Skip to content
Neural Daily

ModelsNews

Anthropic cuts Claude distillation leaks by up to 99%

Anthropic says its new defenses have cut the amount of data distillers can harvest from Claude by around 90 to 99%. The cost: some developers had to update their integrations, and blocked requests are now billed.

By: Mikola Máté Patrik · · 3 min read

Anthropic illustration: a blue fern cyanotype repeated in ever smaller copies across a grid
Image: Anthropic · Press kit · Official cover image of Anthropic's distillation defenses post · Source

Why distillation is a problem

In a distillation attack, a company collects millions of responses from a stronger model and uses them to train a smaller one. Claude's reasoning transcripts are the most valuable part, since they show how the model reaches its answer. Anthropic says these campaigns often run through networks of fraudulent accounts, and one proxy network managed more than 20,000 accounts at once (Anthropic).

The company gives two reasons for concern. Distilled models ship without proportionally robust safeguards, and the capabilities can end up in foreign military and surveillance systems. As an example it cites Zhipu's GLM-5.3, which it says distilled the cyber capabilities of leading US models.

How Anthropic defends Claude

The first step was summarizing Claude's reasoning. In Anthropic's test, a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, while one trained on summarized transcripts reached 71.8%. Attackers then moved to prompts that try to make the model reveal its hidden reasoning.

  • Preserved thinking: since Claude Fable 5.1 and Opus 5.5, API accounts created on or after August 31, 2026 cannot edit Claude's prior context.
  • Newer models' reasoning cannot be read by older models with weaker safeguards, and with Claude Sonnet 5.5 a transcript is only available to the organization that sent the request.
  • A two-stage classifier screens extraction attempts on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, with a false positive rate below 0.1%.
  • Persistent offenders get stricter usage limits and repeat offenders are banned. Anthropic has banned tens of thousands of accounts, often within two hours.
Anthropic chart: reasoning tokens exposed to distillers per day on a log scale, average 8,800x before and 135x after the safeguards
Anthropic · Screenshot · Official chart from Anthropic's distillation defenses post · Source

Daily reasoning tokens exposed to distillers before and after the new safeguards, on a log scale. Source: Anthropic

What it means for developers

Teams on new API accounts can no longer rewrite Claude's earlier reasoning, so agent and chat logic has to account for that. Since September 24, Anthropic again charges for requests its safeguards block before Claude responds. The company admits the sub 0.1% false positive rate is not zero, so a benign request can occasionally get caught.

Anthropic calls distillation a cat and mouse game and says it does not know how long the gains will last. It is asking cloud platforms and other model developers to act against fraudulent accounts as well.

    Produced with the help of AI, reviewed by an editor. How we make our articles

    Reviewed and edited by the Neural Daily desk. About

    Related articles