AI news ·
Anthropic says new defenses cut distillation harvesting by 90 to 99 percent
Anthropic's new defenses cut model distillation by 90 to 99 percent, targeting reasoning transcripts that let a distilled model hit 80.4% on SWE-bench Verified.
Anthropic has rolled out new defenses that it says reduce what competitors can extract through model distillation by 90 to 99 percent. The announcement, published in an October 12 research post, details a bundle of technical changes embedded in Claude Fable 5.1 and Opus 5.5, and names two Chinese AI labs it accuses of running distillation campaigns against its models.
The core target for distillers is not Claude's final answers but its reasoning transcripts - the step-by-step thinking the model produces before responding. Anthropic reports that a model distilled from Claude's full reasoning transcripts scored 80.4% on SWE-bench Verified. When distilled from only summarized reasoning, that figure dropped to 71.8%. Closing off access to those transcripts is the central aim of the new safeguards.
Preserved thinking locks down prior context
The primary technical defense is a feature called preserved thinking. New API accounts created after August 31, 2026 cannot edit Claude's prior context. Anthropic's post identifies context editing as the technique attackers use to pull long reasoning transcripts out of the model. By blocking that vector, the company aims to starve distillation pipelines of their richest training material.
A two-stage classifier now screens outputs across Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Anthropic says the system's false positive rate sits below 0.1 percent. Accounts flagged for repeated attempts face stricter rate limits, and associated accounts are banned within two hours of detected distillation campaigns. The company says tens of thousands of accounts have been banned and that reasoning token extraction is down 10- to 100-fold. High-confidence blocked requests have been billed since September 24.
Two Chinese labs named in the post
The research post names specific actors. Zhipu is said to have been "distilling cyber capabilities into GLM-5.3." Moonshot's Kimi models, according to the post, "secretly forwarded" requests to Claude, including "surveillance analysis requests potentially linked to China's People's Liberation Army." Anthropic offers these as examples of the distillation activity its defenses are designed to stop.
No third party has verified the 90 to 99 percent reduction figure. The data comes entirely from Anthropic's own measurements. The company also acknowledges downsides: "revenue loss and substantial internal resource investment" from the defensive measures, plus occasional false positives that affect legitimate users.
Why this matters for executives and IT leaders
Distillation is a known technique for building competitive models at lower cost, and the reasoning transcripts that Anthropic is now walling off represent some of the most valuable training data an API can leak. For organizations buying access to frontier models, these defenses signal that API terms of service are shifting from legal documents to technically enforced boundaries. The fact that Anthropic is billing for blocked, high-confidence distillation requests - and naming specific rival labs - also suggests the commercial stakes around reasoning data are escalating beyond what standard rate limits and acceptable-use policies can handle.