Anthropic published its distillation defenses and says early evidence suggests the new methods cut the data harvested by distillers by around 90 to 99 percent. Distillation attacks are covert, industrial-scale campaigns to extract one model's capabilities and replicate them in another without authorization, often through networks of fraudulent accounts, at a fraction of the development time and cost.
Anthropic gives two reasons it cares. Distilled models approach the frontier without proportionally robust safeguards, inviting misuse in biology and cybersecurity. It says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3: it tried Claude Fable 5, but after Anthropic's cyber safeguards degraded its attacks, it switched to an older Claude model and another lab's. The US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) has since assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and Anthropic's own analysis found its safeguards easy to bypass.
The second is national security: distilled capabilities end up in foreign military, intelligence and surveillance systems. Anthropic recently reported that requests to Moonshot's Kimi models were secretly forwarded to Claude, one apparently from a user affiliated with China's People's Liberation Army seeking to analyze CCTV footage of a specific individual. The White House accusation that Moonshot distilled Anthropic's models came over Kimi K3.
Why simple defenses were not enough
Distillers generate millions of responses from a larger model to teach a smaller one, and the most valuable data are transcripts of Claude's reasoning, the thinking it writes before responding. The first measure was to summarize that reasoning before showing it to users. In a test, a pretrained Claude model trained on transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified with full reasoning and 71.8% with summarized reasoning, a drop of 8.6 points.
From Anthropic's post.
Attackers then moved to active extraction, such as telling Claude to output its prior reasoning verbatim; one lab tested 12,000 requests, each a different trick. Ordinary users rarely ask for this, so it can be detected, but distillers scaled up with proxy networks controlling hundreds of thousands of fraudulent accounts. These resold Claude access in unsupported regions, used false identities and stolen payment details, and in one case ran more than 20,000 accounts at once.
Three new methods
Controlling where reasoning can go. Distillers had been moving protected reasoning blocks between conversations, models and accounts. With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced preserved thinking, which stops new API accounts, created on or after August 31, from editing Claude's prior context. It also blocks earlier models with weaker safeguards from reading these models' reasoning. With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.
Blocking and patching extraction attempts. Anthropic built a two-stage classifier system of the kind used in its constitutional classifiers research and red-teamed it using transcripts of distillers' attempts. It says the safeguards are now roughly as robust as those that stop Claude from helping build bioweapons, with a false positive rate under 0.1%. They run on the most capable generally available models (currently Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1), with future ones planned. Newly blocked techniques include asking Claude to translate its earlier reasoning into another language or write it in tags.
Making repeated attempts difficult. Users who keep trying to extract reasoning face stricter usage limits, and persistent attempts lead to bans. Since September 24, Anthropic has also charged for requests blocked before Claude responds, in areas such as distillation where the false positive rate is under 0.1%.
Results
Anthropic says the classifier now catches all of the distillation techniques described in its September report. Since it went in, the reasoning tokens extracted by distillers have been consistently 10 to 100 times lower than before, adding to the effect of preserved thinking. Tens of thousands of accounts have been banned, often within two hours of a campaign starting.
From Anthropic's post.
The chart shows daily reasoning tokens exposed to successful distillation requests as a multiple of September 26, the quietest measurable day after the safeguards (on since September 19). The pre-safeguard average was about 8,800 times that baseline, with a peak near 56,000 times; afterward it averaged about 135 times, roughly 65 times lower, and on several days it was too small to measure.
Trade-offs and the call to the industry
Anthropic says it turned away meaningful revenue and trillions of tokens of paying distiller traffic. Preserved thinking required some developers to update their integrations, and the classifiers block benign requests in fewer than 0.1% of cases, which are also charged. Anthropic does not know how long the gains will last, expects distillation to remain cat-and-mouse, and has not yet seen a highly sophisticated, persistent attempt to circumvent the defenses.
It argues that stopping illicit distillation takes every frontier developer, and that efforts are undermined when attackers can reach a similarly capable model without safeguards, as Zhipu did with GLM-5.3. Distillers also spread traffic across Anthropic's API, third-party clouds and other inference providers, so platforms must quickly detect abuse and offboard fraudulent accounts. Incentives often cut the other way, Anthropic acknowledges, since defenses are expensive and distillers pay; it is publishing its methods to show a workable alternative.