Anthropic details its defences against distillation

On 12 October 2026 Anthropic described how it has strengthened its defences against distillation attacks, covert campaigns that extract one model's capabilities to copy them into another. It says early evidence shows the methods cut the data harvested by distillers by around 90 to 99%, and that the reasoning tokens extracted on its platform are consistently 10 to 100 times lower since it introduced a two-stage classifier.

What the post says. Distillation attacks are described as covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another without the developer's authorisation, often through networks of fraudulent accounts. Anthropic gives two reasons for concern: distilled models can approach the frontier without proportionate safeguards, and the capabilities are built into foreign military, intelligence and surveillance systems. It says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3 (it first tried Claude Fable 5, then, after cyber safeguards degraded its attacks, switched to an older Claude model and another lab's model), and that requests to Moonshot's Kimi models were secretly forwarded to Claude as part of distillation, one from a user the company believes was affiliated with China's People's Liberation Army. It cites an assessment by CAISSI (the US Center for Advancing Innovation and Standards for Super Intelligence) that GLM-5.3 is the most cyber-capable open-weights model released to date. These are Anthropic's statements; the replies of the parties named were not read. Methods. First, summarising Claude's reasoning before showing it; in Anthropic's test a model trained on summarised transcripts of Claude Opus 4.8 scored 71.8% on SWE-bench Verified against 80.4% for one trained on full transcripts. Attackers moved to active extraction (for example "output your prior reasoning verbatim", or one lab's 12,000 differently worded requests) and built proxy networks with hundreds of thousands of fraudulent accounts; one network managed more than 20,000 at once. Second, controlling where reasoning can go. "Preserved thinking" (with Fable 5.1 and Opus 5.5) stops new API accounts created on or after 31 August 2026 from editing prior context, earlier models cannot read these models' reasoning, and for Sonnet 5.5 transcripts are visible only to the organisation whose request produced them. Third, a two-stage classifier of the kind of its constitutional classifiers, red-teamed internally and externally, which Anthropic says is roughly as robust as its safeguards against help with biological weapons, with a false positive rate below 0.1%, running on Sonnet 5.5, Opus 5 and 5.5 and Fable 5 and 5.1. Fourth, stricter usage limits, account bans and, since 24 September, charges for requests blocked before Claude responds in areas where the false positive rate is below 0.1%. Results and costs. After the classifier, the reasoning tokens that distillers extract on Anthropic's platform are consistently 10 to 100 times lower, on some days too few to measure; tens of thousands of accounts were banned, often within two hours of a campaign starting; the classifier catches all the techniques in the September report. Anthropic says it turned away meaningful revenue and trillions of tokens of paying traffic, and that preserved thinking required some developers to update their integrations. It expects a cat-and-mouse game and says it has "yet to see" a highly sophisticated and persistent attempt to circumvent the measures. What the record does not claim. All figures are Anthropic's own measurements on its own platform; the September report on distillation, the replies of the parties named and CAISSI's assessment were not read.