Anthropic Strengthens Anti-Distillation Defense Reducing Data Extraction by 90% to 99%
On October 12, Anthropic published a blog stating that it has significantly reduced the effectiveness of distillation attacks on Claude through new methods, with early evidence showing that the amount of data extracted by distillers on its platform has decreased by approximately 90% to 99%. Distillation attacks refer to the covert behavior of extracting model capabilities and replicating them to other models through fraudulent account networks, often used by overseas laboratories to catch up with U.S. cutting-edge capabilities.
Anthropic pointed out two major concerns: distilled models often lack equivalent security protections, which could cause harm in biological and cybersecurity fields; and they pose national security risks, as capabilities could be integrated into foreign military, intelligence, and surveillance systems. Specific cases include Zhipu's distillation of U.S. models' network capabilities while developing GLM-5.3, which previously attempted Claude Fable 5 but switched to older Claude and other laboratory models due to degraded security protections; the U.S. CAISSI assessed GLM-5.3 as the strongest open-source weight model for network capabilities released to date, while Anthropic's research found its protections easy to bypass and willing to develop end-to-end security vulnerabilities.
Another case involves the Kimi model from the Dark Side of the Moon, where requests were secretly forwarded to Claude as part of the distillation. One of the requests came from a user that Anthropic believes is linked to the People's Liberation Army of China, aimed at analyzing specific individuals' CCTV footage. Anthropic has rejected a large amount of paid traffic (tens of trillions of tokens) from distillers and invested resources into research and product teams.
The defense focuses on protecting Claude's reasoning process (reasoning transcripts), as it is more valuable than the final output. Early measures included summarizing reasoning, resulting in models trained on complete reasoning scoring 80.4% on SWE-bench Verified, which dropped to 71.8% after summarization. Distillers then shifted to actively extracting by requesting verbatim outputs of previous reasoning or testing tens of thousands of requests to bypass.
The new methods include three aspects: implementing preserved thinking for new API accounts created after August 31, 2026, prohibiting editing of previous context; preventing new model reasoning from being read by earlier, less protected models; and Sonnet 5.5 reasoning being accessible only to the institution. A two-stage classifier was also deployed, with strength comparable to biological weapon defenses and a false positive rate of less than 0.1%, applied to Sonnet 5.5, Opus 5/5.5, and Fable 5/5.1. Requests intercepted in low false positive areas will resume charging, and stricter limitations or bans will be imposed on accounts with ongoing extraction.
After implementation, the number of reasoning tokens extracted on the platform has continued to drop to 1/10 to 1/100 of previous levels, with tens of thousands of related accounts banned, often completed within two hours of activity starting. Anthropic acknowledges trade-offs, including some developers needing to update integrations, very low probability of false interceptions, and charging for intercepted requests, but still believes the costs are worth bearing and calls for the entire industry to adopt similar measures.
Source: Public Information
ABAB AI Insight
Anthropic has previously reported distillation activities multiple times, including disclosures in February and September 2026, describing agent networks controlling tens of thousands to hundreds of thousands of fraudulent accounts, using false identities and stolen payment information, and reselling access in regions where services are not provided. The company likens distillation to abuses in cybersecurity and biological fields, employing similar constitutional classifiers methods to build defenses. The GLM-5.3 and Kimi cases show that overseas laboratories, after obtaining cutting-edge reasoning capabilities through distillation, have some models with weak protections or used for monitoring related requests.
In terms of capital pathways, distillers obtain high-value reasoning data through large-scale paid API calls, at a cost far lower than training cutting-edge models from scratch. Anthropic has chosen to reject related revenue and invest in protective resources, while charging for low false positive intercepted requests to increase the cost of attacks. Preserved thinking and classifiers restrict reasoning access to specific accounts and institutional scopes, reducing the feasibility of extraction across accounts, models, and dialogues. Other cutting-edge developers with weaker protections become alternative targets.
Similar cases include early model distillation used to narrow capability gaps and model extraction attacks in the security field. Currently, the industry is in a parallel phase of cutting-edge model capability diffusion and protection upgrades, with Anthropic attempting to promote industry standards through public methods while maintaining control over its models in reasoning transparency and security.
Essentially, this is about technological substitution and regulatory changes. Distillation replicates high-cost reasoning capabilities at low cost, weakening the security and capability barriers of original developers; protection upgrades raise extraction thresholds through technical means and introduce mechanisms such as charging and banning to alter attackers' cost structures. The mechanism is to shift the reasoning process from widely accessible to controlled access, while requiring the entire industry to synchronize protections; otherwise, capabilities can still diffuse through other channels.
ABAB News · Cognitive Laws
The reasoning process is the core asset; output is just the surface.
Protection upgrades raise extraction costs; diffusion still relies on alternative channels.
Rejecting revenue for safety boundaries; industry standards determine the final effect.