Anthropic said new anti-distillation defenses have reduced the amount of Claude reasoning data harvested by attackers by approximately 90% to 99%.
The company described distillation attacks as covert, industrial-scale efforts to extract the capabilities of a frontier model and reproduce them in another model without authorization from the original developer.
Anthropic said these attacks are often carried out through networks of fraudulent accounts and can allow other AI developers to replicate advanced capabilities at a fraction of the time and cost required to build them independently.
The company said one of its biggest concerns is that distillation can produce powerful models without equivalent safeguards, potentially increasing risks in areas such as cybersecurity and biology.
Anthropic cited Zhipu’s development of GLM-5.3 as one example, saying the company attempted to distill cyber capabilities from Claude before switching to an older Claude model and another lab’s system after newer safeguards degraded its attacks.
Anthropic also said illicitly distilled models could create national security risks if extracted capabilities are incorporated into foreign military, intelligence, or surveillance systems.
The company said it has turned away meaningful revenue and trillions of tokens of paying traffic associated with distillation activity while investing significant engineering and product resources into stronger defenses.
Anthropic’s anti-distillation strategy focuses heavily on limiting access to Claude’s hidden reasoning, which the company said is especially valuable for training smaller models to imitate frontier capabilities.
One early defense involved summarizing Claude’s reasoning before exposing it to users.
In Anthropic’s testing, a model trained on full Claude Opus 4.8 reasoning transcripts achieved 80.4% on SWE-bench Verified, compared with 71.8% when trained only on summarized reasoning transcripts. Strengthening our defenses agai…
Attackers subsequently shifted toward active extraction techniques designed to make Claude reveal its full reasoning.
Anthropic said some groups tested thousands of different prompts intended to bypass those protections, while others built proxy networks containing hundreds of thousands of fraudulent accounts.
The company said one previously identified network controlled more than 20,000 fraudulent accounts at the same time.
Anthropic has now expanded its defenses across three major areas.
First, the company introduced controls that restrict where reasoning transcripts can be moved or accessed.
With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced a feature it calls preserved thinking, which prevents new API accounts created on or after August 31, 2026 from editing Claude’s prior context.
The company also prevents reasoning generated by newer models from being read by older models with weaker protections.
With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request generated them.
Second, Anthropic built a two-stage classifier system designed to identify attempts to extract Claude’s reasoning.
The company said it used both internal and external red-teaming to test the system and patch vulnerabilities.
Anthropic said the resulting defenses are now roughly as robust as its safeguards for harmful biological requests and have a false-positive rate below 0.1%.
The classifier currently runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1, with plans to extend it to future models that may become attractive targets for distillation.
Third, Anthropic has made repeated extraction attempts more difficult by tightening usage limits and banning accounts associated with persistent distillation activity.
The company also resumed charging for blocked requests in certain categories, including distillation, where its classifiers have false-positive rates below 0.1%.
Anthropic said its new safeguards catch all of the distillation techniques described in its September report.
After deployment of the new classifier, the number of Claude reasoning tokens extracted by distillers on Anthropic’s platform fell by a factor of 10 to more than 100.
The company said it has also banned tens of thousands of accounts associated with distillation, often within two hours of the start of an attack campaign. Strengthening our defenses agai…
Anthropic acknowledged that the protections come with trade-offs.
Some developers have had to update integrations because of preserved thinking, legitimate requests can occasionally be blocked, and users may now be charged for requests rejected by the system.
The company also cautioned that distillation remains an ongoing cat-and-mouse problem and said attackers are likely to continue searching for new methods to bypass safeguards.
Anthropic is publishing details of its approach in an effort to encourage other frontier AI developers and cloud platforms to strengthen their own anti-distillation measures.
The company argued that model developers, inference providers, and third-party platforms all have a role to play in detecting abuse and shutting down fraudulent accounts.
KEY QUOTES:
“In recent months, we’ve made substantial progress on reducing the effectiveness of distillation attacks on Claude using new methods. Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%.”
“Distillation is a problem that every model developer faces and must confront. We hope this post helps developers and platforms better understand how they can prevent these attacks, what the trade-offs with these measures might be, and why the costs are worth bearing.”
“We don’t yet know how long these gains will last. We expect that distillation will remain a cat-and-mouse game, and that we’ll need to continue iterating on our defenses over time.”
Anthropic statement
