Full Breakdown
Anthropic Deploys Multi-Layered Defenses to Slash Model Distillation Data Theft
By Drooid · · How we work
Core Event – New Safeguards Cut Distillation Data by 90-99%
On October 12, Anthropic announced that new safeguards for its Claude models have reduced data harvested by “distillation attacks” to roughly one-tenth to one-hundredth of previous levels. The company reports reasoning-token extraction is now 10 to 100 times lower than before.
Background & Context – Rise of Distillation Attacks Amid U.S.–China AI Competition
Distillation attacks extract a model’s inference records, especially internal reasoning transcripts, to train smaller copies. Anthropic, OpenAI, Google and others warn that such techniques let competitors replicate frontier capabilities quickly, raising safety and national-security concerns. Anthropic cited the Chinese AI startup Zhipu (also known as Z.ai or Z.AI) as having attempted to distill Claude while developing its GLM-5.3 model.
Data & Statistics – Measurable Impact of the Defenses
| Metric | Reported Figure |
|---|---|
| Reduction in harvested data | 90 %–99 % lower |
| Reasoning-token extraction | 10–100 × lower |
| False-positive rate of classifier | < 0.1 % |
| Accounts banned or frozen | Tens of thousands |
| “Preserved thinking” rollout | New API accounts on/after Aug 31 2026 |
| Billing for blocked requests resumed | Sept 24 (limited to < 0.1 % false-positive rate) |
| OpenAI’s related action | Blocked a distillation campaign Sept 30 |
Official Statements & Responses – Anthropic’s Rationale and Claims
Anthropic described the defenses as a “multi-layered” system protecting Claude’s reasoning through three pillars: (1) preserved thinking, which stops newly created API accounts from editing prior context; (2) a two-stage classifier with a false-positive rate below 0.1 %; and stricter usage limits and account freezing for repeat offenders, with billing resumed after September 24. The company likened the robustness to safeguards that prevent Claude from assisting in biological-weapon creation.
Anthropic acknowledged trade-offs: some developers updated integrations, and the classifier can misidentify benign requests. It argues the security benefits—especially mitigation of national-security risks from illicitly distilled models—justify the costs.
OpenAI, on September 30, announced its own detection and blocking of a distillation campaign targeting protected reasoning.
Conflicting Reports & Gaps – Limited Independent Verification
All reductions are reported by Anthropic in its blog and press releases; no external audits have been provided, leaving the precise effectiveness unverified.
Why It Matters – Security, Competition, and Industry Practices
By curbing extraction of Claude’s reasoning, Anthropic aims to prevent foreign actors from reproducing U.S. AI capabilities amid the U.S.–China AI rivalry. The company urges cloud providers and inference-service platforms to detect and remove fraudulent accounts early, calling for collective action to sustain safeguards across the frontier-model ecosystem.
What’s Next – Ongoing Adaptation
Anthropic says its monitoring system will evolve to address new evasion techniques, and future updates will extend the two-stage classifier to additional models. The firm expects the cat-and-mouse dynamic with distillers to persist, requiring continued investment in detection, account management and developer coordination.
