Anthropic says new defenses cut what distillers can extract from Claude by 90 to 99%
Anthropic detailed three measures against distillation attacks: limiting where Claude's reasoning can go, a two-stage classifier, and stricter limits and bans. It acknowledged trade-offs for legitimate developers, including billing for some blocked requests.
Photo: TechCrunch / Wikimedia Commons, CC BY 2.0. Anthropic logo via Wikimedia Commons (public domain).
Anthropic said on October 12 that new methods have reduced the amount of data harvested by distillers from Claude by around 90 to 99%, according to early evidence described in a company blog post. Distillation attacks, Anthropic writes, are covert, industrial-scale campaigns to extract one model's capabilities and replicate them in another, often run through networks of fraudulent accounts.
The company says its defenses focus on Claude's reasoning transcripts, the most valuable data for distillers. In its own test, a model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified, versus 71.8% when trained on summarized reasoning.
Anthropic describes three layers. "Preserved thinking," introduced with Claude Fable 5.1 and Claude Opus 5.5, stops API accounts created on or after August 31, 2026 from editing Claude's prior context. A two-stage classifier, which Anthropic says is now roughly as robust as the safeguards that stop Claude helping build bioweapons, has a false positive rate below 0.1%. Repeat offenders face stricter usage limits and bans; the company says it has banned tens of thousands of accounts tied to distillation, often within two hours of a campaign starting.
The post acknowledges trade-offs: some developers have had to update their integrations, the classifiers occasionally block benign requests, and since September 24 Anthropic has resumed charging for requests blocked by its safeguards in areas where the false positive rate is under 0.1%. Anthropic also said Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3, and called on other developers and platforms to help stop distillation.