Anthropic reported on October 12, 2026, that new defensive measures have reduced the volume of data extracted from its Claude models by distillation attacks by approximately 90 to 99 percent, according to internal platform metrics. Distillation attacks are covert campaigns in which unauthorized parties query a frontier AI model at scale to replicate its capabilities in another model without the original developer’s consent.
The company described these attacks as “industrial-scale” efforts conducted through networks of fraudulent accounts, allowing overseas laboratories to mimic advanced AI capabilities for a fraction of the development time and cost. Anthropic stated in a September 2026 report that the method has been used extensively by foreign AI laboratories to keep pace with U.S. companies.
National Security and Safety Concerns
Anthropic outlined two principal concerns. First, distilled models may approach frontier capability levels but are released without proportionally robust safeguards, creating risks in domains such as biology and cybersecurity. The company cited Zhipu’s GLM-5.3 model as an example. According to Anthropic, Zhipu distilled the cyber capabilities of leading U.S. models during GLM-5.3 development, initially targeting Claude Fable 5 before switching to an older Claude model and another laboratory’s model after encountering safeguards. The U.S. Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) assessed GLM-5.3 to be the most cyber-capable open-weights model released to date, according to a September 2026 announcement. Anthropic’s own research found that GLM-5.3’s safeguards can be bypassed and that the model is willing to develop security exploits from end to end.
Second, Anthropic stated that illicitly distilled models present a national security risk because the companies conducting distillation integrate the resulting capabilities into foreign military, intelligence, and surveillance systems. The company reported in September 2026 a case in which requests to Moonshot’s Kimi models were secretly forwarded to Claude as part of distillation efforts. One request came from a user Anthropic believes was affiliated with China’s People’s Liberation Army, who sought to analyze CCTV surveillance of a specific individual.
Technical Defenses and Trade-Offs
Anthropic’s defenses focus on making Claude’s reasoning transcripts—the step-by-step thinking process the model writes before responding—harder for distillers to access. The company stated that reasoning transcripts are more valuable for distillation than final outputs alone because they help a smaller model understand how Claude reaches its answers.
Initial measures included summarizing Claude’s reasoning before displaying it to users. Internal evaluations showed that a pretrained Claude model trained on full transcripts from Claude Opus 4.8 achieved 80.4% on the SWE-bench Verified coding benchmark, compared to 71.8% when trained only on summarized transcripts. However, attackers adapted by employing “active extraction” techniques, ranging from simple instructions to output prior reasoning verbatim to sophisticated campaigns testing thousands of prompt variations. Anthropic described in September one laboratory that tested 12,000 requests, each seeking to trick Claude in a different way.
The company’s current defenses disrupt attacks in three ways. First, Anthropic introduced preserved thinking with Claude Fable 5.1 and Claude Opus 5.5, preventing new API accounts created on or after August 31, 2026, from editing Claude’s prior context. The measure also blocks reasoning transcripts from being read by earlier models with weaker safeguards and, with Claude Sonnet 5.5, restricts reasoning access to the organization that produced the transcript.
Second, Anthropic deployed a two-stage classifier system based on its constitutional classifiers research. The company stated the classifier has been red-teamed internally and externally using manual and automated methods, achieving robustness comparable to safeguards that prevent Claude from helping build bioweapons, with a false positive rate below 0.1%. The system runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1, and is planned for future frontier models.
Third, Anthropic detects accounts used for distillation and applies stricter usage limits or bans. Since September 24, 2026, the company has resumed charging for requests blocked by safeguards before Claude responds in areas with false positive rates below 0.1%, including distillation.
Measured Impact and Limitations
Anthropic stated that after introducing the two-stage classifier, the number of reasoning tokens extracted by distillers on its platform fell consistently by a factor of 10 to 100 compared to pre-implementation levels. On some days, the company reported, the volume of reasoning tokens extracted was too small to measure. The company has used these defenses to ban tens of thousands of accounts associated with distillation, often within two hours of a distillation campaign beginning, according to the October 12 disclosure.
Anthropic acknowledged that the measures involve trade-offs. The company stated in February 2026 that it was working to make distillation harder without affecting legitimate users, but has not fully met that goal. Preserved thinking has required some developers to update their integrations, the classifiers can misidentify or block benign requests in fewer than 0.1% of cases, and the company now charges users for those blocked requests. Anthropic also turned away meaningful revenue and trillions of tokens’ worth of paying traffic from distillers, and invested substantial research and product team time into the problem.
The company stated it does not yet know how long the gains will last, expects distillation to remain an iterative challenge, and has not yet faced a highly sophisticated and persistent attempt to circumvent the new defenses.
Industry-Wide Call to Action
Anthropic stated that preventing illicit distillation requires work and buy-in from all frontier model developers, noting that its efforts would be undermined if attackers could easily access similarly capable models lacking robust anti-distillation safeguards. The company also called on third-party cloud platforms and inference providers to detect and disrupt abuse quickly and offboard fraudulent accounts, noting that distillers distribute traffic across Anthropic’s API, third-party platforms, and other providers. Anthropic acknowledged that industry incentives often favor inaction because defenses are expensive and distillers are paying customers, and stated it published its methods to demonstrate a workable alternative.
Source: www.anthropic.com.
Be the first to comment