker structured output. The fix is not to abandon Fable 5. The fix is to rewrite the prompts so the security framing lives in the system prompt, not the user message, so the classifier reads the per-request payload as routine log parsing.

What to Watch Next

The signal that classifiers are changing is when the major labs start publishing per-category reroute rates the way they publish refusal rates today. Until that happens, operators are running blind on the most important behavior change between model versions. Watch pre-deployment-evaluation reports for the first lab that breaks out reroutes as a separate column.