Constitutional AI: Principled AI Alignment

Two constitutions, one design problem

India's Constitution contains two very different kinds of provisions sitting side by side. Part III, the Fundamental Rights, is written with judicial precision: Article 21 says no person shall be deprived of life or personal liberty except by procedure established by law, and a court can rule on whether a specific state action violates it. Part IV, the Directive Principles of State Policy, is written in the opposite register: Article 39 asks the State to ensure that the ownership and control of material resources are distributed to subserve the common good. No court can order the government to satisfy Article 39 the way it can enforce Article 21 — the language is deliberately broad, aspirational, and open to interpretation. The framers needed both. Narrow, checkable rules give you certainty but leave gaps everywhere a drafter didn't anticipate. Broad principles cover the gaps but require a judge, or a government, to exercise judgment about what they mean in a given case — and broad principles can pull against narrow rights, which is exactly what happened in Minerva Mills v. Union of India (1980), where the Supreme Court had to decide how far Parliament could amend Fundamental Rights in the name of advancing Directive Principles, and held that the harmony between Parts III and IV was itself part of the Constitution's basic structure (the doctrine the Court had established seven years earlier in Kesavananda Bharati v. State of Kerala, 1973).

A large language model's "constitution" — the written set of principles used to shape its behaviour toward being helpful, harmless, and honest — faces the identical design problem, at much smaller scale but with the same structural tension. Two related chapters in this course cover how a constitution gets turned into trained behaviour through AI-generated self-critique and reinforcement learning from AI feedback (RLAIF), and how Constitutional AI compares to other alignment techniques like RLHF and direct preference optimization. This chapter deliberately stays upstream of all of that. Before any critique-and-revise loop runs, before any preference model is trained, someone has to sit down and write the document. That act of drafting — choosing how specific each principle should be, deciding what happens when two principles disagree, and measuring whether the resulting document actually changes model behaviour in the direction intended — is a distinct engineering discipline, and it is the subject of this chapter.

What a constitution is, mechanically

Strip away the training procedure and a constitution is just a ranked or weighted list of natural-language statements that a judge — a human rater, an AI critic, or a trained preference model — consults when comparing two candidate outputs or revising one output. Anthropic's original Constitutional AI paper (Bai et al., 2022, "Constitutional AI: Harmlessness from AI Feedback") assembled such a document by drawing on multiple existing sources of normative guidance rather than inventing principles from nothing: excerpts adapted from the UN Universal Declaration of Human Rights, clauses inspired by other AI labs' usage policies, and the researchers' own additions targeting specific failure modes observed in earlier models. DeepMind's Sparrow agent, described in Glaese et al. (2022), "Improving Alignment of Dialogue Agents via Targeted Human Judgements," took a visibly different path: it shipped with a fixed list of roughly two dozen (23) explicit rules — "do not pretend to have a body or be able to move in a body," "do not offer financial advice," "do not make threatening statements" — each one narrow enough that a human annotator could check compliance in a single glance.

Both documents are "constitutions" in the technical sense used in this literature. They differ enormously in one design dimension: how much interpretive work is pushed onto the judge applying the principle versus how much work the drafter did in advance by enumerating cases. That dimension is the first thing a constitution designer has to get right, and it has a measurable effect on the resulting model, which is what the next section derives.

Axis one: specificity versus generality

A highly specific principle — "never provide step-by-step synthesis routes, reagent quantities, or reaction conditions for chemical weapons" — is cheap to audit and hard to misapply on the cases it names, but by construction it says nothing about the tenth chemical weapon precursor the drafter didn't think to list, and nothing at all about biological or radiological analogues. A highly general principle — "avoid content that could contribute to serious harm" — covers all of those unlisted cases in principle, but hands enormous interpretive latitude to whatever system is applying it, and vague language is exactly what a model (or a human rater under time pressure) tends to over-apply defensively, refusing benign requests that merely share surface features with harmful ones. This is not a hypothetical trade-off; it shows up as a measurable shift in precision and recall the moment you run an evaluation, which is worth working through in full because the arithmetic is where the trade-off stops being a vibe and becomes a design decision you can defend with numbers.

Suppose a safety team is evaluating two versions of a single principle against a held-out labelled set of 200 prompts: 100 are genuinely dangerous requests (asking for weaponisable synthesis instructions) and 100 are benign-but-adjacent requests that share surface vocabulary with the dangerous set (a school chemistry question about oxidation states, a novelist asking how nerve agents are described in Cold War thrillers, a pharmacology student asking about LD50 values for a controlled substance). Constitution v1 uses only the general principle above. Constitution v2 adds one clarifying sentence: "General chemistry safety information, historical or fictional description of hazardous chemistry, and dosage/toxicity data used for medical or educational purposes are permitted; reagent quantities, reaction conditions, and synthesis routes usable to produce a weapon are not." Running both constitutions over the same 200 prompts (via the model's judgement, red-team review, or however the eval is scored) produces two confusion matrices.

Precision is TP / (TP + FP) — of everything the constitution refused, what fraction was actually harmful. Recall is TP / (TP + FN) — of everything actually harmful, what fraction got refused. For v1: precision = 92 / (92 + 35) = 92/127 ≈ 0.7244, recall = 92/100 = 0.92, and F1 = 2·P·R / (P + R) = 2(0.7244)(0.92) / (0.7244 + 0.92) ≈ 0.8106. For v2: precision = 89 / (89 + 6) = 89/95 ≈ 0.9368, recall = 89/100 = 0.89, F1 = 2(0.9368)(0.89) / (0.9368 + 0.89) ≈ 0.9128. (These figures were computed with a short script and checked twice, not estimated.) Adding one specific clause moved precision from 72.4% to 93.7% — a large drop in over-refusal — at the cost of recall falling from 92% to 89%, because the clarifying language, by narrowing what counts as "harmful," also nudged three genuinely borderline harmful prompts across the line into "allowed." Net effect, F1 rose from 81.1% to 91.3%. This is a real and recurring pattern in industry alignment work, sometimes discussed under the label "helpfulness tax": vague safety language produces a high false-positive rate (over-refusal of benign requests), and the standard fix is not to weaken the principle but to sharpen its boundary with specific carve-outs, accepting a small recall cost in exchange for a large precision gain. The technique of running the same eval set before and after changing exactly one principle, to isolate that principle's effect, is called principle ablation, and it is the primary tool a constitution designer has for defending a wording choice with evidence rather than intuition.

The Sparrow-style approach of writing 23 narrow rules is the extreme end of specificity: very high precision on the named categories, essentially zero recall on anything unnamed, and a maintenance burden that grows linearly with every new failure mode discovered after deployment. Anthropic's smaller set of broader principles sits closer to the general end: better unnamed-case coverage, but requiring a judge (increasingly, another instance of the model itself, trained through the self-critique process covered in the sibling chapter) capable enough to interpret "serious harm" sensibly across genuinely novel prompts. Neither extreme is correct in the abstract; the ablation methodology above is how a team decides, case by case, which principles in their own constitution need a specific clarifying clause and which are better left general.

Axis two: what happens when principles disagree

A constitution with more than one principle will eventually produce prompts where the principles point in different directions: a helpfulness principle wants to answer a question in full, a harm-avoidance principle wants to withhold part of the answer, and an honesty principle objects to silently omitting information without saying so. Three design patterns handle this, and a real constitution typically uses more than one of them at once.

Weighted blending. Score each candidate response against every principle (a preference model does this in practice, but for design purposes treat the scores as given), multiply each score by that principle's importance weight, and sum. This is simple and lets principles trade off smoothly against each other — a response that is slightly less honest but much more helpful can still win if helpfulness carries more weight. But pure blending has a serious failure mode: a catastrophic violation of one principle (say, providing dangerous synthesis instructions) can still be outvoted by a response that scores extremely well on every other principle, because a weighted sum has no way to represent "this one thing matters infinitely more than the others in this specific case."

Lexicographic priority (tiers). Rank principles into tiers and never let a lower tier's score compensate for a failure at a higher tier. Anthropic's published guidance for Claude follows this pattern in spirit — broad safety considerations sit above general ethical behaviour, which sits above task helpfulness — precisely so that no amount of helpfulness can buy back a safety violation.

Hard veto gates. The strictest version of a tier: certain principles (child safety, mass-casualty weapons) are not scored at all, only checked pass/fail, and a fail eliminates the candidate before any weighted comparison happens. This is standard practice in production systems, where a classifier-based safety filter runs before or alongside the main preference-scoring step specifically so that catastrophic categories cannot be "argued around" by a response that happens to score well elsewhere.

A well-designed constitution typically combines the last two: a small set of non-negotiable veto principles, and beneath that, a larger set of graded principles resolved by weighted comparison. The worked example below traces exactly this combination end to end, using the same style of arithmetic verification as the precision/recall figures above.

def check_veto(veto_flags, veto_principles):
    # Returns False if ANY veto principle is triggered for this response.
    return not any(veto_flags.get(p, False) for p in veto_principles)

def weighted_score(scores, weights):
    return sum(scores[k] * weights[k] for k in weights)

candidates = {
    'A': {'veto_flags': {}, 'scores': {'helpful': 9, 'harmless': 6, 'honest': 8}},
    'B': {'veto_flags': {}, 'scores': {'helpful': 10, 'harmless': 4, 'honest': 7}},
    'C': {'veto_flags': {'weapons_synthesis': True},
          'scores': {'helpful': 10, 'harmless': 9, 'honest': 9}},
}
weights = {'helpful': 0.5, 'harmless': 0.3, 'honest': 0.2}
veto_principles = ['weapons_synthesis', 'csae']

for name, c in candidates.items():
    passed = check_veto(c['veto_flags'], veto_principles)
    score = weighted_score(c['scores'], weights) if passed else float('-inf')
    print(name, 'passes veto:', passed, '| score:', score)

Tracing this by hand: candidate A has no veto flags, so it passes the gate, and its weighted score is 0.5(9) + 0.3(6) + 0.2(8) = 4.5 + 1.8 + 1.6 = 7.9. Candidate B also passes, scoring 0.5(10) + 0.3(4) + 0.2(7) = 5.0 + 1.2 + 1.4 = 7.6. Candidate C carries weapons_synthesis: True, so check_veto returns False, and its score is forced to negative infinity regardless of its underlying weighted total — which, if it had been allowed to compete, would have been 0.5(10) + 0.3(9) + 0.2(9) = 5.0 + 2.7 + 1.8 = 9.5, the highest of the three. Running the script prints exactly: A passes veto: True | score: 7.9, B passes veto: True | score: 7.6, C passes veto: False | score: -inf. Candidate A is selected, with a final score of 7.9 against B's 7.6 — even though, on pure helpfulness, B scored higher (10 vs 9), and even though C would have won outright under weighted blending alone. This is the entire point of the two-tier architecture: it makes "no weighted argument can buy back a veto-tier violation" a structural property of the scoring procedure rather than something the drafter has to hope the weights happen to enforce.

How the tiers fit together

Correcting a common misconception

Students who first meet Constitutional AI usually assume that a longer, more exhaustive list of specific rules is unambiguously safer than a shorter list of broad principles — more coverage should mean fewer gaps. The precision/recall exercise above shows why this is false as a general claim: it depends entirely on which failure mode costs more in a given deployment. Sparrow's 23 explicit rules give near-total precision on the categories they name and near-zero recall on anything outside them — a new jailbreak phrasing or a category nobody wrote a rule for slips straight through, because a rule-based system has no mechanism for generalising to a case it wasn't told about. A small number of broad principles, applied by a judge capable of contextual reasoning, generalises to unnamed cases far better, at the cost of being harder to audit and more prone to the over-refusal behaviour quantified in the v1/v2 example. The correct lesson is not "more rules are safer" or "fewer, broader principles are safer" in the abstract; it is that specificity and generality trade discoverable-case precision against novel-case recall, and the right point on that spectrum for any one principle is an empirical question, answered the way the ablation study above answered it — by measuring, not by assuming length equals safety.

Active recall

Attempt each question before reading its answer.

1. A constitution designer proposes deleting the veto tier entirely and folding weapons_synthesis into the weighted scorer as a fourth graded principle with weight 0.4 (rescaling the others to helpful=0.3, harmless=0.2, honest=0.1). Using candidate C's scores (helpful=10, harmless=9, honest=9) and giving it a "weapons_synthesis" score of 0 out of 10 (since it violates that principle), would C still be rejected relative to A's 7.9?
2. In the two-tier example, if the harmlessness weight is raised from 0.3 to 0.45 and the honesty weight is lowered from 0.2 to 0.05 (helpfulness unchanged at 0.5), recompute A's and B's scores. Does the winner change?
3. Using the v1/v2 confusion matrix table, suppose a v3 constitution is even more specific than v2 and achieves TP=80, FN=20, FP=2, TN=98. Compute its precision, recall, and F1, and explain in one sentence why F1 alone would mislead a team comparing v2 and v3.
4. Why can a purely lexicographic (tiered, no blending at all) constitution still produce inconsistent decisions between two very similar prompts, even though a hard veto tier cannot?
5. A team wants to add a new principle addressing a harm category discovered after deployment (say, AI-generated non-consensual intimate imagery). Using the design vocabulary from this chapter, which tier should it go in, and what evaluation would you run before shipping it?

Answers.

1. Weighted score for C becomes 0.3(10) + 0.2(9) + 0.1(9) + 0.4(0) = 3.0 + 1.8 + 0.9 + 0.0 = 5.7. That is below A's recomputed score under the same rescaled weights: 0.3(9) + 0.2(6) + 0.1(8) + 0.4(10, assume A scores a perfect 10 on weapons_synthesis since it has no such content) = 2.7 + 1.2 + 0.8 + 4.0 = 8.7. So C still loses, 5.7 vs 8.7 — but only because the designer manually set its violation score to 0 and gave the principle a large weight. The danger this reveals is exactly why a veto tier is preferred over folding catastrophic principles into the weighted sum: the outcome now depends on a specific, tunable numeric choice (weight 0.4, score 0) rather than being a structural guarantee. A different, less careful weighting (say weight 0.15 for the new principle) could let C win despite the violation, which is precisely the failure mode a hard veto is designed to make impossible.

2. A: 0.5(9) + 0.45(6) + 0.05(8) = 4.5 + 2.7 + 0.4 = 7.6. B: 0.5(10) + 0.45(4) + 0.05(7) = 5.0 + 1.8 + 0.35 = 7.15. A still wins, but the margin widens from 0.3 (7.9 vs 7.6) to 0.45 (7.6 vs 7.15). Increasing the weight on the principle where A already led (harmless: A=6 vs B=4) and shrinking the weight on the principle where A also led but by less (honest: A=8 vs B=7) both push in A's favour, so the reweighting increases A's margin of victory even though both candidates' raw scores fell.

3. Precision = 80/(80+2) = 80/82 ≈ 0.9756. Recall = 80/100 = 0.80. F1 = 2(0.9756)(0.80)/(0.9756+0.80) ≈ 0.8791, i.e. 87.9% — lower than v2's 91.3%. A team looking only at F1 would conclude v2 beats v3 and stop there, but F1 hides the shape of the trade-off: v3 has near-perfect precision (97.6%, better than v2's 93.7%) at the cost of missing one in five real threats (recall 80% vs v2's 89%). Whether v2 or v3 is the better choice depends on which error is more costly in the deployment context — a single aggregate number cannot answer that, only the full confusion matrix can.

4. A strict tier ordering only guarantees that a higher-tier principle can never be outvoted by a lower one; it says nothing about how consistently the tier-one judgment itself is applied. If the entity applying "avoid facilitating serious harm" is a language model exercising contextual judgment (as it must be for any principle general enough to cover unnamed cases), two prompts that are functionally identical but phrased differently can receive different judgments at that same tier, because the tier structure resolves conflicts between principles, not variance within the application of one principle. That residual inconsistency is exactly what the RLAIF training process (covered in the sibling chapter) is built to reduce, by training a model on many consistent examples of a principle being applied rather than relying on it being invoked correctly each time from scratch.

5. A genuinely catastrophic, clearly-defined harm category belongs in the veto tier, not the weighted tier, for the same structural reason candidate C was excluded outright rather than merely penalised: no amount of helpfulness or other positive scoring should be able to compensate for it. Before shipping, the team should run a principle-ablation evaluation exactly like the v1/v2 exercise: build a labelled eval set containing both genuine instances of the new harm category and adjacent benign prompts that share surface features with it (to catch over-refusal), measure precision/recall/F1 with the new veto rule active versus inactive, and check that the false-positive rate on the benign-adjacent set stays low enough that the new principle isn't quietly refusing large amounts of legitimate content.

Think About It

Think about this: How would you explain constitutional ai: principled ai alignment to a friend who has never seen a computer? What real-world analogy would you use? Imagine you had to build a system using these concepts — what would be your first step? Try this: before moving on, write down three things you learned and one question you still have.

Key Takeaways — Summary and Recap

Let us recap what we covered: the core ideas behind constitutional ai: principled ai alignment, how they connect to real-world applications, and why they matter for your journey in computer science. Remember these key points as you move forward. For competitive exam preparation (CBSE, JEE, BITSAT), focus on understanding the WHY behind each concept, not just the WHAT.