Anthropic says new defenses cut the Claude reasoning harvested by distillers by about 90 to 99 percent
Confirmed
The takeaway
On Oct 12, 2026 Anthropic published “Strengthening our defenses against distillation attacks”.
Status
- Claim
Confirmed
- Our reporting
- High confidence
- Importance
- 3 of 5
- Last verified
- 13 October 2026
Your AI and this story
- GPT-6 Astra165 days after its cutoff
- Claude Opus 5.5104 days after its cutoff
- Gemini 3.8 Flash195 days after its cutoff
- Grok 4.7134 days after its cutoff
None of these four assistants can know about it. The closest, Claude Opus 5.5, stops 104 days before it.
Key facts
- Headline claim: ‘Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99 percent’; after the classifier, extracted reasoning tokens are ‘consistently 10 to 100 times lower’, and on some days ‘too small to measure’
- Why reasoning is the target: a pretrained Claude model trained on Claude Opus 4.8 transcripts reached 80.4% on SWE-bench Verified with full reasoning and 71.8% with summarized reasoning
- Layer 1, controlling where reasoning can go: ‘preserved thinking’ (introduced with Claude Fable 5.1 and Opus 5.5) stops API accounts created on or after Aug 31, 2026 from editing Claude’s prior context; earlier models with weaker safeguards cannot read these models’ reasoning; with Sonnet 5.5, reasoning transcripts are readable only by the organization whose request produced them
- Layer 2, a two-stage classifier of the constitutional-classifier kind, red-teamed internally and externally: ‘roughly as robust as those that prevent Claude from helping build bioweapons’, false positive rate below 0.1%; it runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1
- Layer 3, making repeated attempts hard: stricter usage limits, bans, and ‘since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds’ in areas with a <0.1% false positive rate, including distillation
- Enforcement: ‘tens of thousands of accounts’ banned, ‘often in less than two hours’ after a campaign starts; Anthropic says it turned away ‘meaningful revenue and trillions of tokens’ worth of paying traffic from distillers’
- Attack history given: distillers moved from passive collection to active extraction (one lab tested 12,000 different trick requests) and built proxy networks controlling ‘hundreds of thousands of fraudulent accounts’; patched tricks include asking Claude to translate its earlier reasoning or to write it in tags next to the answer
- Stated trade-offs: preserved thinking ‘has required some developers to update their integrations’, classifiers misfire in fewer than 0.1% of cases, ‘and we now charge users for those blocked requests’. ‘We haven’t met this goal completely’
Show 2 more
- Caveats in the post: ‘We don’t yet know how long these gains will last’; the measurements cover Anthropic’s own platform; distillers also use third-party clouds and inference providers
- Claims about Chinese labs repeated in the post: Zhipu tried to distill Claude Fable 5 for GLM-5.3, then ‘switched to an older Claude model and another lab’s model’; requests to Moonshot’s Kimi were secretly forwarded to Claude. These are Anthropic’s allegations from its September report
What happened
Anthropic published a research post on how it now defends Claude against “distillation attacks”: campaigns that collect a model’s outputs at scale, usually through fraudulent accounts, to train another model. The post says the most valuable data for distillers is Claude’s written-out reasoning, so the defenses “focus almost entirely on making Claude’s reasoning harder for distillers to access”.
The earlier defense was to show users a summary of the reasoning. Distillers answered with prompts that ask Claude to reveal the hidden reasoning, and with proxy networks of fraudulent accounts. The new system has three parts:
- Controlling where reasoning can go. Preserved thinking stops new API accounts from editing Claude’s earlier context. Protected reasoning cannot be moved to older models, and with Sonnet 5.5 it cannot be moved between organizations.
- Blocking and patching extraction attempts. A two-stage classifier, trained and red-teamed on real extraction attempts, blocks requests that try to obtain hidden reasoning. Anthropic says it catches every technique described in its September report and is updated when a new one appears.
- Making repeated attempts difficult. Accounts that keep trying get stricter limits and then bans. Since Sept 24 Anthropic again charges for requests that these safeguards block.
Anthropic estimates the effect from the number of reasoning tokens that known distillers extract on its own platform: 10 to 100 times fewer than before the classifier.
Why it matters
This is the first time Anthropic has put numbers on its anti-distillation work, after accusing Chinese labs of distillation in February, June and September 2026. It also explains API changes that developers noticed in September (preserved thinking, charges for blocked requests) as anti-distillation measures. The post asks other model developers and cloud platforms to do the same, since “illicit distillers are still paying customers” and a weaker provider undoes the effort.
The figures are Anthropic’s own and have not been checked by anyone else. The labs it names have not been asked for comment in this entry; press coverage was not yet available when it was written.
Sources
4 sources from 2 sites. Numbers match the chips in the text.
4 sources: 4 primary
Primary
- Anthropic: Strengthening our defenses against distillation attacks (Oct 12, 2026)anthropic.com, official
- Claude docs: preserved thinkingplatform.claude.com, docs
- Anthropic threat intelligence report, September 2026: illicit distillationanthropic.com, official
- Anthropic: Detecting and preventing distillation attacks (February 2026)anthropic.com, official
Changes
- Filed (the page itself is dated Oct 12, 2026)