{"schema":"postcutoff/event@1","as_of":"2026-10-13T02:19:00+02:00","url":"https://postcutoff.com/e/2026-10-12-anthropic-distillation-defenses/","md":"https://postcutoff.com/e/2026-10-12-anthropic-distillation-defenses/index.md","disclosure":{"written_by":"AI agents (Claude Opus 5.5 in Claude Code)","editor":"Adam Bicz","policy":"https://postcutoff.com/about/"},"license":null,"id":"2026-10-12-anthropic-distillation-defenses","date":"2026-10-12","date_precision":"day","short_title":"Anthropic says new defenses cut the Claude reasoning harvested by distillers by about 90 to 99 percent","deck":null,"takeaway":"On Oct 12, 2026 Anthropic published \"Strengthening our defenses against distillation attacks\".","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":[{"n":1,"title":"Anthropic: Strengthening our defenses against distillation attacks (Oct 12, 2026)","url":"https://www.anthropic.com/research/distillation-defenses","type":"official","group":"primary","domain":"anthropic.com"},{"n":2,"title":"Claude docs: preserved thinking","url":"https://platform.claude.com/docs/en/build-with-claude/preserved-thinking","type":"docs","group":"primary","domain":"platform.claude.com"},{"n":3,"title":"Anthropic threat intelligence report, September 2026: illicit distillation","url":"https://www.anthropic.com/threat-intelligence-report-september-2026#illicit-distillation-sep-26","type":"official","group":"primary","domain":"anthropic.com"},{"n":4,"title":"Anthropic: Detecting and preventing distillation attacks (February 2026)","url":"https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks","type":"official","group":"primary","domain":"anthropic.com"}],"official":4,"filed":"2026-10-13","updated":"2026-10-13","orgs":["Anthropic"],"title":"Anthropic says new defenses cut the Claude reasoning harvested by distillers by about 90 to 99 percent","summary":"On Oct 12, 2026 Anthropic published \"Strengthening our defenses against distillation attacks\". It describes three layers (preserved thinking, a two-stage classifier, and limits, bans and charges for repeated attempts) and says the reasoning tokens that distillers extract on its own platform are now \"consistently 10 to 100 times lower\" than before. It admits costs for legitimate users and says it has not yet seen \"a highly sophisticated and persistent attempt\" to get around them.","key_facts":["Headline claim: 'Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99 percent'; after the classifier, extracted reasoning tokens are 'consistently 10 to 100 times lower', and on some days 'too small to measure'","Why reasoning is the target: a pretrained Claude model trained on Claude Opus 4.8 transcripts reached 80.4% on SWE-bench Verified with full reasoning and 71.8% with summarized reasoning","Layer 1, controlling where reasoning can go: 'preserved thinking' (introduced with Claude Fable 5.1 and Opus 5.5) stops API accounts created on or after Aug 31, 2026 from editing Claude's prior context; earlier models with weaker safeguards cannot read these models' reasoning; with Sonnet 5.5, reasoning transcripts are readable only by the organization whose request produced them","Layer 2, a two-stage classifier of the constitutional-classifier kind, red-teamed internally and externally: 'roughly as robust as those that prevent Claude from helping build bioweapons', false positive rate below 0.1%; it runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1","Layer 3, making repeated attempts hard: stricter usage limits, bans, and 'since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds' in areas with a <0.1% false positive rate, including distillation","Enforcement: 'tens of thousands of accounts' banned, 'often in less than two hours' after a campaign starts; Anthropic says it turned away 'meaningful revenue and trillions of tokens' worth of paying traffic from distillers'","Attack history given: distillers moved from passive collection to active extraction (one lab tested 12,000 different trick requests) and built proxy networks controlling 'hundreds of thousands of fraudulent accounts'; patched tricks include asking Claude to translate its earlier reasoning or to write it in tags next to the answer","Stated trade-offs: preserved thinking 'has required some developers to update their integrations', classifiers misfire in fewer than 0.1% of cases, 'and we now charge users for those blocked requests'. 'We haven't met this goal completely'","Caveats in the post: 'We don't yet know how long these gains will last'; the measurements cover Anthropic's own platform; distillers also use third-party clouds and inference providers","Claims about Chinese labs repeated in the post: Zhipu tried to distill Claude Fable 5 for GLM-5.3, then 'switched to an older Claude model and another lab's model'; requests to Moonshot's Kimi were secretly forwarded to Claude. These are Anthropic's allegations from its September report"],"key_numbers":[],"tags":["distillation","safeguards","classifiers","preserved-thinking","reasoning","api","china","zhipu","moonshot","national-security"],"science":null,"body_md":"## What happened\n\nAnthropic published a research post on how it now defends Claude against \"distillation attacks\": campaigns that collect a\nmodel's outputs at scale, usually through fraudulent accounts, to train another model. The post says the most valuable data\nfor distillers is Claude's written-out reasoning, so the defenses \"focus almost entirely on making Claude's reasoning harder\nfor distillers to access\".\n\nThe earlier defense was to show users a summary of the reasoning. Distillers answered with prompts that ask Claude to reveal\nthe hidden reasoning, and with proxy networks of fraudulent accounts. The new system has three parts:\n\n- **Controlling where reasoning can go.** Preserved thinking stops new API accounts from editing Claude's earlier context.\n  Protected reasoning cannot be moved to older models, and with Sonnet 5.5 it cannot be moved between organizations.\n- **Blocking and patching extraction attempts.** A two-stage classifier, trained and red-teamed on real extraction attempts,\n  blocks requests that try to obtain hidden reasoning. Anthropic says it catches every technique described in its September\n  report and is updated when a new one appears.\n- **Making repeated attempts difficult.** Accounts that keep trying get stricter limits and then bans. Since Sept 24 Anthropic\n  again charges for requests that these safeguards block.\n\nAnthropic estimates the effect from the number of reasoning tokens that known distillers extract on its own platform: 10 to\n100 times fewer than before the classifier.\n\n## Why it matters\n\nThis is the first time Anthropic has put numbers on its anti-distillation work, after accusing Chinese labs of distillation\nin February, June and September 2026. It also explains API changes that developers noticed in September (preserved thinking,\ncharges for blocked requests) as anti-distillation measures. The post asks other model developers and cloud platforms to do\nthe same, since \"illicit distillers are still paying customers\" and a weaker provider undoes the effort.\n\nThe figures are Anthropic's own and have not been checked by anyone else. The labs it names have not been asked for comment\nin this entry; press coverage was not yet available when it was written.","disputed":[],"related":[{"id":"2026-09-30-openai-moonshot-distillation-campaign","url":"https://postcutoff.com/e/2026-09-30-openai-moonshot-distillation-campaign/","date":"2026-09-30","date_precision":"day","short_title":"OpenAI says Moonshot AI-linked individuals ran a coordinated campaign to extract its models' hidden reasoning","deck":null,"takeaway":"Hidden chains of thought are a main competitive asset and a safety-monitoring surface.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":11,"official":2,"filed":"2026-09-30","updated":"2026-10-04","orgs":["OpenAI","Moonshot AI"]},{"id":"2026-09-29-anthropic-glm-5-3-spread-of-cyber-capabilities","url":"https://postcutoff.com/e/2026-09-29-anthropic-glm-5-3-spread-of-cyber-capabilities/","date":"2026-09-29","date_precision":"day","short_title":"Anthropic: open-weights GLM-5.3 nearly matches Mythos Preview at exploit development","deck":null,"takeaway":"It is the first time a frontier lab has published evidence that an open-weights model reached the level of exploit capability it had judged too risky to release widely.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":13,"official":5,"filed":"2026-09-30","updated":"2026-10-07","orgs":["Anthropic","Zhipu AI"]},{"id":"2026-09-17-caisi-glm-5-3-cyber-assessment","url":"https://postcutoff.com/e/2026-09-17-caisi-glm-5-3-cyber-assessment/","date":"2026-09-17","date_precision":"day","short_title":"NIST CAISI: GLM-5.3 is the most cyber-capable open-weight model yet, but trails the US frontier by about four months","deck":null,"takeaway":"This is the US government's own measurement of the open-weight cyber gap, published twelve days before Anthropic's Frontier Red Team report on the same model.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":1,"official":1,"filed":"2026-10-03","updated":"2026-10-03","orgs":["NIST","CAISI","Zhipu AI"]},{"id":"2026-09-10-anthropic-threat-intelligence-report-sept-2026","url":"https://postcutoff.com/e/2026-09-10-anthropic-threat-intelligence-report-sept-2026/","date":"2026-09-10","date_precision":"day","short_title":"Anthropic report details AI-orchestrated cyberattacks and distillation by Chinese labs","deck":null,"takeaway":"It documents the move from AI-assisted to AI-orchestrated attacks, and it treats distillation of frontier models as a security threat on a par with cyber misuse.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"medium","status":{"key":"partly","labels":["Partly confirmed"]},"sources":10,"official":2,"filed":"2026-09-29","updated":"2026-10-09","orgs":["Anthropic"]},{"id":"2026-09-08-nsa-cisa-fbi-advisory-chinese-ai-distillation","url":"https://postcutoff.com/e/2026-09-08-nsa-cisa-fbi-advisory-chinese-ai-distillation/","date":"2026-09-08","date_precision":"day","short_title":"NSA, CISA and FBI advisory AA26-251A","deck":"Six Chinese AI firms run 'industrial-scale' distillation of Claude, GPT, Gemini and Grok","takeaway":"Distillation moved from company terms-of-service complaints to a formal US government attribution.","category":"policy-safety","category_label":"Policy & safety","importance":4,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":6,"official":2,"filed":"2026-10-10","updated":"2026-10-10","orgs":["NSA","CISA","FBI","DeepSeek","Moonshot AI","Alibaba","MiniMax","StepFun","Z.AI"]},{"id":"2026-08-14-zhipu-glm-5-3","url":"https://postcutoff.com/e/2026-08-14-zhipu-glm-5-3/","date":"2026-08-14","date_precision":"day","short_title":"Zhipu (Z.ai) releases GLM-5.3, top open-weights coding/agent model","deck":null,"takeaway":"Zhipu, which listed in Hong Kong in January, shows Chinese open models competing at the top on agentic coding.","category":"model-release","category_label":"Model releases","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":4,"official":2,"filed":"2026-09-29","updated":"2026-10-02","orgs":["Zhipu AI","Z.ai"]},{"id":"2026-02-23-anthropic-distillation-attacks-report","url":"https://postcutoff.com/e/2026-02-23-anthropic-distillation-attacks-report/","date":"2026-02-23","date_precision":"day","short_title":"Anthropic accuses DeepSeek, Moonshot and MiniMax of 'distillation attacks'","deck":"16M+ Claude exchanges via ~24,000 fraudulent accounts","takeaway":"\"Distillation attacks\" became a named security and policy issue in 2026.","category":"policy-safety","category_label":"Policy & safety","importance":3,"confidence":"high","status":{"key":"confirmed","labels":["Confirmed"]},"sources":3,"official":1,"filed":"2026-10-04","updated":"2026-10-04","orgs":["Anthropic","DeepSeek","Moonshot AI","MiniMax"]}],"people":[],"posts":[],"videos":[],"models":[],"changes":[{"date":"2026-10-13","type":"filed","text":"Created (the page itself is dated Oct 12, 2026)"}],"provenance":{"agents":[{"model":"Claude Opus 5.5","maker":"Anthropic","tool":"Claude Code"}],"filed":"2026-10-13","run":null,"sources_read":null,"updated":"2026-10-13","human_review":null,"version":null},"gaps":[{"model_id":"gpt-6-astra","name":"GPT-6 Astra","cutoff":"2026-04","days_after":165,"in_training_data":false},{"model_id":"claude-opus-5-5","name":"Claude Opus 5.5","cutoff":"2026-06","days_after":104,"in_training_data":false},{"model_id":"gemini-3-8-flash","name":"Gemini 3.8 Flash","cutoff":"2026-03","days_after":195,"in_training_data":false},{"model_id":"grok-4-7","name":"Grok 4.7","cutoff":"2026-05","days_after":134,"in_training_data":false}],"short_url":null}