Claude, From First Principles: Training, Constitutional Methods, and What Actually Shapes a Response

A weights file decides less than it seems to

Ask what “Claude” is and the honest answer resists a single noun. A deployed Claude model is at minimum four separable things stacked on top of one another, each fixed on a different schedule and controllable by a different party: a pretrained prior, fitted once and never touched again; a post-training pass that reshapes what the prior will actually say, built from reinforcement learning against both human and AI-generated judgments; a set of per-request choices — a system prompt, a thinking-token budget, a tool definition — that a caller sets fresh on every single call; and an external evaluation gate, governed by a public policy, that has to be cleared before any of the above is allowed to ship. None of these four is optional and none of them is the others. Confuse them and almost every claim about “what Claude does” becomes unfalsifiable, because the actual cause of a given behaviour could live in any of the four layers, and a single transcript cannot tell you which one produced it.

This article works through the first three layers in the order a model actually passes through them, then the fourth — the gate every layer above has to clear — and it stays at systems level throughout. Constitutional AI, Anthropic’s best-known post-training method, gets one dedicated section here: enough to place it correctly in the pipeline and state what it structurally changes, not a full account of how principles are written, selected, or weighed against one another when they conflict, which is substantial enough to be its own subject. Long-context behaviour, enterprise deployment mechanics, the deployed safeguards that enforce a given safety tier, the economics of serving these systems, and a benchmark-by-benchmark tour of capability evaluation are likewise out of scope here; each deserves its own treatment rather than a paragraph inside this one.

What pretraining actually buys

The architecture underneath a Claude model, like nearly every other frontier language system, is a decoder-only transformer trained to predict the next token over a very large corpus ^[12]. What that training actually produces is not knowledge in any curated sense but a prior — a broad distribution over plausible continuations that encodes an enormous amount about language, code, and the structure of arguments, and comparatively little about what any particular operator wants done with it. Two variables set the price of that prior. Pretraining compute for a dense transformer is well approximated by

where $N$ is the parameter count and $D$ is the number of training tokens, the factor of six accounting for the forward and backward pass together. Kaplan and colleagues showed empirically that test loss falls as a power law in each of $N$, $D$, and compute across many orders of magnitude, with a functional form that includes an irreducible floor: doubling the parameter count buys a fixed decrement in loss, not a fixed multiple of capability ^[12]. That single empirical regularity is a large part of why frontier pretraining runs keep growing and why each one produces diminishing, rather than accelerating, returns.

What Anthropic has and has not disclosed about its own pretraining recipe is easy to state precisely, because the boundary is sharp. The company publishes model and system cards describing a model’s capabilities, evaluated behaviour, and the safety process a release went through ^[5]. It does not publish the training corpus, the exact parameter count, or the compute budget for any Claude generation, and nothing in this article should be read as claiming otherwise. What can be said, because it is publicly documented policy rather than an inference from outputs, is that training runs above certain capability thresholds are themselves subject to an internal review process before training proceeds, under the company’s Responsible Scaling Policy ^[6] — a fact that matters more in this article’s later section on the evaluation gate than it does here. The load-bearing point for this section is narrower: pretraining is a one-time purchase of a broad, unfocused prior, and everything the rest of this article describes is something done to that prior afterward, never an addition to it.

Post-training installs behaviour, not knowledge

The step that turns a broad prior into something resembling a helpful, cautious assistant is post-training, and its default form across the field, including at Anthropic, is reinforcement learning from human feedback. Anthropic’s own early technical account is direct about the mechanism: human labellers compare pairs of model responses, those comparisons are used to fit a separate preference, or reward, model, and the policy is then optimised against that fitted reward model with reinforcement learning ^[2]. A companion paper from the same research programme frames the target explicitly as a language assistant that is simultaneously helpful, honest, and harmless, and treats that three-way tension, not any single axis, as the actual object being optimised ^[3].

The optimisation itself has a specific and revealing shape. Rather than maximising the fitted reward outright, the standard formulation constrains the updated policy to stay close to a reference policy, ordinarily the model just after supervised fine-tuning, one step removed from the raw pretrained prior:

The reward term $r(x,y)$ pulls the policy toward whatever the fitted preference model scores highly; the Kullback–Leibler penalty, weighted by $\beta$, pulls it back toward the reference distribution. That second term is not a minor regulariser. It is the load-bearing assumption behind the entire method: remove it, and a policy optimised hard enough against an imperfect reward model will find outputs the reward model over-scores without those outputs actually being better, a failure usually called reward hacking. Casper and thirty-one co-authors, surveying RLHF across the field rather than defending any one lab’s implementation, catalogue this and related problems as fundamental rather than incidental — reward models are themselves approximations fit to a finite, imperfect sample of human judgment, and optimising hard against an approximation reliably finds its blind spots ^[10]. This is a genuine point of disagreement in the field, not a settled matter: labs running RLHF treat the KL anchor, reward-model ensembling, and process-level checks as adequate mitigations in practice, while Casper and colleagues argue the underlying problem is structural and call for auditing and disclosure standards beyond what is currently published by any lab. Both positions are defensible from public evidence; this article does not adjudicate between them.

What matters for the first-principles account here is narrower still. RLHF does not teach a model new facts about the world. It reweights which of the prior’s already-latent behaviours get reliably produced, anchored throughout by that Kullback–Leibler term to the pretrained-and-fine-tuned starting point rather than left free to wander.

Constitutional AI’s role, defined at survey level

Constitutional AI is Anthropic’s best-documented departure from plain RLHF, and it is worth being precise about exactly what it changes, because the method is easy either to overstate or to wave at vaguely. Bai and fifty co-authors describe it as a two-phase procedure layered onto the pipeline above ^[1]. In the first phase, the model is prompted to critique its own draft response against one principle drawn from a written list, then to revise the response in light of that critique; those revised responses become supervised fine-tuning data, so the model that comes out the other side has been trained partly on its own corrected output rather than solely on external demonstrations. In the second phase, the same reinforcement-learning-against-a-reward-model structure from the previous section is reused, but for the harmlessness comparisons specifically, the preference labels ordinarily supplied by human raters are instead generated by a separate instance of the model, prompted with a constitutional principle and asked which of two candidate responses better satisfies it — a substitution the paper’s authors call reinforcement learning from AI feedback, RLAIF, to distinguish it from RLHF ^[1]. Put in terms of the objective in the previous section, Constitutional AI’s second phase is the same $J(\theta)$, with $r(x,y)$ for the harmlessness component sourced from a principle-conditioned AI judgment rather than an additional round of human labelling; the original paper’s helpfulness comparisons continued to draw on human preference data ^[1].

The written document that supplies those principles is itself public and has changed shape over time. Anthropic first published a version of Claude’s constitution in May 2023; a substantially expanded revision, organised around Claude being broadly safe, broadly ethical, compliant with Anthropic’s own guidelines, and genuinely helpful, was published in January 2026, running to roughly eighty pages across four sections rather than the original’s much shorter form ^{[4, 13]}. That the document is public at all is itself a methodological choice Anthropic states plainly: values expressed as an explicit, readable constitution are easier to inspect and argue with than values implied entirely by an opaque set of crowdsourced comparisons ^[4].

It is worth stating what this section has deliberately not done. It has not walked through how individual principles are selected, how conflicts between principles are resolved when a critique could reasonably invoke more than one of them, or how the critique-and-revision prompts are engineered — that is the method’s actual substance, and it is substantial enough to be its own article rather than a subsection of this one. What matters at the survey level this piece is pitched at is where the step sits, inside post-training, downstream of the pretrained prior, reusing the same reward-and-KL-anchored optimisation as RLHF, and what it changes structurally: it moves part of the harmlessness signal from a human comparison to a principle-conditioned model comparison, in a process whose criteria are published rather than implicit.

One further piece of Anthropic’s own published research bears on how durable this kind of training turns out to be. A 2026 study from the company’s alignment science group found that training a model directly against a specific adversarial scenario generalised poorly to related but different scenarios, whereas training it on documents describing the reasoning behind aligned behaviour, including Claude’s constitution itself and fictional narratives about AI systems acting well, reduced a measured blackmail-under-threat behaviour from 65 percent to 19 percent in one internal evaluation, despite the training data never mentioning that specific scenario ^[9]. That is a vendor-reported internal result, not an independently replicated one, and it should be read as exactly that; it is included here because it speaks directly to this section’s claim that constitutional-style, principle-based training is meant to change something more general than a narrow behaviour, which is also its own stated justification for existing as a distinct method rather than simply more RLHF data.

What actually shapes a single response

Everything above happens once, before a model is ever deployed. A separate set of choices happens on every single request, and it is the layer most directly under the caller’s control. Three mechanisms account for most of it.

The first is the system prompt: instructions placed ahead of the user’s own turn that the model treats with a different priority than ordinary conversation, and which vary by deployment context, since a consumer chat interface, an API integration, and a coding tool each carry different defaults. The second is a thinking, or reasoning, budget. Claude 3.7 Sonnet introduced what Anthropic describes as a hybrid reasoning mode, in which the same underlying model can answer immediately or first produce an extended, visible chain of reasoning before answering, and a caller using the API can cap that reasoning to a specific number of tokens, trading latency and cost against answer quality ^[11]. This is functionally the same idea as a reasoning-effort control found elsewhere in the field, but the specific instantiation differs in a way worth naming rather than glossing over: Anthropic exposes it as a token budget the caller sets directly, rather than as an ordinal label chosen from a fixed menu, which changes how precisely a given deployment can tune cost against quality. The third mechanism is tool definitions, the schema of external functions a model is told it may call, which shape not the model’s values but the action space it reasons over, and which the alignment-science finding cited in the previous section found mattered for generalisation even when a specific tool went unused during an evaluation, plausibly because the presence of unused options exercises a broader part of the model’s learned behaviour than a menu that never varies ^[9].

None of these three settings touches the weights. A model given a terse system prompt, no thinking budget, and no tools, and the same model given a detailed system prompt, a generous thinking budget, and a rich tool schema, are the same fitted parameters answering under two different policies. Observed differences between the two are evidence about the request configuration, not about the underlying model, a distinction that matters enormously for anyone comparing two deployments and mistaking a settings difference for a capability difference.

The gate every layer above has to clear

None of the preceding three layers ships to users on the strength of engineering judgment alone. Anthropic states its own general rationale for building this apparatus at all in explicitly empirical terms: an uncertain but plausibly near-term arrival of highly capable systems justifies research into interpretability, oversight, and testing for dangerous capabilities well before any specific model demonstrates them ^[7]. The concrete instrument built on that rationale is a public Responsible Scaling Policy that assigns each model an AI Safety Level, or ASL, based on periodic capability evaluations, conducted on a roughly six-month cadence, covering domains including cyber offence, biological weapons uplift, and autonomous replication or self-improvement capability, with defined thresholds that trigger a higher ASL tier and its associated deployment and security requirements before a model can be released at all ^[6]. Claude Opus 4 was released under ASL-3 measures; Anthropic’s own description frames this as a precautionary, provisional classification rather than a determination that the higher-risk capability had been conclusively confirmed, while Claude Sonnet 4 from the same generation was released under the lower ASL-2 standard, illustrating that the classification is model-specific rather than generation-wide ^[5].

Some of this evaluation work is not done by Anthropic itself. The company’s own account states that pre-deployment testing of Claude Opus 4 included independent assessment by the United States and United Kingdom AI safety institutes, plus a separate contracted assessment by Apollo Research focused specifically on an early model snapshot’s propensity toward sabotage-like behaviour ^[5]. Evaluators with no contract from Anthropic at all also track Claude models on their own terms: METR, a nonprofit evaluation organisation, measures how long a software task, timed against a competent human baseline, a model can complete at a defined success rate, and reported Claude 3.7 Sonnet at roughly a one-hour, fifty-percent-success time horizon on its task suite, a figure the organisation itself qualifies with caveats about task-suite composition and small trial counts at the longest difficulty tiers ^[8]. That figure is cited here only as one illustration of what evaluation independent of a vendor’s own reporting looks like structurally; a survey of what capability evaluation actually measures, and how reliably, is its own subject and not this article’s.

What ships alongside the weights

The practical consequence of the previous section is that a Claude release is not only a set of weights plus a post-training recipe; it is that pair plus a public document describing what was tested, what was found, and what was not resolved. System cards are Anthropic’s vehicle for this, and they are explicitly framed as safety and evaluation disclosures rather than marketing collateral, published alongside or shortly after a model’s release ^[5]. Casper and colleagues’ broader critique of RLHF-based pipelines explicitly calls for auditing and disclosure standards beyond what most labs currently publish ^[10]; system cards are a partial, voluntary answer to exactly that call, not a complete one, and Anthropic’s Responsible Scaling Policy commits to further governance layers around them, including external review of unredacted risk reports by a body the policy calls the Long-Term Benefit Trust, that sit outside the publicly released document itself ^[6].

The honest limit is worth stating plainly, in keeping with this article’s brief to stick to what is publicly documented. A system card discloses evaluation results and safety process, not training data, not exact compute, and not the internal weighting between the various signals blended together in post-training. Readers comparing two Claude generations, or Claude against another vendor’s model, on the strength of a system card alone are comparing published evaluation summaries, not the underlying systems directly, and the two are not the same object.

Predictions, with what would falsify them

These are forecasts, kept separate from the sourced description above. Horizon: 12 August 2028.

One. Anthropic’s published system cards will report the specific per-request settings used during headline capability evaluations — thinking-token budget, system-prompt category, tool schema — rather than an aggregate score alone, because comparisons without that detail will have become as indefensible for Claude as for any other reasoning-capable model family. Disconfirmed if 2028-era system cards still report headline evaluation numbers with no disclosure of the inference-time settings used to produce them.

Two. The proportion of post-training preference signal sourced from principle-conditioned AI judgment, rather than fresh human comparison, will grow beyond the harmlessness-only scope described in the original Constitutional AI method, extending into other behaviour categories the constitution already covers. Disconfirmed if Anthropic’s own published technical reports in 2028 show human preference comparisons still supplying the large majority of preference data across all categories, essentially unchanged in proportion from the 2022 method.

Three. Independent, non-Anthropic evaluation of frontier Claude models, in the pattern METR and the AI safety institutes already occupy, will expand in scope and be cited directly inside Anthropic’s own system cards as a matter of routine rather than appearing as an occasional, separately sourced data point. Disconfirmed if system cards published in 2028 rely solely on Anthropic-run evaluations with no independent replication cited alongside them.

None of these three requires a capability discontinuity. Each follows from a disclosure and methodology trend already visible in the sources cited above, extrapolated forward on an ordinary four-year horizon.

What to take away

Treat “Claude” as an assembly, not a single fitted object. A pretrained prior supplies breadth at a price set by a scaling law with a floor under it. RLHF and, specifically, Constitutional AI’s principle-conditioned second phase decide which of that breadth gets reliably expressed, anchored throughout to the pretrained-and-fine-tuned starting point so the process does not drift arbitrarily far from it. A small set of per-request settings then decide what a single deployed call actually does, quite apart from any of the above. And a public policy, partly enforced by evaluators outside the company altogether, decides whether any of it is allowed to ship at all. Ask which of these four layers produced a given behaviour before asking whether the behaviour is good, bad, or surprising; most of the genuinely confused arguments about what Claude “is” turn out, on inspection, to have collapsed two or more of these layers into one.