Anthropic Says New Claude Defenses Cut AI Distillation Data Harvesting by Up to 99%

Anthropic says its new defenses against AI model distillation attacks have reduced the amount of data harvested from Claude by around 90% to 99%, marking a major step in the company’s effort to prevent unauthorized attempts to replicate the capabilities of its frontier AI models.

The company said its latest measures have also led to the banning of tens of thousands of accounts linked to distillation campaigns.

Anthropic Targets Industrial-Scale AI Model Extraction

Anthropic describes distillation attacks as “covert, industrial-scale campaigns” designed to extract the capabilities of one AI model and use its responses to train another model without authorization.

Such campaigns can involve networks of fraudulent accounts and allow companies to replicate advanced capabilities at a fraction of the usual development time and cost.

The company said it is particularly concerned because distilled models can approach the capability frontier without necessarily having equally robust safeguards. Anthropic warned that such models could create significant risks in areas including biology and cybersecurity.

Anthropic also raised national security concerns, alleging that capabilities obtained through distillation are being integrated into foreign military, intelligence and surveillance systems. It cited a case in which requests to Moonshot’s Kimi models were secretly forwarded to Claude as part of a distillation effort.

New Safeguards Target Claude’s Reasoning and Persistent Attackers

Anthropic said distillers increasingly target Claude’s reasoning transcripts because these can be more valuable for training another model than final answers alone. Its initial defense involved summarizing Claude’s reasoning before showing it to users.

In one test, a model trained on full Claude Opus 4.8 transcripts achieved 80.4% on SWE-bench Verified, compared with 71.8% when trained on summarized transcripts.

Attackers subsequently developed more sophisticated methods to obtain full reasoning, including attempts to manipulate Claude into revealing it. Anthropic said one lab tested 12,000 requests using different approaches. Some attackers also created proxy networks controlling hundreds of thousands of fraudulent accounts; one network previously identified by Anthropic managed more than 20,000 fraudulent accounts at once.

Anthropic’s newer defenses operate in three main ways. With Claude Fable 5.1 and Claude Opus 5.5, “preserved thinking” prevents new API accounts from editing Claude’s prior context. The company has also restricted access to reasoning transcripts and prevented weaker earlier models from reading protected reasoning from newer models.

A two-stage classifier is now used to detect attempts to extract Claude’s reasoning. Anthropic said its safeguards are “roughly as robust as those that prevent Claude from helping build bioweapons,” while maintaining a false-positive rate of less than 0.1%.

The company said the classifier now catches all distillation techniques described in its September report. After its introduction, reasoning tokens extracted by distillers became consistently 10 to 100 times lower than before, while tens of thousands of associated accounts have been banned, often within two hours of starting a campaign.

Anthropic acknowledged trade-offs, including integration changes for some developers, occasional blocking of benign requests and charges for certain blocked requests.

Still, it said, “Distillation is a problem that every model developer faces and must confront,” and argued that developers and platforms must work together because attackers can distribute traffic across APIs, cloud platforms and inference providers.