Anthropic distillation defenses: what the 90 to 99% claim means

Anthropic says it has made it far harder to copy Claude by training on its reasoning, and it published numbers. On October 12 the company said new methods have reduced the amount of data harvested by distillers “by around 90 to 99 percent,” while warning that it does not know how long the gains will last. We read the post in full, including its two charts. This article explains what the defenses are, what the figures show and what they cannot show.

What is a distillation attack?

A covert campaign to copy one model’s capabilities into another without permission. Anthropic describes them as industrial-scale efforts, often run through networks of fraudulent accounts, in which distillers generate millions of responses from a stronger model and train a smaller one to imitate it. The most valuable data is the model’s written-out reasoning, not only its final answer. Anthropic says it worries about this for two reasons: distilled models approach the frontier without proportionally robust safeguards, and they can feed foreign military, intelligence and surveillance systems.

How do Anthropic’s new defenses work?

Three layers, all aimed at making Claude’s reasoning harder to extract:

• Control where reasoning can go. With Claude Fable 5.1 and Claude Opus 5.5, Anthropic introduced preserved thinking, which stops API accounts created on or after August 31, 2026 from editing Claude’s prior context. That makes it harder to reuse proxy-network accounts to trick the model into revealing protected reasoning. It also stops earlier models with weaker safeguards from reading these models’ reasoning, and with Claude Sonnet 5.5 transcripts are accessible only to the organization whose request produced them.
• Block and patch extraction attempts. A two-stage classifier of the kind described in Anthropic’s constitutional classifiers research now runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Anthropic says its safeguards are now “roughly as robust” as those against bioweapons help, with a false positive rate under 0.1%, and that fixes have already closed holes such as asking Claude to translate its earlier reasoning or write it out in tags.
• Make repeated attempts difficult. Persistent extractors face stricter usage limits and bans. Since September 24 Anthropic has also resumed charging for requests its safeguards block before Claude responds, in areas where the false positive rate is under 0.1%.

What do the numbers show?

That reasoning extraction on Anthropic’s own platform dropped sharply, though not to zero. Anthropic estimates the reasoning tokens distillers extract is “consistently 10 to 100 times lower” than before the classifier, and that on some days the amount was too small to measure.

The chart expresses each day as a multiple of September 26, the quietest measurable day after the safeguards went fully on at day 0 (September 19). Before that, the average day is 8,800 times and the peak 56,000 times; after, the average is 135 times. Our arithmetic puts that average drop at roughly 65 times, inside Anthropic’s 10 to 100 range. The chart also shows that the improvement is not smooth: a few days after launch rebound to several hundred times the baseline.

Anthropic also reports what summarizing reasoning did earlier. A pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified; trained on summarized transcripts it scored 71.8%.

How far can you trust the 90 to 99% claim?

Treat it as a credible internal measurement, not an independent one. Four limits matter:

• It is measured on Anthropic’s platform. The post says distillers spread traffic across Anthropic’s API, third-party cloud platforms and other inference providers, so extraction elsewhere is outside these figures.
• It is early. Anthropic says it “does not yet know how long these gains will last” and has “yet to see a highly sophisticated and persistent attempt” to circumvent the measures.
• The measure is tokens, not outcomes. The figures count reasoning tokens exposed and data harvested. They do not show whether a distilled model got worse.
• Nothing is independently verified. We found no outside test of the classifier or of the accounts Anthropic says it banned.

What did Anthropic allege about Zhipu and Moonshot?

That Zhipu distilled US models’ cyber capabilities while building GLM-5.3, and that Moonshot’s Kimi traffic was secretly sent to Claude. Anthropic says Zhipu tried to distill Claude Fable 5 but, after its cyber safeguards degraded the attacks, switched to an older Claude model and another lab’s model. It cites the US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) as having assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and says its own research found the model’s safeguards easy to bypass. We covered the GLM-5.3 cyber report earlier.

For Moonshot, Anthropic points to a case in which requests to Kimi models were forwarded to Claude, including one from a user it believes was affiliated with China’s People’s Liberation Army asking for analysis of CCTV footage of a specific individual. These are Anthropic’s allegations from its own investigations. We did not find a public response from Zhipu or Moonshot.

What does it cost, and what does Anthropic ask others to do?

Anthropic admits trade-offs. Preserved thinking has required some developers to update their integrations, the classifiers can misidentify benign requests in fewer than 0.1% of cases, and those blocked requests are now charged. It says it has turned away “meaningful revenue and trillions of tokens’ worth of paying traffic” from distillers. It argues other developers and platforms must act too, since defenses are expensive and “illicit distillers are still paying customers.”

What is still unknown about the distillation defenses?

• Durability. Anthropic expects a cat-and-mouse game and says it has not yet seen a highly sophisticated attack.
• Independent verification. The extraction numbers, ban counts and classifier results come from Anthropic alone.
• Effect on distilled models. The post does not show how much capability distillers have actually lost.
• Responses from the named labs. We found none.
• How other labs compare. Anthropic says its efforts are undermined by labs without similar safeguards, without naming which ones lack them beyond the Zhipu example.

What to keep in mind

These are our observations:

• The defense targets reasoning, not answers. Anthropic’s own SWE-bench result shows why: full reasoning transcripts were worth about nine points.
• Read the log chart carefully. A 65-fold drop in average exposure is large, but individual days still rebound.
• The scope is narrow. The numbers cover Anthropic’s own platform and its most capable models.
• Developers feel it. Preserved thinking and charged blocked requests change how integrations behave.

Editorial review: October 13, 2026 (AI). Prepared from Anthropic’s research post (read in full, including both charts) and its linked September threat-intelligence report and GLM-5.3 research page (not re-read in full). We did not test the classifier, verify any account bans or contact Zhipu or Moonshot.