- Anthropic said on October 12, 2026 that 'early evidence' suggests its new defenses have cut the data harvested by distillers by 'around 90 to 99%,' and that reasoning tokens extracted on its platform fell 10 to 100 times after a new classifier launched. Both figures are Anthropic's own.
- The defenses are preserved thinking on Claude Fable 5.1 and Opus 5.5, a two-stage extraction classifier with a false positive rate Anthropic puts below 0.1%, and stricter limits and bans. Anthropic says it has banned tens of thousands of accounts, 'often in less than two hours' after a campaign starts.
- For developers, the visible changes are in the API: on accounts created on or after August 31, 2026, editing conversation history before a thinking block from Fable 5.1, Opus 5.5, Sonnet 5.5 or Haiku 5.5 returns a 400 error, and since September 24 some refusals that arrive before any output are billed.
Contents
On October 12, 2026, Anthropic said its new distillation defenses are working. In a post titled "Strengthening our defenses against distillation attacks," it wrote that "early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%." The defenses include a feature called preserved thinking on Claude Fable 5.1 and Claude Opus 5.5, a new classifier that spots extraction attempts, and fast account bans. This explainer covers what distillation is, why Anthropic treats it as an attack, how each defense works, and what it changes for developers who use the Claude API.
It is based on Anthropic's October 12 post, its February 23, 2026 report on distillation, its September 2026 threat-intelligence report, the Claude API release notes and thinking documentation, and Associated Press reporting, all checked October 14, 2026. The effectiveness numbers are Anthropic's own and haven't been independently verified.
The short version
- Distillation is training a smaller or cheaper model on a stronger model's outputs. It's a standard technique. Anthropic objects when rival labs do it to Claude at scale through fraudulent accounts.
- The prize is reasoning. Anthropic says full reasoning transcripts are what make distillation work. Its own test showed a model trained on full transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained on summaries.
- Three defenses: control where reasoning can go (preserved thinking), block extraction attempts (a two-stage classifier), and make repeat attempts costly (limits, bans and billing for some blocked requests).
- Claimed results (vendor-reported): around 90–99% less data harvested; 10–100 times fewer extracted reasoning tokens; tens of thousands of accounts banned.
- Anthropic's caveat: it calls this a cat-and-mouse game and says it "ha[s] yet to see a highly sophisticated and persistent attempt to circumvent" the defenses.
What is distillation?
Distillation is a way to transfer what a large "teacher" model can do into a "student" model. You send the teacher many prompts, save its answers, and train the student to produce the same answers. Anthropic's February report defines it as "training a less capable model on the outputs of a stronger one."
Labs distill their own models all the time. It's how many small, cheap models are made, as our explainer on why labs ship mini models first describes. Anthropic itself calls distillation "a widely used and legitimate training method." The dispute is about distilling someone else's model without permission. In February, Anthropic said the campaigns it found broke its "terms of service and regional access restrictions," and noted that it "does not currently offer commercial access to Claude in China." It describes the campaigns it sees as "covert, industrial-scale" efforts run through networks of fake accounts and proxy services.
Why is reasoning the main target?
Modern models like Claude think before they answer. Those thinking tokens show how a model reaches an answer, not only the answer itself, which makes them far more valuable as training data. Our reasoning models explainer covers how thinking works and what it costs.
Anthropic quantified the difference. It trained a pretrained Claude model on transcripts from Claude Opus 4.8 and measured it on SWE-bench Verified, a coding benchmark. With full reasoning transcripts, the student scored 80.4%; with summarized transcripts, 71.8%. This was Anthropic's own internal experiment. The post doesn't say how many transcripts were used, and one benchmark result can't tell you how much a summary protects across all tasks. Still, it explains why Anthropic summarizes Claude's visible reasoning, and why attackers moved on to trying to pull out the full version.
Who has Anthropic accused?
The October 12 post builds on two earlier rounds of allegations. All of them are Anthropic's allegations.
- February 23, 2026. Anthropic accused DeepSeek, Moonshot AI and MiniMax of campaigns totaling more than 16 million exchanges with Claude through about 24,000 fraudulent accounts. It attributed over 150,000 exchanges to DeepSeek, over 3.4 million to Moonshot and over 13 million to MiniMax. Our Anthropic explainer covers this round.
- September 2026. Anthropic's September threat-intelligence report says it "identified and disrupted additional distillation attacks against Claude from seven labs based in China." It names Alibaba, DeepSeek, MiniMax, Moonshot AI, SenseTime, Xiaomi and Zhipu (Z.ai), and says operators affiliated with Alibaba "ran the largest distillation attack we have ever measured," with over 151 million exchanges between May and July 2026. DeepLearning.AI's The Batch, which covered the report on September 18, gave a May–June range for that campaign; the figures here are from Anthropic's report. Our coverage of DeepSeek-V4.1-Flash noted that the report named DeepSeek on the day that model launched.
- The October 12 post names two cases. It says "Zhipu, for example, distilled the cyber capabilities of leading US models during the development of GLM-5.3," and that "requests to Moonshot's Kimi models were secretly forwarded to Claude as part of its distillation efforts." It also says the proxy networks "resold access to Claude in regions where it is not offered."
The US government has made similar claims. On September 9, 2026, the Associated Press reported that a joint advisory from the FBI, NSA and CISA said Chinese developers including DeepSeek, Alibaba, Moonshot AI and Z.ai had distilled capabilities from models including Claude, GPT, Gemini and Grok. China's Commerce Ministry called the claims groundless and said distillation "is a common practice," per AP. The Foreign Ministry urged the US to "refrain from making unfounded accusations or smears."
How do Anthropic's defenses work?
Anthropic describes three layers.
1. Controlling where reasoning can go: preserved thinking
Anthropic says preserved thinking on Claude Fable 5.1 and Claude Opus 5.5 stops new API accounts from editing Claude's prior context. The reason: one extraction technique is to replay a conversation over and over with small edits to earlier turns, nudging the model to reveal more of its reasoning each time.
The API documentation spells out the mechanics, and describes preserved thinking as a property of newer Claude models "that guards against distillation." Each thinking block carries a signature. Starting with Fable 5.1, the API checks that block against two things: the model that produced it, and everything sent before it. If the system prompt, the tools or any earlier message has changed, the block is invalid. The docs say this prefix check runs on Claude Fable 5.1, Claude Opus 5.5, Claude Sonnet 5.5 and Claude Haiku 5.5, and not on Claude Mythos 5.1 or older models. For accounts created on or after August 31, 2026, the API enforces it by default, so a replayed block after an edit returns a 400 error. Older accounts can opt in through a beta header.
Two related rules limit where reasoning travels:
- Model binding. Per the September 1 release notes, thinking blocks from Fable 5.1 are "preserved only for the model that produced them or a newer one." Earlier models with weaker safeguards can't read them.
- Account binding. Per the September 28 release notes, Sonnet 5.5's thinking blocks "work only in the account that produced them, or in an account linked to it." Another account's blocks are dropped. The preserved thinking documentation says Haiku 5.5's thinking blocks are tied to the producing account too.
2. Blocking extraction attempts: a two-stage classifier
Anthropic built a two-stage classifier, based on its constitutional classifiers research, that detects attempts to extract reasoning. It says the classifier was red-teamed internally and externally, has a false positive rate below 0.1%, and is about as robust as its bioweapons safeguards. It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.
3. Making repeat attempts costly
Accounts that keep trying face stricter usage limits, and repeat offenders are banned. Since September 24, 2026, Anthropic has billed refusals that arrive before any output in three categories, including reasoning_extraction, where it says false positives are rare. Before that, a blocked request cost the attacker nothing.
How well does it work?
All of these results come from Anthropic, measured on its own platform, and published October 12, 2026:
| Claim | What it measures | Caveat |
|---|---|---|
| Around 90–99% less data harvested | Amount of data distillers obtained | Described as "early evidence"; method not detailed |
| 10–100 times fewer extracted reasoning tokens | Reasoning tokens taken by distillers after the classifier launched | On some days too small to measure, per Anthropic |
| Tens of thousands of accounts banned | Accounts tied to distillation | "Often in less than two hours" after a campaign begins |
| Below 0.1% false positives | Legitimate requests wrongly blocked | Anthropic's own measurement |
Last verified: October 14, 2026
No outside party has checked these figures. They also can't capture distillation Anthropic doesn't detect, or traffic through other platforms that serve Claude. Anthropic says it doesn't know how long the gains will last.
What does it cost legitimate users?
Anthropic lists trade-offs. It says it has turned away "meaningful revenue and trillions of tokens' worth of paying traffic from distillers." Some developers had to update their integrations for preserved thinking. Fewer than 0.1% of benign requests may be blocked, and some blocked requests are now billed. On its February goal of making distillation harder "without affecting the experience for legitimate users," Anthropic writes: "We haven't met this goal completely."
If you build on the API, the practical rule is in the docs: treat conversation history as append-only. Send each assistant turn back exactly as received and add new messages at the end. To change instructions mid-conversation, use mid-conversation system messages, tool-addition blocks or server-side compaction instead of editing earlier turns. Our guide to which Claude model to use covers the other API changes in the current lineup.
What's confirmed, reported and uncertain
- Confirmed (Anthropic's post and API docs): the three defenses; the August 31, 2026 account cutoff and 400 error for edited history on Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5; model and account binding; billing for some refusals since September 24.
- Vendor-reported: the 90–99% and 10–100x reductions, the ban count and timing, the below-0.1% false positive rate, and the SWE-bench transcript experiment.
- Allegations: every claim that a named lab distilled Claude. China's government rejects them, per AP.
- Uncertain: how Anthropic measured the 90–99% figure, and how long the defenses will hold against a determined attacker.
About this storyBased on the sources linked below. Editorial standards
