Anthropic says early evidence suggests its distillation defenses have cut the amount of Claude data harvested by distillers by around 90 to 99 percent, and it is publishing the methods to show there is a workable alternative.
Distillation, in Anthropic's description, means covert campaigns that harvest millions of responses from a stronger model to teach a smaller one to imitate it, often through networks of fraudulent accounts. The prize is Claude's written-out reasoning, which shows a student model how an answer was reached. Anthropic's test: a model trained on full transcripts from an earlier Opus model scored 80.4% on SWE-bench Verified, against 71.8% when trained on summarized reasoning, one of the company's first countermeasures. Distillers then moved to active extraction, including prompts asking Claude to repeat its prior reasoning verbatim, and spread requests across proxy networks the company says control hundreds of thousands of accounts.
The current distillation defenses work in three layers. Preserved thinking, introduced with the newest Fable and Opus releases, stops API accounts created on or after August 31, 2026 from editing earlier context, and Sonnet 5.5 reasoning transcripts can be read only by the organization that generated them. A two-stage classifier, built like the company's constitutional classifiers for biology and cybersecurity, blocks extraction requests; Anthropic puts its false positive rate below 0.1%. Users who keep probing face tighter usage limits and bans, and since September 24 blocked requests in those areas are billed again.
Anthropic reports that tokens of reasoning extracted on its own platform fell by a factor of 10 to 100 or more after the classifier went live, and that it has banned tens of thousands of accounts, often within two hours of a campaign starting. The distillation defenses carry costs, and the company says so: it turned away what it calls meaningful revenue, some developers had to rework integrations, and legitimate requests can occasionally be blocked.
Every figure for the distillation defenses comes from Anthropic's own tests, the extraction estimate is measured only on its own platform, and the company notes that distillers also draw on third-party clouds and other inference providers. It also says it has not yet seen a highly sophisticated, persistent attempt to get around the new safeguards, and calls the contest cat and mouse. The company names Zhipu's GLM-5.3 as the case that shows why one lab's defenses are not enough when a rival model without them stays available.
