Anthropic says new defenses cut Claude distillation by up to 99%

Every frontier lab has the same quiet problem. You spend billions to train a model, you open an API so people can pay to use it, and some of those paying customers are not customers at all. They are rival labs running fraudulent accounts at industrial scale, collecting millions of answers so they can teach their own cheaper model to behave like yours. This is called a distillation attack, and on October 12, 2026 Anthropic published its most detailed account yet of how it is fighting back.

The headline number: according to Anthropic's own early estimate, its new defenses have reduced the amount of data harvested by distillers by around 90 to 99 percent. Put differently, the number of Claude reasoning tokens that distillers manage to extract on Anthropic's platform is now 10 to 100 times lower than before the measures went live. On some days it was too small to measure. The full write up is on the Anthropic research blog under the title Strengthening our defenses against distillation attacks.

Below is what distillation really is, why reasoning transcripts are the prize, how the three new defense layers work, what Anthropic says about Zhipu and Moonshot, and what the trade-offs mean for ordinary developers who build on Claude.

What a distillation attack actually is

Distillation itself is a normal machine learning technique. A large "teacher" model produces answers, and a smaller "student" model is trained to copy them. Labs do this all the time with their own models to ship faster and cheaper versions.

The attack version does the same thing without permission. Anthropic describes it as covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another. The tools are mundane: networks of fraudulent accounts, stolen payment details, false identities and proxy services that resell Claude access in regions where Anthropic does not offer it. The payoff is huge. A lab that distills a frontier model can get close to frontier capability in a fraction of the time and for a fraction of the cost.

Anthropic gives two reasons it cares beyond lost revenue. First, distilled models often reach the market without matching safeguards. If a copycat inherits the cyber or biology skills of a frontier model but not its refusals, the dangerous parts travel and the protective parts stay behind. Second, Anthropic frames distillation as a national security issue, because, in its account, some of the companies doing it feed the gained capabilities into military, intelligence and surveillance systems.

Why reasoning is the real prize

A model's final answer is useful to a distiller. Its reasoning is far more useful. Modern Claude models write out a thinking process before they answer, and that chain of thought shows the student model how to get to an answer, not just what the answer is.

Anthropic measured this directly. It took a pretrained Claude model and trained it on transcripts from Claude Opus 4.8. Trained on the full reasoning, the student scored 80.4 percent on the SWE-bench Verified coding benchmark. Trained on transcripts where the reasoning had been summarized, it scored 71.8 percent. That 8.6 point gap is the whole game. It explains why Anthropic's defenses focus almost entirely on making Claude's raw reasoning harder to reach.

Simple defenses did not hold

The first line of defense was simple. Anthropic had Claude summarize its reasoning before showing it to users. That blunted passive distillation, where attackers just send normal looking requests and train on whatever comes back.

Attackers then moved to active extraction. The tactics ranged from blunt instructions such as asking Claude to output its prior reasoning verbatim, character for character, to elaborate campaigns. Anthropic says one lab tested 12,000 requests, each trying to trick Claude in a different way. Because ordinary users almost never ask a model to dump its hidden reasoning, these requests are detectable in principle. In practice, Anthropic admits its first detectors were not good enough.

Distillers found ways around them and then scaled. They built proxy networks controlling hundreds of thousands of fraudulent accounts, so that a ban on one account barely slowed the campaign. In a report earlier this year, Anthropic described a single network that ran more than 20,000 fraudulent accounts at once. That persistence is what pushed the company to build heavier machinery.

The three new layers

Anthropic now attacks the problem in three separate ways.

1. Controlling where reasoning can go. Distillers had learned to move protected reasoning blocks between conversations, to make Claude believe the user already had the full reasoning and could safely see it again. They also moved reasoning between models, using an older model with weaker safeguards to read a newer model's thinking, and between accounts, using proxy networks to keep trying after a ban. Anthropic's answer is preserved thinking, introduced with Claude Fable 5.1 and Claude Opus 5.5. API accounts created on or after August 31, 2026 can no longer edit Claude's prior context. The new models' reasoning can also no longer be read by earlier models with weaker protections. With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.

2. Blocking and patching extraction attempts. Anthropic built a two-stage classifier in the style of its constitutional classifiers research, the same family of safeguards it uses to stop Claude from helping with bioweapons or serious cyberattacks. It trained and tested the system on real transcripts of distillers' extraction attempts, ran internal and external red teaming, and fixed what the red teamers broke. The company says the result is now roughly as robust as its bioweapon safeguards, with a false positive rate below 0.1 percent. The classifier runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1, and Anthropic plans to put it on future models that would be attractive targets. When a new trick shows up, it gets patched. Examples Anthropic already closed include asking Claude to translate its earlier reasoning into another language or to write it out inside tags next to the answer.

3. Making repeated attempts difficult. Accounts that keep trying to extract reasoning hit stricter usage limits. Persistent ones get banned, often in less than two hours after a campaign begins. Anthropic says it has banned tens of thousands of accounts linked to distillation. And since September 24, it has resumed charging for requests that its safeguards block before Claude responds, but only in areas where the false positive rate is under 0.1 percent, distillation included. That turns every failed extraction attempt into a cost for the attacker.

The Zhipu and Moonshot examples

Anthropic is unusually direct about who it thinks is doing this. It says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3. According to the post, Zhipu first tried to distill Claude Fable 5, found that Claude's cyber safeguards degraded its attacks, and switched to an older Claude model and another lab's model. Anthropic adds that the US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) has assessed GLM-5.3 as the most cyber-capable open-weights model released so far, and that its own research found GLM-5.3's safeguards easy to bypass, with the model willing to build security exploits end to end.

The second example involves Moonshot's Kimi models. Anthropic says it previously reported a case where requests sent to Kimi were secretly forwarded to Claude as part of a distillation effort. One of those requests, from a user Anthropic believes was affiliated with China's People's Liberation Army, asked for help analyzing CCTV surveillance footage of a specific person.

These are Anthropic's claims about competitors, and neither company's response is part of the post. Still, they show why the company treats the topic as more than a pricing fight: in its view, distillation is how dangerous capabilities escape the safeguards that were built around them.

What it achieved

Anthropic measures success by estimating how many tokens of Claude's reasoning distillers have extracted from its own platform. After the classifier went live, that number has been consistently 10 to 100 times lower, on top of the gains from preserved thinking. The company says its two-stage classifier now catches all of the distillation techniques described in its September report, on its most capable generally available models.

It also paid for those results. Anthropic says it has turned away meaningful revenue and trillions of tokens' worth of paying traffic from distillers. That is a notable admission in a market where every lab is fighting for API share.

What we still do not know

There are clear limits to the evidence, and independent coverage such as Ground Truth's analysis has pointed them out.

• The 90 to 99 percent figure is Anthropic's own estimate on Anthropic's own platform. The post does not publish absolute token counts, the baseline period or the classification method, so outsiders cannot reproduce it.
• It measures what Anthropic detects. Extraction that slips past the classifier unnoticed is, by definition, not in the chart.
• It does not cover Claude traffic on third-party clouds and inference providers, where Anthropic says distillers also spread their requests.
• Anthropic itself says it has not yet seen a highly sophisticated and persistent attempt to get around the new system, and expects the cat and mouse game to continue.

So the honest reading is: a big, credible drop in observed extraction, with real uncertainty about attackers nobody has seen yet.

Why it matters

For the AI industry, this is a template. Anthropic is publishing its methods on purpose, arguing that distillation is a problem every developer and every platform has to confront. Its defenses lose value if attackers can simply turn to a similarly capable model with weaker protections. That is a direct message to other labs, and to cloud platforms that host frontier models: detect abuse faster, offboard fraudulent accounts, and accept that illicit distillers are still paying customers you will have to turn away.

For developers, there are concrete side effects. Preserved thinking forced some teams to update integrations that edited prior context. The classifier will, in under 0.1 percent of cases, block a benign request, and that blocked request is now billed. Reasoning from Sonnet 5.5 is locked to the organization that created it, which matters for multi-tenant tools and for anyone who moves transcripts between systems. Anthropic openly says it has not fully met its February goal of making distillation harder without touching legitimate users.

For the open model race, it raises the cost of catching up by copying. If the strongest reasoning is harder to harvest, labs that relied on distillation have to spend more on their own training, or accept a bigger gap to the frontier.

Dany's take

This is the least flashy and maybe most important kind of AI security news. Everyone talks about jailbreaks. Far fewer people talk about the fact that the safety work built into one model can be stripped off simply by copying its brain into another one. Anthropic's numbers look strong, and the SWE-bench experiment is a clean way to show why reasoning is the crown jewel. But a 99 percent drop measured only by the defender, with no public baseline, is a claim to watch, not a closed case. The part I respect most is the honesty about trade-offs: billing for blocked requests and locking down context will annoy some developers, and Anthropic says so. If other labs and cloud platforms do not follow, distillers will just walk to the weakest door.

Bottom line

Anthropic says its layered defenses, preserved thinking, a red teamed two-stage classifier with under 0.1 percent false positives, and fast bans plus billing for blocked requests, have cut the reasoning that distillers extract from Claude by roughly 90 to 99 percent. The company names Zhipu's GLM-5.3 and a Moonshot Kimi forwarding scheme as examples of why it cares, admits the measures cost both revenue and some developer convenience, and calls on the rest of the industry to close the same doors.

Primary source: Anthropic, Strengthening our defenses against distillation attacks. Independent analysis: Ground Truth on the reported fall in extracted reasoning.