Trains a model to critique and revise its own outputs against a written set of principles, then learns from the revised outputs. The aim is a helpful assistant that can explain why it declined, rather than one that simply refuses.
@article{bai2022constitutional,
author = {Yuntao Bai and Saurav Kadavath and Sandipan Kundu and Amanda Askell and Jackson Kernion and Andy Jones and Anna Chen and Anna Goldie and Azalia Mirhoseini and Cameron McKinnon and Carol Chen and Catherine Olsson and others},
title = {Constitutional AI: Harmlessness from AI Feedback},
year = {2022},
eprint = {2212.08073},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2212.08073}
}Ejentic did not author this paper. Credit belongs to the authors named above; the note is ours.
2026
This is the evaluation we run before we let an agent touch anything a customer can see. The finding that matters is the split — a model can pass direct prompt-injection tests and still fold the moment the same instruction comes back through a tool result. Those are different failure surfaces and one test does not cover both.
2026
This is the exact shape of a deployed support or negotiation agent: it works for the business and talks to someone who does not. The split the benchmark finds is the one that matters commercially, because the failure is not leaking data to the counterparty, it is refusing the principal so broadly that the agent stops doing the job it was hired for.
2026
Directly relevant to anyone bolting retrieval onto a model and assuming the citations are the safety mechanism. Adding a fake citation to a true claim made models worse, not better. Grounding that is not verified is worse than no grounding at all, because it arrives with the confidence of evidence.