What does this equation mean?

That first version cost real computation: 23.7% more inference compute than running the model alone, and a 0.38 percentage-point increase in refusals on ordinary, harmless traffic [ 4 ] . Anthropic’s January 2026 follow-up redesigned the system around a two-stage cascade rather than a single classifier pass: a lightweight probe reads the language model’s own internal activations and screens every exchange cheaply, escalating only the fraction it flags to a slower, more capable classifier that reviews the input and output together [ 1 ] . If $c_{\text{probe}}$ is the near-free cost of the first pass and $c_{\text{exchange}}$ the much larger cost of the second, and $p_{\text{esc}}$ is the fraction of traffic the probe escalates, the expected added cost per request is $\bar{c} = c_{\text{probe}} + p_{\text{esc}} \cdot c_{\text{exchange}}$. Because $p_{\text{esc}}$ is small on ordinary traffic, the average cost collapses toward $c_{\text{probe}}$ even though $c_{\text{exchange}}$ did not get any cheaper — which is the documented reason Anthropic reports the overhead falling from 23.7% to roughly 1% between generations, alongside a drop in the harmless-traffic refusal rate to 0.05% and, across more than 1,700 cumulative red-teaming hours against the new system, one high-risk vulnerability found, which Anthropic describes as a detection rate of 0.005 per thousand queries — the lowest of any defense it reports having evaluated [ 1 ] . Every one of those figures is Anthropic’s own measurement of its own system; none has yet appeared in an independently authored, peer-reviewed replication.