# Anthropic: new safeguards cut what distillers harvest by 90 to 99%

> A distillation attack extracts a model's reasoning transcripts through the API and trains a competing model on them.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Lab safety
- **Published by:** Anthropic
- **Disclosed:** 2026-10-12
- **Affects:** Claude API, Claude Sonnet 5.5, Claude Opus 5.5, Claude Fable 5.1
- **Research by:** Anthropic
- **Primary source:** https://www.anthropic.com/research/distillation-defenses
- **Page:** https://theinjection.dev/items/anthropic-distillation-defenses/

Anthropic published the defenses it runs against distillation attacks, where fraudulent accounts pull Claude's reasoning transcripts from the API to train other models. Anthropic says the methods cut harvested data by 90 to 99%.

## What happened

Anthropic set out its anti-distillation defenses on October 12, 2026, in a post under its Policy section. The post describes covert campaigns that copy one model's capabilities into another without the developer's permission, and names two cases: Anthropic says Zhipu distilled cyber capabilities while building GLM-5.3, and that requests to Moonshot's Kimi were secretly forwarded to Claude. Anthropic's stated worry is that a distilled model can approach frontier capability without comparable safeguards.

## How it works

The prize is the reasoning transcript, because it shows how a model reaches an answer rather than just the answer. Attackers moved from passive collection of ordinary traffic to active extraction, with prompts that ask Claude to output its prior reasoning verbatim, character for character, routed through proxy networks of false identities; Anthropic says one such network ran more than 20,000 accounts at once. The defense has three parts: summarize reasoning before it is shown and keep it inside the requesting organization, screen requests with a two-stage classifier built on Anthropic's constitutional classifiers research, and raise the cost of repeat attempts through stricter limits, bans and billing.

## Who is affected

Developers building on the Claude API meet two changes. Preserved thinking, which stops an account editing prior context, applies to accounts created on or after August 31, 2026, and Anthropic has charged for blocked requests since September 24, 2026. The classifier runs on the models listed below.

## What to do

Check whether your integration rewrites earlier assistant turns, because preserved thinking blocks that on newer API accounts. Budget for a small share of refusals and their cost: Anthropic puts the classifier's false positive rate under 0.1% and bills requests it blocks before a response.

## Distilled model score, SWE-bench Verified

Higher is better for the distiller. Both runs trained on Claude Opus 4.8 transcripts.

| Result | Score |
|---|---|
| Trained on full transcripts | 80.4% |
| **Trained on summarized transcripts** (this story) | 71.8% |

Source: https://www.anthropic.com/research/distillation-defenses

## Quick facts

- **Affected:** Claude API accounts created on or after August 31, 2026
- **Classifier runs on:** Claude Sonnet 5.5, Claude Opus 5 and 5.5, Claude Fable 5 and 5.1
- **Reported effect:** 90 to 99% less data harvested; 10 to 100 times fewer reasoning tokens extracted
- **False positives:** Under 0.1% of requests
- **Billing:** Blocked requests charged since September 24, 2026
- **Status:** Anthropic's account of its own platform, not independently verified

## Sources

1. [Anthropic Policy Post](https://www.anthropic.com/research/distillation-defenses)
2. [Classifiers Research](https://www.anthropic.com/research/constitutional-classifiers)