Anthropic says new defenses cut data harvested by Claude distillers by up to 99%

Anthropic says new defenses against distillation attacks have cut the amount of data harvested from Claude by distillers by about 90% to 99%, according to early estimates in a research post published October 12 and shared on X. Distillation attacks use a stronger model's outputs, especially its reasoning, to train a cheaper copycat model.

A separate measure on its own platform. Anthropic says that after it introduced a new classifier, the number of Claude reasoning tokens extracted by distillers on its own platform has been consistently 10 to 100 times lower than before.

A two-stage classifier. The core of the system is a two-stage classifier that Anthropic says has a false positive rate of less than 0.1%.

'Preserved thinking.' Anthropic also introduced a measure it calls preserved thinking, which prevents new API accounts, those created on or after August 31, from editing Claude's prior context.

Bans, limits and charges. Anthropic says it has banned tens of thousands of accounts tied to distillation, often in less than two hours after an account starts a campaign. Accounts that keep trying face stricter usage limits, and since September 24 Anthropic has charged for requests that its safeguards block.

The cost to Anthropic. The company says it has turned away trillions of tokens' worth of paying traffic from distillers.

Labs named in the post. Anthropic says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3. It also says requests to Moonshot's Kimi models were secretly forwarded to Claude, including one from a user Anthropic believes was affiliated with China's People's Liberation Army.

Anthropic isn't calling it solved. The company says it doesn't yet know how long these gains will last, and that it has not yet seen a highly sophisticated and persistent attempt to get around the new defenses.