Distillation Attacks Down by 90 to 99%: Anthropic's Three Defenses for Claude's Reasoning

Hi, it's Shii-chan!

Today I'm covering Anthropic's report on stronger defenses against distillation attacks. Some of the changes affect developers too.

What was announced?

Anthropic published "Strengthening our defenses against distillation attacks." Distillation attacks are covert, large-scale campaigns that extract one model's capabilities to build another without the developer's authorization, often through networks of fraudulent accounts.

Anthropic says early evidence suggests the new methods cut the data harvested by distillers by roughly 90 to 99%.

Why it matters

Distilled models can approach the frontier without comparable safeguards, which raises concerns in biology and cybersecurity. The post gives examples:

Zhipu reportedly distilled cyber capabilities from leading US models while developing GLM-5.3. After Anthropic's cyber safeguards degraded its attacks, it switched to an older Claude model and another lab's model
CAISI assessed GLM-5.3 as the most cyber-capable open-weights model released to date
In a case involving Moonshot's Kimi models, requests were secretly forwarded to Claude

Reasoning transcripts are especially valuable to distillers because they show how Claude reaches its answers.

What changes: three defenses

1. Controlling where reasoning can go

Preserved thinking (Claude Fable 5.1 and Claude Opus 5.5): API accounts created on or after August 31, 2026 can't edit prior context, which makes repeated extraction through proxy networks harder
Reasoning is no longer readable by earlier models with weaker anti-distillation safeguards
With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them

2. Blocking and patching extraction attempts

A two-stage classifier built from distillation transcripts, based on constitutional classifiers research
Roughly as robust as the safeguards against bioweapons assistance, with a false positive rate below 0.1%
Deployed on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1
New techniques, such as asking Claude to translate earlier reasoning into another language or write it in tags alongside its answer, have already been patched

3. Making repeated attempts difficult

Accounts persistently trying to extract reasoning face stricter usage limits, and repeated attempts lead to bans
Since September 24, requests blocked by safeguards in specific areas, including distillation, are charged (false positive rate under 0.1%)

Dive Deep

Summaries weren't enough

The first measure was summarizing reasoning before showing it. In a test, a pretrained model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, versus 71.8% with only summarized transcripts. Attackers then switched to active extraction, such as asking Claude to output its prior reasoning verbatim. One lab tested 12,000 varied requests.

Results

On the most capable generally available models, the classifier catches all distillation techniques described in Anthropic's September report
Reasoning tokens extractable by distillers are 10 to 100+ times lower than before, and on some days too small to measure
Tens of thousands of distillation-linked accounts have been banned, sometimes within two hours of a campaign starting

Limits and trade-offs

Anthropic doesn't know how long the gains will last and expects a cat-and-mouse dynamic
It hasn't yet seen a highly sophisticated, persistent attempt to circumvent the defenses
Preserved thinking requires some developers to update their integrations
The classifier can block benign requests in fewer than 0.1% of cases, and blocked requests are charged
Anthropic has turned away meaningful revenue and trillions of tokens of paying traffic from distillers

Call to action for the industry

Distillers spread traffic across Anthropic's API, third-party clouds, and other inference providers, so platforms and developers also need to detect abuse quickly and offboard fraudulent accounts. Anthropic published its methods to show a workable alternative exists.

Wrap-up

Data harvestable by distillers is estimated down roughly 90 to 99%
Three defenses: reasoning controls, a two-stage classifier, and deterrence of repeated attempts
New API accounts can't edit prior context with Preserved thinking
Requests blocked by these safeguards are charged, so keep that in mind

If you build on the Claude API or follow AI security, this one is worth a look!