Anthropic tightens defenses to curb industrial-scale model distillation

On October 12, 2026, Anthropic published a detailed account of new measures it has deployed to reduce the effectiveness of distillation attacks against its Claude family of models. The company reports early evidence that these changes have cut the amount of data distillers harvested on Anthropic’s platform by roughly 90–99%, and that reasoning tokens extractable from Claude have fallen by a factor of about 10–100.

What distillation attacks are and why they matter

Distillation attacks are covert, industrial-scale campaigns that aim to extract a model’s capabilities—most valuably its internal reasoning transcripts—and use those outputs to train smaller models to mimic the original. These campaigns are commonly run through networks of fraudulent accounts. Anthropic highlights two primary concerns:

• Safety: distilled models frequently lack the proportionate safeguards of the original frontier models and therefore can be used to cause significant harm in domains like biology and cybersecurity. Anthropic cites Zhipu’s use of distillation during GLM-5.3 development to capture cyber capabilities from leading U.S. models; the U.S. Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) assessed GLM-5.3 as the most cyber-capable open-weights model released to date. Anthropic’s own research found GLM-5.3’s safeguards easy to bypass and the model capable of end-to-end exploit development.
• National security: illicitly distilled models are being integrated into foreign military, intelligence, and surveillance systems. Anthropic previously reported a case where requests to Moonshot’s Kimi models were secretly forwarded to Claude for distillation purposes; one request—believed to be affiliated with China’s People’s Liberation Army—sought analysis of CCTV surveillance for a specific individual.

Why simple defenses were insufficient

The most useful data for distillers is the model’s step-by-step reasoning, which helps a distilled model reproduce not just outputs but the process of arriving at those outputs. Anthropic initially tried simpler countermeasures: for example, it displayed summarized reasoning to users instead of full transcripts. Internal tests showed that training a model on summarized reasoning reduced its SWE-bench Verified performance to 71.8% versus 80.4% when trained on full transcripts.

However, distillers adapted. They shifted from passive scraping to active extraction tactics—prompting Claude to reveal hidden reasoning verbatim with carefully crafted inputs. Some labs tested thousands of variant prompts (one tested 12,000 different requests). Attackers also scaled via proxy networks that managed hundreds of thousands of fraudulent accounts, resold access in restricted regions, and used stolen payment details; Anthropic previously documented networks controlling more than 20,000 fraudulent accounts at once. The scale and persistence of these campaigns required more sophisticated defenses.

Anthropic’s new three-pronged approach

Anthropic says it now disrupts distillation attacks in three main ways while aiming to minimize impact on legitimate users:

1. Controlling where reasoning can go ("preserved thinking")

• Distillers have tried to move protected reasoning blocks between conversations, between models, and between accounts to trick systems into revealing unsummarized reasoning.
• For Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced "preserved thinking," which prevents new API accounts (those created on or after August 31, 2026) from editing Claude’s prior context. This reduces the ability of proxy networks to repeatedly attempt extraction.
• The company also prevented earlier, weaker models from reading the reasoning of stronger models, and for Claude Sonnet 5.5 made reasoning transcripts accessible only to the organization that made the original request.

2. Blocking and patching extraction attempts

• Anthropic built a two-stage classifier system (similar in approach to its previously described constitutional classifiers). They trained and stress‑tested the classifier using transcripts of distillers’ extraction attempts, and ran both internal and external red‑teaming to find and fix weaknesses.
• The resulting safeguards are intended to be roughly as robust as those that prevent Claude from assisting in bioweapon or cyberattack construction. Anthropic reports a false positive rate below 0.1%.
• This classifier is run on Anthropic’s most capable generally available models (currently Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1) and will be applied to future attractive targets for distillers.
• The system is continuously updated to address new evasion techniques, for example requests that ask Claude to translate its prior reasoning or to reformat it alongside answers.

3. Making repeated attempts difficult

• Anthropic detects accounts used for repeated extraction attempts, applies stricter usage limits to such accounts, and bans accounts involved in persistent distillation campaigns.
• Since September 24, 2026, Anthropic resumed charging for requests that are blocked by safeguards in areas (including distillation) where the classifier’s false positive rate is <0.1%. Charging for blocked requests raises the cost of evasion for distillers who are paying customers.

Effectiveness so far and limitations

• Anthropic reports that the new defenses reliably stop many more distillation attempts: on their most capable generally available models the two-stage classifier now detects the techniques described in their September report.
• Measured on Anthropic’s platform, the number of reasoning tokens that distillers extracted dropped by a factor of 10–100 after the classifier was introduced. On some days the extractable token volume was too small to measure.
• The company has banned tens of thousands of accounts linked to distillation, often within two hours of campaign start.
• Anthropic cautions that this is an ongoing arms race: they expect attackers to probe for new bypasses and plan continued iteration. They also acknowledge trade-offs: preserved thinking required some developers to update integrations, classifiers can (in <0.1% of cases) block benign requests, and users are now charged for blocked requests.

Broader implications and a call to action

Anthropic emphasizes that distillation is an industry-wide problem requiring cooperation from other frontier model developers and from platforms. Distillers route traffic across Anthropic’s API, third-party cloud platforms, and other inference providers, so platforms can materially slow distillation by rapidly detecting and disrupting abuse and offboarding fraudulent accounts.

Anthropic says it has refused meaningful revenue and trillions of tokens’ worth of paying traffic from distillers and has published its methods to demonstrate that effective defenses are feasible. The company argues that, despite costs and trade-offs, preventing illicit distillation is necessary for safety and national security, and that the industry should adopt similar measures rather than leaving protection to market incentives alone.