Anthropic says new defenses cut data stolen by model distillers by up to 99%

Distillation attacks try to copy one model's capabilities into another by prompting it at scale, usually through networks of fraudulent accounts. What the attackers want most is Claude's reasoning transcripts, the step-by-step thinking before an answer, because those teach a smaller model how Claude gets there. In a detailed writeup, Anthropic says its new defenses have cut the data distillers can extract by roughly 90 to 99 percent, with reasoning tokens harvested falling 10 to more than 100 times on its own measurements.

The company walks through the back and forth. An early fix was to summarize reasoning before showing it, but that leaves a gap: a model trained on full transcripts scored 80.4% on SWE-bench Verified, versus 71.8% on summarized ones. Attackers then switched to prompting Claude to reproduce its hidden thinking, with one lab testing 12,000 such prompts, and scaled up through proxy networks running hundreds of thousands of fake accounts. Anthropic's response has three parts: locking reasoning context so accounts created after August 31, 2026 cannot edit prior thinking, a two-stage classifier with a false positive rate under 0.1%, and charging for blocked requests since September 24. It has banned tens of thousands of distillation-linked accounts, often within two hours of a campaign starting.

The stakes are why the company bothers. It cites Zhipu's GLM-5.3, assessed as the most cyber-capable open-weight model so far and reportedly built partly on distilled US capabilities, and a case where a user believed to be linked to China's People's Liberation Army routed requests through Moonshot's Kimi to ask Claude to analyze CCTV footage of a specific person. Anthropic says the defenses cost it trillions of tokens of paying traffic and forced some legitimate developers to update their integrations.

Why it matters

If you build on Claude, the new rules change how reasoning flows between accounts and models, so integrations created after August 31 may need changes and a sub-0.1% share of requests could be wrongly blocked. More broadly, labs now treat their own reasoning traces as an asset worth defending, which is a shift in how the closed-model business guards its edge.