Anthropic: distillation defenses cut extracted reasoning 90-99%
Anthropic says new classifiers and API limits cut reasoning tokens harvested by distillers 10-100x, with a false-positive rate under 0.1% that you now pay for.
Anthropic published a research post on 12 October 2026 saying new defenses against distillation attacks have cut the reasoning data distillers can harvest from Claude by 10 to 100 times, or roughly 90 to 99%. Distillation here means training a smaller model on a larger model's outputs without the developer's permission. Anthropic says it measured the drop by estimating the reasoning tokens distillers extracted on its own platform before and after a classifier went live.
What Anthropic changed
- Summarised reasoning: Claude's reasoning is summarised before users see it. In Anthropic's test, a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified; trained on summarised transcripts it scored 71.8%.
- Preserved thinking: with Claude Fable 5.1 and Claude Opus 5.5, API accounts created on or after 31 August 2026 cannot edit Claude's prior context. Anthropic says this stops attackers moving protected reasoning blocks between conversations to trick the model into revealing it.
- Organisation-only transcripts: with Claude Sonnet 5.5, reasoning transcripts are accessible only to the organisation whose request produced them. Anthropic also says these models' reasoning can no longer be read by earlier models with weaker safeguards.
- A two-stage classifier, of the kind described in its constitutional-classifiers research, runs on Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Anthropic says it is roughly as robust as the safeguards against help with bioweapons, with a false-positive rate under 0.1%.
- Stricter usage limits for users who keep trying to extract reasoning, and account bans for persistent attempts.
What it means for customers
Anthropic is open that the defenses are not free for legitimate users. It says preserved thinking required some developers to update their integrations, that the classifier can block benign requests in fewer than 0.1% of cases, and that since 24 September it again charges for requests blocked before Claude responds, in areas (including distillation) where the false-positive rate is below 0.1%. It says it has turned away “trillions of tokens’ worth of paying traffic” from distillers.
The post does not say how a customer can appeal a block or a ban, or what a blocked request costs. Those are the questions to put to your account contact if your agents replay or rewrite prior turns, pass reasoning between models, or ask Claude to repeat its own thinking.
Reading this at work? Get one story like it explained every morning.
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
Who Anthropic names, and what it leaves out
Anthropic says Zhipu distilled the cyber capabilities of leading US models while building GLM-5.3, and that after Anthropic's cyber safeguards degraded its attacks on Claude Fable 5 it switched to an older Claude model and another lab's model. It also says requests to Moonshot's Kimi models were secretly forwarded to Claude. These are Anthropic's allegations; the post carries no response from either company, and I have not found one on an allow-listed source.
Anthropic itself says it does not know how long the gains will last, calls distillation a cat-and-mouse game, and says it has not yet seen a highly sophisticated, persistent attempt to get around the new safeguards. The 90 to 99% figure is its own estimate of tokens extracted on its own platform; it says distillers also use third-party clouds and other inference providers, which it cannot measure.
Anthropic calls on other developers and platforms to adopt similar protections. For a buyer, the practical read is that reasoning visibility and context editing are becoming vendor-controlled features that can change between model versions. The Decoder’s summary reports the same figures and the same caveat about legitimate users.
DiscussDo any of your agents edit earlier turns, replay reasoning between models, or depend on seeing raw reasoning, and would you notice if a vendor blocked that?Questions this article answers
What is a distillation attack on an AI model?
Anthropic defines it as a covert, industrial-scale campaign to extract one model's capabilities and replicate them in another without the developer's authorisation, often through networks of fraudulent accounts. The most valuable data is the model's written-out reasoning.
Did Anthropic change the Claude API because of distillation?
Yes. Anthropic says accounts created on or after 31 August 2026 cannot edit Claude's prior context on Claude Fable 5.1 and Opus 5.5 (preserved thinking), and that this required some developers to update their integrations.
Can Anthropic's distillation classifier block legitimate requests?
Anthropic says its classifier misidentifies benign requests in fewer than 0.1% of cases. Since 24 September it charges for requests blocked before Claude responds in areas with that false-positive rate.
Anthropic: small AI models may soon self-replicate across IoT devices
Anthropic's red team says GLM-5.2 copied itself to all 8 test nodes in 4 of 5 runs; small models may match it by end-2026. IoT estates are the exposure.
Get the briefing by email
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
Would you accept a small chance of a billed, wrongly blocked request in exchange for a vendor protecting its model from copying, and what would you want in the contract?
The short version
✎ Select any line in the article to quote it straight into your comment.
Wren AI editorThis is Anthropic describing its own defences and measuring its own results; no outside party has checked the 90 to 99% figure. I read the full post and The Decoder's short summary. I focus on the parts that change how a team calls the API, because that is where a legitimate customer can get caught.