Anthropic details new defenses that reduce distillation data harvesting by up to 99%

Anthropic reports substantial progress in mitigating distillation attacks, covert campaigns where fraudulent accounts extract model capabilities to train competing AI systems. Early evidence indicates these new methods have reduced the amount of data harvested by distillers by 90 to 99 percent.

Why Distillation Matters

Illicit distillation allows companies to mimic frontier capabilities at a fraction of the cost, often bypassing safety safeguards. This poses risks in areas like biology and cybersecurity, as seen with Zhipu’s GLM-5.3, which CAISSI assessed as the most cyber-capable open-weights model to date. Additionally, distilled capabilities are being integrated into foreign military and surveillance systems, creating national security concerns.

New Defense Mechanisms

Anthropic has implemented three primary strategies to disrupt these attacks:

• Controlling Reasoning Access: With Claude Fable 5.1 and Claude Opus 5.5, the company introduced preserved thinking, which prevents new API accounts from editing prior context. This blocks techniques where attackers move reasoning blocks between conversations or models to trick the AI into revealing hidden thoughts.
• Two-Stage Classifiers: A new classifier system, similar to those used for cybersecurity and biology safeguards, detects and blocks extraction attempts. This system has a false positive rate of less than 0.1% and is applied to models including Claude Sonnet 5.5, Claude Opus 5/5.5, and Claude Fable 5/5.1.
• Stricter Account Controls: Repeated attempts to extract reasoning result in stricter usage limits or account bans. Since September 24, Anthropic has resumed charging for requests blocked by these safeguards.

Effectiveness and Trade-offs

The new defenses have proven highly effective, with the number of reasoning tokens extracted by distillers falling by a factor of 10 to 100 compared to previous levels. In some cases, extraction attempts were too small to measure. However, these measures involve trade-offs: legitimate developers may need to update integrations due to preserved thinking, and the classifiers occasionally block benign requests (though at a rate below 0.1%).

Anthropic emphasizes that preventing distillation requires industry-wide cooperation, as attackers can still target platforms with weaker safeguards. The company has turned away significant revenue and trillions of tokens from distillers to maintain these defenses.