Anthropic Blocks 90 To 99 Percent Of Distillation Attacks

Anthropic blocks 90 to 99 percent distillation attacks

Anthropic says it's managed to slash the success rate of distillation attacks against its Claude models by something like 90 to 99 percent. They dropped the details in a blog post on October 12, 2026, framing the whole thing as a necessary countermeasure against industrial-scale operations that basically steal model capabilities and repurpose them in systems without proper guardrails.

How distillation attacks steal model reasoning

Here's how these attacks usually work: bad actors fire off millions of requests to a frontier model, hoover up the responses-especially the internal reasoning traces-and use that data to train a smaller copycat. They typically hide behind armies of fake accounts, stolen credit cards, and proxy networks to stay under the radar. Anthropic argues this lets outfits reach frontier-level performance for a fraction of the R&D cost and time, and they flag two big risks. First, these distilled models usually ship without anywhere near the same safety controls. Second, capabilities siphoned from U.S. models are winding up in foreign military, intelligence, and surveillance gear.

The post calls out two specific cases. Chinese lab Zhipu apparently lifted cyber capabilities from top U.S. models while building GLM-5.3, including a failed swing at Claude Fable 5 that got shut down by Anthropic's safeguards; Zhipu then pivoted to an older Claude model and another lab's system. The U.S. Center for Advancing Innovation and Standards for Super Intelligence has since rated GLM-5.3 as the most cyber-capable open-weights model out there, and Anthropic's own digging found its safeguards are easily bypassed-it'll even develop security exploits end-to-end. In a separate incident, requests to Moonshot's Kimi models were quietly being forwarded to Claude as part of a distillation pipeline. One request came from a user Anthropic links to China's People's Liberation Army, looking to analyze CCTV footage of a specific person.

Anthropic owns up to the trade-offs, too. They say they've walked away from real revenue and trillions of tokens worth of paying traffic from distillers, and their research and product teams have sunk massive effort into this. Some changes have also forced legitimate customers to update their integrations.

Early defense summarized reasoning traces

Their early anti-distillation work centered on summarizing Claude's reasoning before showing it to users, since that reasoning trace is way more valuable for distillation than the final answer alone. In a controlled test, a model trained on full reasoning transcripts from Claude Opus 4.8 hit 80.4 percent on the SWE-bench Verified coding benchmark, while one trained on summarized transcripts only managed 71.8 percent. Attackers adapted by shifting from passive collection to active extraction, using prompts ranging from simple demands to spit out the hidden reasoning to sophisticated campaigns testing thousands of distinct jailbreak variations. One lab ran 12,000 requests, each crafted to trick the model differently. Distillers then scaled this through proxy networks running hundreds of thousands of fake accounts; a network detailed in Anthropic's February report juggled more than 20,000 simultaneous accounts.

New three layer defense architecture stops extraction

The new defense architecture disrupts attacks in three ways. First, a feature called "preserved thinking," rolled out with Claude Fable 5.1 and Claude Opus 5.5, stops new API accounts-those created on or after August 31, 2026-from editing Claude's prior context. This kills the technique of moving protected reasoning blocks between conversations to fool the model into thinking the requester already has access. Those same models also prevent their reasoning from being read by earlier models with weaker safeguards, and with Claude Sonnet 5.5, reasoning transcripts are only visible to the organization that generated them.

Second, Anthropic built a two-stage classifier system based on its constitutional classifiers research to detect and block extraction attempts. Using transcripts of actual distillation attempts, they ran internal and external red-teaming exercises-both manual and automated-and patched every vulnerability the red teamers found. Anthropic claims the resulting safeguards are now roughly as robust as those protecting against misuse in cybersecurity and biology, though the blog post doesn't offer a comparative metric.

The third defensive layer isn't fully described in the published text, which cuts off mid-sentence. Anthropic frames the overall effort as a challenge every model developer has to face and says it hopes the disclosure helps other platforms grasp the threat, the available mitigations, and why the costs are worth eating.

Frequently asked questions

What is a distillation attack and how do attackers carry it out?

A distillation attack involves sending millions of requests to a frontier model to collect its responses, especially internal reasoning traces, then using that data to train a smaller copycat model. Attackers hide behind fake accounts, stolen credit cards, and proxy networks to avoid detection, allowing them to reach frontier-level performance at a fraction of the R&D cost.

Which specific distillation campaigns did Anthropic identify and disrupt?

Anthropic identified two campaigns. Chinese lab Zhipu extracted cyber capabilities from top U.S. models for GLM-5.3, including a failed attempt on Claude Fable 5 before pivoting to an older Claude model. Separately, Moonshot's Kimi models were quietly forwarding requests to Claude, including one from a user linked to China's People's Liberation Army seeking to analyze CCTV footage.

How effective are Anthropic's new defenses against distillation attacks?

Anthropic says its new defenses have slashed the success rate of distillation attacks by 90 to 99 percent. The protections combine "preserved thinking" features that restrict reasoning access, a two-stage classifier system hardened through red-teaming, and a third undisclosed layer. Anthropic claims the safeguards are now roughly as robust as those for cybersecurity and biology misuse.

What are the "preserved thinking" features in Anthropic's updated models?

Rolled out with Claude Fable 5.1, Claude Opus 5.5, and Claude Sonnet 5.5, "preserved thinking" stops new API accounts created on or after August 31, 2026 from editing prior context, prevents reasoning from being read by earlier models with weaker safeguards, and makes reasoning transcripts visible only to the organization that generated them.

What trade-offs did Anthropic accept to block distillation attacks?

Anthropic walked away from real revenue and trillions of tokens worth of paying traffic from distillers. Its research and product teams invested massive effort, and some changes forced legitimate customers to update their integrations. The company frames these costs as necessary to prevent capabilities from reaching foreign military and surveillance systems without proper guardrails.

Source: Anthropic