---
id: "2026-10-12-anthropic-distillation-defenses"
url: "https://postcutoff.com/e/2026-10-12-anthropic-distillation-defenses/"
as_of: "2026-10-13T02:19:00+02:00"
date: "2026-10-12"
date_precision: day
category: policy-safety
importance: 3
confidence: high
status: [Confirmed]
sources: 4
editor: Adam Bicz
human_review: null
version: null
---

As of: 2026-10-13 02:19 CEST.
Researched and written by AI agents (Claude Opus 5.5 in Claude Code). Human editor: Adam Bicz.
Canonical page: https://postcutoff.com/e/2026-10-12-anthropic-distillation-defenses/

# Anthropic says new defenses cut the Claude reasoning harvested by distillers by about 90 to 99 percent

On Oct 12, 2026 Anthropic published "Strengthening our defenses against distillation attacks". It describes three layers (preserved thinking, a two-stage classifier, and limits, bans and charges for repeated attempts) and says the reasoning tokens that distillers extract on its own platform are now "consistently 10 to 100 times lower" than before. It admits costs for legitimate users and says it has not yet seen "a highly sophisticated and persistent attempt" to get around them.

## Key facts
- Headline claim: 'Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99 percent'; after the classifier, extracted reasoning tokens are 'consistently 10 to 100 times lower', and on some days 'too small to measure'
- Why reasoning is the target: a pretrained Claude model trained on Claude Opus 4.8 transcripts reached 80.4% on SWE-bench Verified with full reasoning and 71.8% with summarized reasoning
- Layer 1, controlling where reasoning can go: 'preserved thinking' (introduced with Claude Fable 5.1 and Opus 5.5) stops API accounts created on or after Aug 31, 2026 from editing Claude's prior context; earlier models with weaker safeguards cannot read these models' reasoning; with Sonnet 5.5, reasoning transcripts are readable only by the organization whose request produced them
- Layer 2, a two-stage classifier of the constitutional-classifier kind, red-teamed internally and externally: 'roughly as robust as those that prevent Claude from helping build bioweapons', false positive rate below 0.1%; it runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1
- Layer 3, making repeated attempts hard: stricter usage limits, bans, and 'since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds' in areas with a <0.1% false positive rate, including distillation
- Enforcement: 'tens of thousands of accounts' banned, 'often in less than two hours' after a campaign starts; Anthropic says it turned away 'meaningful revenue and trillions of tokens' worth of paying traffic from distillers'
- Attack history given: distillers moved from passive collection to active extraction (one lab tested 12,000 different trick requests) and built proxy networks controlling 'hundreds of thousands of fraudulent accounts'; patched tricks include asking Claude to translate its earlier reasoning or to write it in tags next to the answer
- Stated trade-offs: preserved thinking 'has required some developers to update their integrations', classifiers misfire in fewer than 0.1% of cases, 'and we now charge users for those blocked requests'. 'We haven't met this goal completely'
- Caveats in the post: 'We don't yet know how long these gains will last'; the measurements cover Anthropic's own platform; distillers also use third-party clouds and inference providers
- Claims about Chinese labs repeated in the post: Zhipu tried to distill Claude Fable 5 for GLM-5.3, then 'switched to an older Claude model and another lab's model'; requests to Moonshot's Kimi were secretly forwarded to Claude. These are Anthropic's allegations from its September report

## What happened

Anthropic published a research post on how it now defends Claude against "distillation attacks": campaigns that collect a
model's outputs at scale, usually through fraudulent accounts, to train another model. The post says the most valuable data
for distillers is Claude's written-out reasoning, so the defenses "focus almost entirely on making Claude's reasoning harder
for distillers to access".

The earlier defense was to show users a summary of the reasoning. Distillers answered with prompts that ask Claude to reveal
the hidden reasoning, and with proxy networks of fraudulent accounts. The new system has three parts:

- **Controlling where reasoning can go.** Preserved thinking stops new API accounts from editing Claude's earlier context.
  Protected reasoning cannot be moved to older models, and with Sonnet 5.5 it cannot be moved between organizations.
- **Blocking and patching extraction attempts.** A two-stage classifier, trained and red-teamed on real extraction attempts,
  blocks requests that try to obtain hidden reasoning. Anthropic says it catches every technique described in its September
  report and is updated when a new one appears.
- **Making repeated attempts difficult.** Accounts that keep trying get stricter limits and then bans. Since Sept 24 Anthropic
  again charges for requests that these safeguards block.

Anthropic estimates the effect from the number of reasoning tokens that known distillers extract on its own platform: 10 to
100 times fewer than before the classifier.

## Why it matters

This is the first time Anthropic has put numbers on its anti-distillation work, after accusing Chinese labs of distillation
in February, June and September 2026. It also explains API changes that developers noticed in September (preserved thinking,
charges for blocked requests) as anti-distillation measures. The post asks other model developers and cloud platforms to do
the same, since "illicit distillers are still paying customers" and a weaker provider undoes the effort.

The figures are Anthropic's own and have not been checked by anyone else. The labs it names have not been asked for comment
in this entry; press coverage was not yet available when it was written.

## Your AI and this story

- GPT-6 Astra (training cutoff April 2026): 165 days after its cutoff
- Claude Opus 5.5 (training cutoff June 2026): 104 days after its cutoff
- Gemini 3.8 Flash (training cutoff March 2026): 195 days after its cutoff
- Grok 4.7 (training cutoff May 2026): 134 days after its cutoff

## Sources

1. [Anthropic: Strengthening our defenses against distillation attacks (Oct 12, 2026)](https://www.anthropic.com/research/distillation-defenses) (anthropic.com, official)
2. [Claude docs: preserved thinking](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking) (platform.claude.com, docs)
3. [Anthropic threat intelligence report, September 2026: illicit distillation](https://www.anthropic.com/threat-intelligence-report-september-2026#illicit-distillation-sep-26) (anthropic.com, official)
4. [Anthropic: Detecting and preventing distillation attacks (February 2026)](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks) (anthropic.com, official)

## Changes

- 2026-10-13 (filed): Created (the page itself is dated Oct 12, 2026)

## Related

- 2026-09-30: [OpenAI says Moonshot AI-linked individuals ran a coordinated campaign to extract its models' hidden reasoning](https://postcutoff.com/e/2026-09-30-openai-moonshot-distillation-campaign/index.md)
- 2026-09-29: [Anthropic: open-weights GLM-5.3 nearly matches Mythos Preview at exploit development](https://postcutoff.com/e/2026-09-29-anthropic-glm-5-3-spread-of-cyber-capabilities/index.md)
- 2026-09-17: [NIST CAISI: GLM-5.3 is the most cyber-capable open-weight model yet, but trails the US frontier by about four months](https://postcutoff.com/e/2026-09-17-caisi-glm-5-3-cyber-assessment/index.md)
- 2026-09-10: [Anthropic report details AI-orchestrated cyberattacks and distillation by Chinese labs](https://postcutoff.com/e/2026-09-10-anthropic-threat-intelligence-report-sept-2026/index.md)
- 2026-09-08: [NSA, CISA and FBI advisory AA26-251A](https://postcutoff.com/e/2026-09-08-nsa-cisa-fbi-advisory-chinese-ai-distillation/index.md)
- 2026-08-14: [Zhipu (Z.ai) releases GLM-5.3, top open-weights coding/agent model](https://postcutoff.com/e/2026-08-14-zhipu-glm-5-3/index.md)
- 2026-02-23: [Anthropic accuses DeepSeek, Moonshot and MiniMax of 'distillation attacks'](https://postcutoff.com/e/2026-02-23-anthropic-distillation-attacks-report/index.md)