Anthropic's rerouting system has two stages: a cheap first-stage classifier (~0.05% compute) that watches which expert pathways activate in the model, and an expensive second-stage classifier (27–80% extra compute) that only fires when the first flags a request. The result: jailbreak pass rates dropped from 95% to under 0.5%.