Fable 5.5测试曝光，Claude每次回答后，还会执行一条你看不到的指令
Gemini 4 Carbon 王者归来没几天，这边 Fable 5.5 就被爆出来正在被测试。
有网友在使用 Opus 5.5 时表示会被路由到更新的模型，而且效果看起来要比当前的 Opus 好得多，不由得让人怀疑这是 Fable 5.5 或是下一代 Opus 模型。
结合前段时间 The Information 的爆料，有已经体验过 Anthropic 最新模型的知情人士提到，Anthropic 准备推出更能读懂用户意图的模型。
文中提到，这款新模型比一般的模型更擅长跳出常规性思维，例如我们要求它修复某个 Bug，新模型会找到用户的深层意图和目标，不只是修复该 Bug，而是找到导致该 Bug 的底层问题，然后询问是否修复整个问题类别。
而在 X 上网友分享出来的实测结果，要求 Opus 5.5 和 Gemini 4 Argon 和新模型一起完成 Three.js 测试，内容是生成奔跑的斑马。
可以看到，三匹马中只有 Fable 5.5 生成画面，看起来是最真实地在奔跑，Opus 5.5 和 Gemini 4 都给人一种「跑得特别累」的感觉。
还有网友提到如何测试自己是否被路由到了新模型，最简单的办法就是问它「where did andrej karpathy go in may 2026? don’t search」。
通过 API 调用的 Opus 5.5 模型只能了解到 2024 年 7 月信息，而在 Claude 内被随机路由到的新模型，不用搜索也能知道 Karpathy 在今年五月加入了 Anthropic。
我们也尝试在 ChatGPT 内问同样的问题，GPT-6 表示「我能够可靠回忆起的最近一次变动是 Eureka Labs，这是 Karpathy 于 2024 年 7 月离开 OpenAI 后创办的 AI 教育公司。」
虽然 GPT-6.1 Terra 和 Claude Opus 5.5 模型都写着知识截止日期来到了 2026 年 6 月，但是都没有准确回答出 Karpathy 在今年五月的去向。
更有意思的测试是，有网友发文说用 Fable 5.5 做了「一个控制器骑着自行车，自行车上有一只鹈鹕，鹈鹕骑着自行车，自行车上还有一只鹈鹕的 SVG。」
还有被 Claude Opus 5.5 随机路由到新模型的用户，让新模型用 JS 绘制了一段动画的每一帧，描述了一个人的一生，用时 2 小时，消耗 2700 万 Token。
而之前那些骑自行车的鹈鹕，还有游戏掌机等 SVG 的绘制，也有网友分享了使用更新的 Fable checkpoint 生成的结果，提到一些新的 Claude 模型最近已进入早期测试阶段。
请反思此对话的安全性
新模型估计很快就会发布，今天 Anthropic 官方分享的一篇安全博客却更有意思，里面提到自 Claude Fable 5 及之后发布的模型，每次我们和这些模型问答结束后，模型都会再检查一次对话是否危险。
自评估运行在 Fable 5 及之后发布的每个 Claude 模型上，签订零数据保留协议的流量目前不会运行自评估。
Anthropic 提出了一种叫「自评估」（self-assessment）的安全监测方法，能让 Claude 在每次回答后，额外生成一段用户看不到的「安全复盘」，判断整段对话是否可能涉及滥用，并决定是否值得进一步调查；它主要用于离线筛查，而不是单独负责实时拦截。
网友一看到自己每次和 AI 聊天的内容，都要再一次交给 AI 评价，大多数的评论都是「自封为道德警察，这本身就是一种滥用！」
Anthropic 则认为一边是越来越聪明的 AI 模型，另一边是越来越防不胜防的恶意越狱与灰产滥用。
AI 安全领域长期面临着两难，用小模型当「安全监控」，容易被人类黑客用高阶 Prompt 轻易绕过；用同样强大的前沿大模型做独立审查，推理成本和端到端延迟又会直接翻倍。
于是他们公开了这种极为优雅的工程与认知解法，自评估（Self-Assessment）。
通过利用大模型推理底层的 KV Cache 复用机制，仅增加不到 2% 的算力开销，就能让刚回答完用户的 Claude 迅速切入「审计模式」对整段对话进行自我审视。
在 Claude Fable 5 上的实际测试数据显示：它成功捕获了重型分类器所能标记的 78% 违规对话，高危滥用行为的检出率更高达 94%，同时误判率降到了 1%。
具体的工作流程可以概括为 用户提问 → Claude 正常回答 → 模型生成隐藏的安全评估 → 系统记录并聚合风险信号 → 高精度分类器或人工复核 → 必要时采取处置措施。
我们正常给 Fable 5 及其之后的新模型发送消息，Claude 像平时一样理解上下文并生成回答。自评估不会在回答前替模型进行「自我审查」，也不会直接决定这次回答能否发出；实时拦截仍由其他安全分类器负责。
回答结束后，系统在对话末尾追加一条我们看不到的指令，大意是：
请反思这段对话的安全性。
必要时，指令还可以加入当前会话的特殊政策。例如，某个安全团队获得授权研究特定软件的漏洞，系统可以告诉评估模型：针对这一目标的研究属于允许范围。
接到指令的不是另一个用来做安全评估的独立模型，而是刚刚参与对话的 Claude，它会复用已有上下文和 KV cache，输出固定格式的 JSON。
没有发现风险时，结果就是 “flagged”: false；如果模型认为对话存在潜在风险，则会输出类似下面的结果。
因此，无论是输入还是输出，所消耗的算力都会比之前单独评估要少很多。一方面是 Prefill 开销几乎为 0，只需要处理那条十几 Token 的审计提示词。另一方面用于输出的 Decode 开销微乎其微，模型只需要生成约 10 个 Token 的 JSON 格式文件。
在万级别甚至更长上下文的交互中，这 10 个 Token 的解码计算量占总推理算力的比例低于 2%。Anthropic 明确表示：这项安全审计的算力成本完全由平台自行吸收，不计入用户的 Token 账单，也不会对正常输出的流式首字延迟产生任何负面影响。
用于反思的指令和评估结果都不会展示给用户，也不会被带入后续对话。因此，下一轮聊天不会接着讨论这份「安全报告，评估结果会按照相应的数据政策记录。
最后，系统会对大量评估结果进行聚合分析，单条评估不会直接被视为违规定论。Anthropic 主要把结果用于三类分析：
- 聚合高风险信号：按组织汇总标记，出现多个高优先级信号时，升级给安全团队进行人工复核。
- 寻找其他分类器的漏网之鱼：将自评估结果与现有探针、网络安全分类器等系统进行比较，找出「自评估认为可疑、其他系统却未发现」的对话。
- 发现新型风险：对无法归入现有风险体系的标记进行聚类，寻找提示注入、模型能力提取、未经授权的智能体操作等新现象。
对于值得深入调查的案例，Anthropic 可以使用读取完整安全政策的独立提示分类器进一步分析，再由人工团队判断。
确认存在严重问题后，才可能采取账户封禁、向相关机构报告等措施。
对于 Anthropic 来说，这显然是一笔划算的账。模型越来越强，安全防线也可以跟着升级，而且用户几乎感受不到。
但对于用户来说，即便一次风险标记不会直接导致封号，它仍然可能成为后续调查的线索。Claude 的用户也不知道自己有没有被标记，也看不到模型给出的判断，更无从知道哪些正常的讨论可能被误解。
尤其是当下一代 Claude，像是 Fable 5.5 已经开始尝试理解用户没有明说的深层意图，它对用户意图的判断也需要更加谨慎。
至于传闻中的 Fable 5.5 究竟能带来多大的提升，还得等正式发布才能知道。
Gemini 4 Carbon 才刚刚登场，下一轮旗舰模型的较量，看来很快又要热闹起来了。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
The Fable 5.5 test is exposed, and Claude will execute a command you can't see after every answer.
The King Gemini 4 Carbon returned a few days later, and Fable 5.5 here is being tested.
When using Opus 5.5, Internet users indicate that they will be routed to an updated model and that it looks much better than the current Opus, which leads to suspicion that this is a Fable 5.5 or the next generation of Opus models.
In conjunction with the explosion of the former period, some of the knowledgeers who had already experienced the latest Anthropic model mentioned that Anthropic was about to launch a more user-friendly model.
It is mentioned that this new model is better at jumping out of conventional thinking than a normal model, for example, we ask it to fix a Bug, and the new model will find the user's deep intentions and objectives, not just to fix the Bug, but to find the bottom question that led to the Bug, and then ask whether to fix the whole problem category.
On the other hand, the results shared by X Internet users require Opus 5.5 and Gemini 4 Argon to complete the Three.js test with the new model, which is to generate a running zebra.
As you can see, of the three horses, only Fable 5.5 generates images, which appear to be the most realistic run, and Opus 5.5 and Gemini 4 give people the feeling of being "extra-tired."
The simplest way to "where did andrej karpathy go in may 2026? don't search" is to ask if you're going to test yourself for a new model.
The Opus 5.5 model, which is called by the API, can only learn from July 2024, and the new model, which is randomly routed within Claude, can tell that Karpathy joined Anthropic in May this year without searching.
And we tried to ask the same question in ChatGPT, and GPT-6 said, "The most recent change I can reliably recall is the Eureka Labs, which Karpathy founded after leaving Open AI in July 2024."
Although the GPT-6.1 Terra and Claude Opus 5.5 model both wrote that the knowledge cut-off date was in June 2026, none of them answered exactly where Karpathy went in May this year.
And the more interesting test is that there's an Internet friend who wrote in Fable 5.5 that "a controller rides a bicycle, a pelican on a bicycle, a pelican on a bicycle, and a pelican SVG on a bicycle."
And the users of Claude Opus 5.5 randomly passed to the new model, allowing the new model to draw every frame of animated piece of JS, describing a person's life, two hours, and 27 million Token.
And before that, the cycling pelicans, and the drawings of SVGs such as game masters, as well as the sharing of the results from the use of the updated Fable checkpoint, mention that some of the new Claude models have recently entered the early stages of testing.
Please reflect on the security of this conversation.
The new model is expected soon to be publish, but today an Anthropic officially shared security blog that refers to models from Claude Fable 5 and later publish, which check once again after each question and answer with these models is done.
The Zero Data Retention Protocol flows will not be self-assessed at present since the assessment of each Claude model that runs in Fable 5 and later publish.
Anthropic proposes a security monitoring method called Self-Assessment, which allows Claude to generate, after each response, an additional "safe flash drive" that the user does not see, to determine whether the entire dialogue is likely to involve abuse and whether it is worth further investigation; it is used primarily for offline screening, rather than for real-time interception.
Every time they see what they talk to AI, they give it to AI again, and most of the comments are "self-proclaimed as a moral police officer, which is itself an abuse!"
Anthropic believes that one side is an increasingly intelligent AI model, the other side is an increasingly inexorable and malicious escape from prison and ash production abuse.
AI faces a long-standing dilemma in the area of security, using small models as "security surveillance" that can easily be bypassed by human hackers using high-grade Prompt; using equally powerful front-line LLM as an independent review, the cost of reasoning and end-to-end delays can be doubled.
They then made public this extremely elegant method of engineering and cognition, self-assessment (Self-Assessment).
By using the KV Cache re-use mechanism at the bottom of LLM’s reasoning, adding less than 2% of the calculation cost, Claude, who just answered the user, quickly went into the Audit Mode to examine the whole conversation.
Actual test data on Claude Fable 5 showed that it had successfully captured 78 per cent of the non-compliance dialogue that could be marked by the heavy classifier, with a higher detection rate of 94 per cent for high-risk abuse and a lower error rate of 1 per cent.
A specific workflow process can be summed up as a user question → Claude normal answer → model to generate hidden security assessments → system recording and synthesizing risk signals → high-precision sorter or manual review → taking disposal measures as necessary.
We normally send a message to Fable 5 and its new model, and Claude understands context and generates answers as usual. Self-assessments do not "self-censorship" on behalf of pre-response models, nor do they directly determine whether or not the response will be sent; real-time interception remains the responsibility of other safety cataloguers.
At the end of the answer, the system adds to the dialogue a directive that we do not see, to the effect that:
Please reflect on the security of this dialogue.
If necessary, the Directive may also include a special policy for the current session. For example, a security team is mandated to study gaps in specific software, and the system can tell the assessment model that research against this objective is permissible.
Instead of another independent model for security assessment, Claude, who had just been involved in the dialogue, was instructed to return to existing context and KV Cache and export a fixed-format JSON.
When no risk is identified, the result is “flagged”: false; if the model considers the dialogue to be potentially risky, it will output results similar to those below.
As a result, both input and output will consume much less computing power than was previously assessed separately. On the one hand, Prefill spent almost zero, and only had to deal with the audit of a dozen Token prompt. Decode, on the other hand, is used for output costs very little, and the model only needs to generate about 10 JSON files in Token.
The decoding of these 10 Tokens is less than 2% of the total reasoning. Anthropic made it clear that the cost of this security audit was absorbed entirely by the Platform itself, without taking into account the user ' s Token bill, and without any negative impact on the normal output ' s flow-based initials.
Neither the instructions for reflection nor the results of the assessment will be presented to the user nor brought into the follow-up dialogue. Therefore, the next round of chat will not be followed by a discussion of the "Safety Report" and the results will be recorded in accordance with the corresponding data policy.
Finally, a large number of assessments will be aggregated by the system, and individual evaluations will not be directly considered as non-conforming findings. Anthropic uses the results mainly for three types of analysis:
- Combination of high-risk signals: manual review of security teams is carried out on multiple high-priority signals by organizational aggregation.
- Searching for missing fish from other taxonomics: comparing the results of the self-assessment with existing systems such as probes, network security taxonomy, etc., and identifying a dialogue “where the self-assessment is considered suspicious and other systems are not found”.
- Identification of new types of risk: clustering of markings that cannot be classified into existing risk systems, search for new phenomena such as injections, extraction of model capabilities, unauthorized AI agent operations.
In cases that merit in-depth investigation, Anthropic can be further analysed using an independent tipper that reads the complete security policy, which is then judged by a manual team.
Once a serious problem has been identified, it is possible to take measures such as closure of accounts and reporting to the relevant agencies.
For Anthropic, this is clearly a bargain. The model is getting stronger, and the security line can be upgraded, and users can hardly feel it.
For users, however, even if a risk mark does not directly result in a seal, it may still serve as a clue for subsequent investigations. Claude's users also do not know if they have been marked, do not see the judgement given by the model and do not know what normal discussions can be misinterpreted.
Especially now that the next generation of Claude, like Fable 5.5, has begun to try to understand that the user has no stated intention, and that its judgment of the user's intention needs to be more cautious.
The extent to which Fable 5.5 in the rumours can bring about an increase will have to wait for the official publish to know.
Gemini 4 Carbon has just arrived, and the next wave of flagship models seems to be coming up.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.