Table of Contents
Anthropic says new anti-distillation defenses have sharply reduced the amount of Claude reasoning data that rival model builders can extract from its platform.
In a research post published Oct. 12, the company said its latest safeguards have cut reasoning data harvested by distillers by roughly 90% to 99%. The measures are aimed at covert, large-scale campaigns that use a frontier model's outputs to train cheaper imitation systems without authorization.
Reasoning traces are especially sensitive because they can be more valuable than ordinary model answers. A final answer shows what a model concluded, while a reasoning transcript shows how the model approached the task, making it more useful for training another system to reproduce similar behavior.
Anthropic framed the update as a product security measure and broader AI-safety intervention. The company said distillation campaigns are often run through networks of fraudulent accounts, can involve trillions of tokens of paid traffic, and may help model developers approach frontier capabilities without matching the original lab's safety work.
Why Anthropic Is Targeting Reasoning Extraction
Distillation is not new in AI, but Anthropic is focusing on what it describes as illicit distillation: unauthorized campaigns that collect outputs from a stronger model to train another one.
Anthropic's main target is Claude's hidden reasoning. The company previously tried to reduce the value of that data by summarizing Claude's reasoning before showing it to users. In an internal evaluation, Anthropic said a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, while a model trained on summarized reasoning scored 71.8%.
That result helped explain why distillers kept trying to recover fuller reasoning traces. Anthropic said attackers moved from passive collection to active extraction attempts, including prompts designed to make Claude reveal earlier reasoning verbatim. In one case cited by the company, a lab tested 12,000 distinct extraction prompts.
Anthropic said some distillers also used proxy networks with large numbers of fraudulent accounts, allowing them to continue campaigns after individual accounts were blocked. In an earlier report, the company said one network managed more than 20,000 fraudulent accounts at once.
The Three-Layer Defense
Anthropic's new system is built around three main controls: limiting where reasoning can move, blocking extraction attempts, and making repeat attacks more expensive.
The first layer is "preserved thinking," a feature introduced with Claude Fable 5.1 and Claude Opus 5.5. For API accounts created on or after Aug. 31, 2026, preserved thinking prevents users from editing Claude's prior context. Anthropic said attackers had moved protected reasoning blocks between conversations, models, and accounts to trick Claude into revealing information that should have remained hidden.
The company also said newer models' reasoning can no longer be read by earlier Claude models with weaker anti-distillation safeguards. With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.
The second layer is a two-stage classifier system modeled on Anthropic's constitutional-classifier work. Anthropic said it trained and red-teamed the classifier against extraction attempts, including both manual and automated methods. The company said the safeguards are now "roughly as robust as those that prevent Claude from helping build bioweapons," with a false-positive rate below 0.1%.
The classifier currently runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic said it plans to apply the same approach to future models that could attract distillers.
The third layer is enforcement. Anthropic said accounts that repeatedly attempt to extract reasoning face stricter limits or bans. Since Sept. 24, the company has also resumed charging for requests blocked before Claude responds in categories, including distillation, where it says the false-positive rate is below 0.1%.
Anthropic Says Extraction Fell 10x to 100x
Anthropic said the combined defenses have reduced extracted reasoning tokens on its own platform by a factor of 10 to 100, with some days falling to levels that were "too small to measure."
The company also said it has banned tens of thousands of accounts associated with distillation, often within two hours of a campaign beginning. Anthropic said its classifier now catches all of the distillation techniques described in its September threat-intelligence report on its most capable generally available models.
The gains come with trade-offs. Anthropic said it has turned away "meaningful revenue and trillions of tokens' worth of paying traffic" from distillers. Some legitimate developers have had to update integrations because of preserved thinking. The company also acknowledged that benign requests can still be blocked in fewer than 0.1% of cases, and that blocked requests in covered categories are billed.
Anthropic described the work as an ongoing contest rather than a permanent fix. The company said it expects distillation to remain a cat-and-mouse game and that it has not yet seen a highly sophisticated, persistent attempt to evade the latest safeguards.
Anthropic Names Zhipu, GLM-5.3, and Kimi
The post also names specific companies and models in connection with Anthropic's distillation concerns.
Anthropic alleged that Zhipu distilled the cyber capabilities of leading U.S. models while developing GLM-5.3. The company said Zhipu attempted to distill Claude Fable 5, then switched to an older Claude model and another lab's model after Claude's cyber safeguards degraded its attacks.
Anthropic also cited an assessment by the U.S. Center for Advancing Innovation and Standards for Super Intelligence, which it said found GLM-5.3 to be the most cyber-capable open-weights model released to date. Anthropic said its own research found that GLM-5.3's safeguards could be bypassed and that the model was willing to develop security exploits end to end.
The company also pointed to a case in which requests to Moonshot's Kimi models were allegedly forwarded secretly to Claude as part of a distillation effort. Anthropic said one request came from a user it believed was affiliated with China's People's Liberation Army and involved analyzing CCTV surveillance of a specific individual.
