Anthropic Distillation Defenses Update

Anthropic has deployed a suite of new technical defenses to combat "distillation attacks"—industrial-scale efforts to extract the capabilities of frontier models to replicate them in smaller, unauthorized models. These measures have reduced the volume of reasoning tokens extracted by distillers on Anthropic's platform by a factor of 10 to 100+.

The Risk of Illicit Distillation

Illicit distillation allows third parties to mimic frontier AI capabilities at a fraction of the original development cost and time. Anthropic identifies two primary risks associated with this practice:

  1. Safeguard Erosion: Distilled models often lack the robust safety guardrails of the original model. Anthropic cites Zhipu's GLM-5.3 as an example; while it distilled cyber capabilities from leading US models, research found its safeguards are easily bypassed, allowing the model to develop security exploits end-to-end.
  2. National Security Risks: Capabilities gained through distillation are being integrated into foreign military, intelligence, and surveillance systems. Anthropic reports a case where requests to Moonshot's Kimi models were secretly forwarded to Claude to analyze CCTV surveillance of a specific individual for a user believed to be affiliated with China's People's Liberation Army.

Technical Defenses Against Extraction

Distillers primarily target "reasoning transcripts"—the internal thinking process a model generates before its final answer—because this data is significantly more valuable for training smaller models than the final output alone.

Reasoning Control and Preserved Thinking

To prevent attackers from manipulating context to trick models into revealing hidden reasoning, Anthropic introduced preserved thinking in Claude Fable 5.1 and Claude Opus 5.5. This feature prevents API accounts created on or after August 31, 2026, from editing Claude's prior context. Additionally, Claude Sonnet 5.5 restricts reasoning transcripts so they are accessible only to the organization that produced the request.

Two-Stage Classifier System

Anthropic has implemented a two-stage classifier system, based on their constitutional classifiers research, to detect and block extraction attempts. This system is deployed on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1.

Key specifications of the classifier include:

  • Robustness: The safeguards are described as being roughly as robust as those preventing the creation of bioweapons.
  • Accuracy: The system maintains a false positive rate of less than 0.1%.
  • Iterative Patching: The system is updated to block new evasion techniques, such as requesting translations of reasoning or asking for reasoning to be wrapped in specific tags.

Economic and Account Deterrents

To increase the cost of attacks, Anthropic has implemented the following:

  • Usage Limits and Bans: Accounts showing persistent distillation attempts face stricter limits or permanent bans.
  • Monetization of Blocked Requests: Since September 24, Anthropic charges for requests blocked by safeguards in areas where the false positive rate is below 0.1%, including distillation.

Effectiveness and Trade-offs

Early evidence indicates that the new defenses have reduced data harvesting by 90% to 99%. The two-stage classifier now catches all distillation techniques described in Anthropic's September threat intelligence report.

However, these security gains involve specific trade-offs:

  • Integration Updates: The "preserved thinking" feature required some legitimate developers to update their API integrations.
  • False Positives: In fewer than 0.1% of cases, benign requests are misidentified and blocked.
  • Cost: Users are now charged for requests that are blocked by these safeguards.

Industry Implications

Anthropic argues that distillation is a systemic problem requiring cooperation across the industry. Because distillers distribute traffic across various APIs and cloud providers, individual efforts are undermined if other frontier models remain easily accessible without similar anti-distillation safeguards. Anthropic calls on other developers and platforms to prioritize the detection and disruption of fraudulent accounts and the offboarding of illicit distillers, despite the loss of potential revenue.

Sources