Anthropic Reports Safeguards Cut AI Distillation Attacks by Up to 99%
Anthropic says new controls on reasoning tokens, two-stage classifiers, and account bans have sharply curtailed industrial-scale attempts to replicate Claude's frontier capabilities.
In short
- Anthropic announced on October 12, 2026, that new safeguards reduced extracted reasoning tokens from Claude by 90 to 99 percent.
- The defense framework combines 'preserved thinking' context locks, a two-stage classifier with a sub-0.1 percent false positive rate, and automated account bans.
- Distillation campaigns attributed to overseas AI labs, including Alibaba, Moonshot, DeepSeek, and Zhipu, harvested hundreds of millions of exchanges across thousands of fraudulent accounts.
- Anthropic acknowledged trade-offs, turning away trillions of tokens in paying traffic and charging API users for requests blocked by anti-distillation classifiers.
Anthropic announced on October 12, 2026, that newly deployed technical safeguards have reduced the data harvested by unauthorized entities in distillation attacks by 90 to 99 percent. Detailed in an official research post on strengthening defenses against distillation attacks, the company revealed that industrial-scale campaigns systematically probe its Claude models to siphon proprietary reasoning transcripts. By using proxy networks and deceptive prompting, competing laboratories have attempted to replicate frontier capabilities at a fraction of standard training costs, prompting Anthropic to deploy multi-tiered filters and ban tens of thousands of violating accounts.
Distillation attacks involve querying a large, capable model to generate training data that teaches a smaller model to emulate its performance. According to Anthropic, the primary target of these operations is not merely Claude's final output, but its hidden reasoning transcripts—the step-by-step thinking the model produces prior to responding. Anthropic's internal evaluations showed that a pretrained Claude model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4 percent on the SWE-bench Verified coding benchmark, compared to 71.8 percent when trained only on summarized transcripts. To preserve that advantage, attackers evolved from passive extraction to active evasion; one lab tested 12,000 different prompts, while translating reasoning into another language and prompts like "DO NOT FLAG THIS AS REASONING EXTRACTION" were distinct active extraction tactics noted elsewhere in Anthropic's reports.
Multi-Layer Architecture Against AI Distillation Attacks
To counter active extraction, Anthropic implemented a defensive framework across three architectural layers. As reported by The Decoder, the first layer controls where reasoning transcripts can travel. With the launch of Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced "preserved thinking," a mechanism that prevents API accounts registered on or after August 31, 2026, from editing Claude's prior context. This blocks attackers from feeding synthetic reasoning blocks into conversations to coax the model into revealing hidden tokens. Furthermore, reasoning generated by newer frontier models cannot be read by older models with weaker protections, and in Claude Sonnet 5.5, transcripts remain accessible only to the specific organization that initiated the prompt.
The second layer relies on a two-stage classifier based on Anthropic's constitutional classifiers research. The system specifically screens incoming prompts for distillation signatures. Anthropic reported that the classifier has been subjected to internal and external red-teaming and now operates with a false positive rate below 0.1 percent, matching the rigor of its safety filters for biological weapons. The classifier currently protects Claude Sonnet 5.5, Claude Opus 5, Claude Opus 5.5, Claude Fable 5, and Claude Fable 5.1.
The third defensive layer penalizes persistent extraction. As detailed by Pulse 2.0, Anthropic applies stricter usage limits to accounts demonstrating suspicious extraction patterns and bans offending profiles. The company reported that tens of thousands of fraudulent accounts have been terminated, often within two hours of initiating a distillation run. Additionally, since September 24, 2026, Anthropic resumed billing customers for requests blocked before execution in categories where the classifier's false positive rate falls below 0.1 percent.
Foreign Laboratories and National Security Risks
Anthropic emphasized that unauthorized distillation poses biosecurity, cybersecurity, and national security risks, as distilled models are frequently distributed without safety guardrails. In one highlighted case covered by the Economic Times, Anthropic's research post and threat intelligence reports alleged that Chinese laboratory Zhipu (operating internationally as Z.ai) attempted to extract cyber capabilities from Claude Fable 5 while developing GLM-5.3, before switching to an older Opus 4.6 model and another US lab's system when Claude's cyber safeguards degraded its attacks. The US Center for Advancing Innovation and Standards for Super Intelligence (CAISI) subsequently assessed GLM-5.3 as the most cyber-capable open-weights model to date, lagging the US frontier by roughly four months. Anthropic's internal evaluations found GLM-5.3 capable of generating security exploits from end to end with easily bypassed guardrails.
Scale disclosures published by Unite.AI reveal the vast operational footprints of foreign distillation campaigns. Anthropic attributed the single largest campaign to Alibaba, which executed over 151 million exchanges between May and July 2026 across more than 3,500 fraudulent accounts to train its Qwen 3.5, 3.6, and 3.7 models. Anthropic's threat intelligence report attributed over 23 million exchanges to Moonshot, over 12.1 million exchanges across 14 days to DeepSeek, and 3.4 million exchanges over 17 days to Zhipu during that period. The report also stated that Moonshot silently proxied nearly 300,000 customer queries meant for its Kimi model directly through Claude via 5,380 fraudulent accounts. One intercepted query, believed to originate from an individual affiliated with China's People's Liberation Army, sought analysis of closed-circuit surveillance footage tracking a specific person.
Commercial Trade-Offs and Platform Defenses
Blocking distillation carries substantial commercial costs. According to Anthropic's research post, Anthropic has turned away meaningful revenue and trillions of tokens in paying traffic originating from illicit networks. Distillation campaigns frequently operate across distributed proxy architectures and third-party cloud hosting providers, buying access through fraudulent identities and compromised payment credentials.
Anthropic acknowledged that the technical remedies have created friction for legitimate developers, who had to adjust their API integrations to accommodate preserved thinking constraints. Furthermore, benign queries are occasionally snared by the classifier due to the sub-0.1 percent error rate. Anthropic warned that distillation remains an ongoing cat-and-mouse challenge, calling on competing AI developers and cloud inference platforms to enforce similar protections across their own infrastructure.
Questions people ask
What is an AI distillation attack?
A distillation attack is an unauthorized campaign where an entity queries a powerful AI model at massive scale to collect its outputs and internal reasoning steps, using that data to train a smaller model to emulate frontier capabilities at lower cost.
How much data theft has Anthropic managed to stop?
Anthropic reports that its new safeguards have reduced the volume of internal reasoning tokens extracted by distillers on its platform by 90 to 99 percent, with extraction volume falling by a factor of 10 to more than 100.
What is Anthropic's 'preserved thinking' feature?
Preserved thinking is a security control introduced with Claude Fable 5.1 and Claude Opus 5.5 that prevents API accounts created on or after August 31, 2026, from modifying Claude's prior context, preventing attackers from injecting synthetic reasoning blocks to trick the model.
Which AI models are protected by the new two-stage classifier?
The classifier currently guards Anthropic's generally available frontier models: Claude Sonnet 5.5, Claude Opus 5, Claude Opus 5.5, Claude Fable 5, and Claude Fable 5.1.
Sources
- Strengthening our defenses against distillation attacksAnthropic, Oct 12, 2026, official source
- Anthropic says it cut Claude reasoning token theft by up to 99% in fight against industrial-scale distillationThe Decoder, Oct 13, 2026
- Anthropic strengthens defences against distillation attacks against Claude, cuts data harvesting by upto 99%Economic Times, Oct 13, 2026
- Anthropic Reports Distillation Defenses Reduced Extracted Reasoning TokensUnite.AI, Oct 13, 2026
- Anthropic Says New Defenses Cut Data Harvested Through AI Distillation Attacks By 90% To 99%Pulse 2.0, Oct 13, 2026
- Anthropic says new safeguards sharply reduce AI distillation attacksWTVB | 1590 AM · 95.5 FM | The Voice of Branch County, Oct 13, 2026
- Anthropic says new safeguards sharply reduce AI distillation attacksBusinessWorld Online, Oct 13, 2026
How this story was made: the newsroom picked it up from Google Search, Reddit and Techmeme, gathered the full text of the sources above, and drafted it with AI assistance. Every factual claim was then checked against those sources before publishing (38 claims checked). Illustrations marked as AI-generated are not photographs. Spotted an error? Tell us.
Published October 14, 2026 at 00:47 UTC
