Strengthening our defenses against distillation attacks
B · Useful, limited Anthropic policy post describing its own anti-distillation measures with internal effectiveness figures; useful detail, but self-reported, one-sided in its accusations against named labs and not independently checkable.
Summary based on the full text·Original: about 10 minutes to read
In short
Anthropic (12 October 2026) describes how it now defends against distillation: covert, large-scale campaigns that harvest a model's outputs, mainly its reasoning transcripts, to train a competing model. It names Zhipu and Moonshot as offenders. Three measures are described: limits on where reasoning can travel, a two-stage classifier that blocks extraction attempts, and penalties for repeat attempts. Anthropic reports that harvested data fell by about 90 to 99%, and admits the measures cost legitimate developers some friction.
Key numbers
- around 90 to 99%claimed cut in data harvested by distillers
- 10 to 100 timesdrop in reasoning tokens extracted by distillers after the classifier went live
- less than 0.1%false positive rate of the two-stage classifier on benign requests
- 80.4% vs 71.8%SWE-bench Verified score of a model distilled from full vs summarised reasoning transcripts
- more than 20,000fraudulent accounts one distillation network managed at once
As reported by the source.
English·Web page·opens anthropic.com
What it reports
- Summarising reasoning already hurt distillers: a model trained on full Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% on summaries.
- Attackers then moved to active extraction, including one lab testing 12,000 different trick requests, run through proxy networks of hundreds of thousands of fraudulent accounts.
- "Preserved thinking" stops new API accounts (created on or after 31 August 2026) from editing prior context; reasoning from newer models cannot be read by older ones, and on Sonnet 5.5 is visible only to the organisation that produced it.
- A two-stage classifier, red-teamed internally and externally, has a false positive rate under 0.1% and catches all techniques from Anthropic's September report.
- Extracted reasoning tokens fell 10 to 100 times; tens of thousands of accounts were banned, often within two hours of starting.
- Since 24 September, blocked requests are charged in areas where false positives are below 0.1%.
- Claims Zhipu distilled cyber capabilities into GLM-5.3, and that Moonshot forwarded Kimi requests to Claude.
How they got it
Internal telemetry: Anthropic estimates reasoning tokens extracted on its own platform before and after the classifier. The distillation-quality comparison is an internal training experiment. Neither method is described in enough detail to reproduce.
Limits
- All effectiveness figures are self-reported and cover only Anthropic's own platform, not third-party clouds.
- Accusations against named companies come without their response.
- Anthropic says it has not yet seen a highly sophisticated, persistent attempt to circumvent the new defences.
Why it matters for companies
Developers on the API may need to update integrations that edit or replay prior reasoning, and should expect to pay for requests blocked by safety classifiers. Firms that run their own models face the same problem in miniature: outputs are a training asset for anyone with access. The post also shows a trade-off to plan for, as stronger abuse controls mean a small rate of blocked legitimate traffic.
Summary based on the full text. Read the original for the full argument and data.Read the original on anthropic.com
- Tags
- AI security