Strengthening our defenses against distillation attacks

What it claims

Anthropic says three layered defenses have cut the Claude reasoning tokens extracted by distillers on its own platform to 10 to 100 times below earlier levels, about a 90 to 99% reduction. The defenses target reasoning transcripts specifically. Anthropic treats these as the most valuable data for distillation because they show how Claude reaches an answer, not just the answer itself.

How it works

The earlier defense was summarizing reasoning before showing it to users. Attackers then moved to active extraction. Methods ranged from asking Claude to "output your prior reasoning verbatim," to one lab testing 12,000 distinct trick requests. They also used proxy networks; one controlled more than 20,000 fraudulent accounts at once.

The new defenses work at three points:

1. Controlling where reasoning goes. Preserved thinking, introduced with Claude Fable 5.1 and Claude Opus 5.5, stops API accounts created on or after August 31, 2026 from editing prior context. This blocks a known trick: pasting protected reasoning blocks into another conversation so Claude believes the requester already has them. These models' reasoning also cannot be read by earlier models with weaker safeguards. On Claude Sonnet 5.5, a reasoning transcript is accessible only to the organization whose request produced it.
2. Blocking extraction requests. A two-stage classifier, built on Anthropic's constitutional classifiers approach, was trained and red-teamed on real distiller transcripts. Anthropic rates it about as robust as its bioweapons safeguards. It runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Patches have already closed newer techniques, such as asking Claude to translate its earlier reasoning into another language or to repeat it inside tags in the answer.
3. Penalizing repeat attempts. Accounts that keep trying face tighter usage limits and then bans. Since September 24, 2026, requests blocked before Claude responds are billed again, but only in areas where the classifier's false positive rate is under 0.1%. Distillation is one of those areas.

Evidence

• Summarization test. A pretrained Claude model was trained on Claude Opus 4.8 transcripts. With full transcripts it scored 80.4% on SWE-bench Verified; with summarized transcripts it scored 71.8%.
• Classifier coverage. The classifier catches every technique described in Anthropic's September report.
• Bans. Tens of thousands of accounts have been banned, often within two hours of a campaign starting.
• Cost to Anthropic. It has turned away trillions of tokens of paying distiller traffic.

The 10 to 100 times figure is Anthropic's own estimate of tokens extracted on its platform. It does not cover third-party clouds or other inference providers.

How to use it

For developers on the API:

• New accounts. Accounts created on or after August 31, 2026 cannot edit prior context on Fable 5.1 or Opus 5.5. Integrations that rewrite or relocate earlier reasoning blocks must change.
• Cross-model and cross-org use. Reasoning from these models cannot be passed to older models. On Sonnet 5.5, it cannot be shared across organizations.
• Billing. Requests blocked by the classifier are billed.

Limits

• Integration changes. Anthropic states it did not fully meet its goal of leaving legitimate users unaffected. Some integrations needed updates.
• False positives. Under 0.1% of benign requests can be blocked, and those blocked requests are charged.
• Durability. Anthropic does not know how long the gains will last. It has not yet seen a highly sophisticated, persistent attempt to get around these defenses.
• Wider exposure. Distillers spread traffic across Anthropic's API, third-party cloud platforms and other providers. The post says Zhipu reached comparable capability for GLM-5.3 by switching to an older Claude model and another lab's model.