Strengthening our defenses against distillation attacks

What it claims

Anthropic says three changes to Claude's API cut the reasoning tokens distillers extract by 10–100x. The changes restrict where reasoning blocks can travel, add a red-teamed two-stage classifier on extraction requests, and penalise accounts that keep trying. Anthropic also says these changes impose costs on legitimate integrators. The parts that matter to an API user are which models, which accounts and which dates each change covers.

How it works

• Preserved thinking applies to Claude Fable 5.1 and Claude Opus 5.5. API accounts created on or after August 31, 2026 cannot edit Claude's prior context. This blocks the attack of moving protected reasoning blocks between conversations or accounts so that Claude believes the caller already has the unsummarized reasoning.
• Cross-model reading is blocked. Reasoning from those models cannot be read by earlier models with weaker safeguards.
• Sonnet 5.5 transcripts are org-scoped. Claude Sonnet 5.5 reasoning transcripts are accessible only to the organization whose request produced them.
• Two-stage constitutional classifier.
• It was trained and red-teamed, internally and externally, using real distiller extraction transcripts.
• Anthropic describes it as roughly as robust as its bioweapons safeguards.
• It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.
• It is patched as new evasions appear. Already-closed examples include asking Claude to translate its earlier reasoning into another language, and asking it to emit the reasoning in tags alongside the answer.
• Escalation for repeat attempts. Accounts that keep trying get stricter usage limits, then bans. Since September 24, requests blocked before Claude responds are billed in areas where the classifier's false-positive rate is below 0.1%, and distillation is one of those areas.

flowchart TD
  R[API request] --> C{Classifier flags extraction?}
  C -- no --> A[Normal response]
  C -- yes --> B[Blocked, still billed]
  B --> P{Repeated attempts?}
  P -- yes --> L[Stricter limits, then ban]
  P -- no --> E[End]

Evidence

• Effect of summarization:
• Setup: a pretrained Claude model was trained on Claude Opus 4.8 transcripts.
• Result on SWE-bench Verified: 80.4% when trained on full transcripts, 71.8% when trained on summarized transcripts.
• Extracted reasoning tokens: consistently 10–100x lower after the classifier was introduced. The figure is measured on Anthropic's own platform only and comes on top of the gains from preserved thinking.
• Coverage of known techniques: the classifier catches all techniques described in Anthropic's September report.
• Bans: tens of thousands of accounts, often within two hours of a distillation campaign starting.
• False positives: below 0.1%.

Limits

• Integration breakage: preserved thinking has forced some developers to update their integrations. If your account was created on or after Aug 31, 2026 and your code edits prior context on Fable 5.1 or Opus 5.5, check it.
• Cost of false positives: fewer than 0.1% of benign requests may be blocked, and those blocked requests are charged.
• Untested against strong attackers: Anthropic has not yet seen a highly sophisticated, persistent attempt to circumvent these defenses, and does not know how long the gains will last.
• Narrow measurement scope: the token-reduction figure covers only Anthropic's platform. Distillers also route traffic through third-party clouds and other inference providers, which this measurement does not cover.