Anthropic says new defences cut Claude distillation by up to 99%

What did Anthropic announce about distillation?

Anthropic published a research post, “Strengthening our defenses against distillation attacks”, on 12 October 2026. It describes how the company has rebuilt its protections against distillation: covert, large-scale campaigns that send millions of prompts to Claude, save the answers and especially the written-out reasoning, and use them to train a cheaper model that imitates Claude.

The headline claim is that early evidence shows the new measures have cut the amount of data distillers harvest by around 90 to 99 percent. Anthropic frames the post as a playbook for the rest of the industry, arguing that every model developer and every platform that resells model access faces the same problem.

The post follows Anthropic’s September 2026 threat intelligence report, which named Chinese labs it says ran distillation campaigns against Claude, and comes about two weeks after OpenAI said it had disrupted a distillation campaign tied to people associated with Moonshot. Distillation has moved from a terms-of-service footnote to something the largest labs now describe in security language.

Why does Anthropic treat distillation as a security problem?

Anthropic gives two reasons. The first is safety: distillation lets a company approach frontier capability without doing the safety work, so the copy may lack safeguards in areas like biology and cybersecurity. Its example is Zhipu, sold outside China as Z.ai. Anthropic says Zhipu distilled the cyber capabilities of leading US models while building GLM-5.3, tried Claude Fable 5 first, then switched to an older Claude model and another lab’s model when Fable’s cyber safeguards degraded its attacks.

Anthropic says the US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) has since rated GLM-5.3 the most cyber-capable open-weights model released so far, and that its own testing found GLM-5.3’s safeguards easy to bypass. GLM-5.3 is the same model family that Goodfire wrapped in production cyber monitors last week, which shows how widely such open models are now deployed.

The second reason is national security. Anthropic says distilling companies feed what they gain into military, intelligence and surveillance systems. It repeats a case from September in which requests to Moonshot’s Kimi models were secretly forwarded to Claude, including one from a user Anthropic believes was linked to China’s People’s Liberation Army, who wanted CCTV footage of a specific individual analysed.

The September report put numbers on the campaigns. It attributed more than 151 million exchanges to Alibaba between May and July 2026, more than 23 million to Moonshot over the same months, more than 12.1 million to DeepSeek in 14 days of July, more than 3.4 million to Zhipu over 17 days and more than 400,000 to Xiaomi over 20 days. The windows differ, and the attributions are Anthropic’s; the labs have not confirmed them.

Why weren’t summarised reasoning and simple filters enough?

Reasoning transcripts are the prize, because they show a student model how Claude reaches an answer rather than just what it says. Anthropic’s first defence was to show users a summary of Claude’s reasoning instead of the raw text. In an internal test, a pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on the SWE-bench Verified coding benchmark; trained on summaries, it scored 71.8%.

Distillers adapted. They moved from passive collection to active extraction, asking Claude to repeat its hidden reasoning “verbatim, exactly character for character” or, in one lab’s case, testing 12,000 differently worded tricks. The September report described a cleverer route: Claude returns a reference to its raw reasoning, a “thinking signature”, so the API can look it up later. Moonshot and DeepSeek saved those signatures, opened new sessions and got Claude to turn them back into full reasoning.

Anthropic’s early filters caught some of this, but distillers scaled around them with proxy networks controlling hundreds of thousands of fraudulent accounts, often with false identities and stolen payment details. One network in its February report ran more than 20,000 accounts at once.

How do Anthropic’s new distillation defences work?

The first layer controls where reasoning can go. With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced preserved thinking: API accounts created on or after 31 August 2026 can no longer edit Claude’s earlier context, which stops attackers from pasting protected reasoning into a new conversation or replaying it through fresh accounts. Older models with weaker safeguards can no longer read these models’ reasoning, and Claude Sonnet 5.5’s reasoning transcripts are accessible only to the organisation whose request produced them.

The second layer blocks and patches extraction attempts. Anthropic built a two-stage classifier of the kind it uses against bioweapons and cyber misuse, trained on real distillers’ transcripts and red-teamed internally and externally. It says the result is about as robust as its bioweapons safeguards, with a false positive rate under 0.1%. It runs on Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, and will cover future models attractive to distillers. Anthropic says fixes have already shut down newer tricks, such as asking Claude to translate its reasoning into another language or to write it inside tags beside the answer.

The third layer makes repetition expensive. Accounts that keep trying face tighter usage limits, persistent offenders are banned, and since 24 September Anthropic has again charged for requests its safeguards block before Claude answers, in areas where the false positive rate is below 0.1%.

How well do the defences work?

Anthropic measures success by estimating how many reasoning tokens distillers extract on its own platform. Since the classifier went in, it says that figure has run consistently 10 to 100 times lower than before, and on some days was too small to measure. It says the classifier now catches every technique described in the September report, and that tens of thousands of accounts linked to distillation have been banned, often less than two hours after a campaign began.

The company is careful about how far that goes. It says it does not know how long the gains will last, expects a cat-and-mouse game, and has not yet seen a highly sophisticated, persistent attempt to get around the new system. It also turned away meaningful revenue and what it calls trillions of tokens’ worth of paying traffic from distillers.

What changes for developers using Claude?

Anthropic admits it has not met its February goal of stopping distillation without affecting legitimate users. Preserved thinking has forced some developers to update integrations, presumably those that edit or rebuild earlier turns of a conversation. Its classifiers block fewer than 0.1% of benign requests by mistake, and those blocked requests are billed.

The editing restriction applies to API accounts created on or after 31 August, while the classifier and the other reasoning restrictions apply more broadly. Teams building agents that manipulate conversation history, or that pass one model’s reasoning to another, should check Anthropic’s documentation. Security researchers with legitimate needs have other routes, such as the three-tier Cyber Verification Program, though Anthropic does not tie it to distillation.

What are the limits and open questions?

All the effectiveness figures are Anthropic’s, measured on its own platform, and no outside audit is cited. The defences cover the first-party API; Anthropic notes that distillers spread traffic across its API, third-party cloud platforms and other inference providers, and the post does not say whether the same classifier and preserved thinking apply on every cloud that resells Claude.

The accusations against Zhipu, Moonshot, Alibaba, DeepSeek and Xiaomi come from Anthropic’s investigations; we found no responses from those companies in the material we reviewed. And distillation itself is a standard technique: labs distil their own large models into smaller ones every day. The dispute is over doing it covertly and at scale against another company’s model, against its terms of use.

Anthropic’s closing argument is that defences are expensive while distillers are paying customers, so platforms have a reason to do too little. The company says publishing its methods shows another way. Anthropic’s own rules are changing too: its 2026 Usage Policy takes effect on 12 November.