On October 12 Anthropic published a long post on how it defends Claude against distillation, which means training one model on another model's outputs. What it cares about most is Claude's reasoning transcripts, the thinking written before the final answer, because they teach another model how to think.

The defense has three layers: control where reasoning content can go, use classifiers to block attempts to extract it, and make repeated attempts increasingly costly. Anthropic's own result is a 90-99% drop in the data distillers harvest. All of these numbers are Anthropic's; none has been independently checked.

Two things change for you in practice. On new accounts you can no longer freely rewrite Claude's earlier reasoning context. And requests blocked by the safeguards are now billed. If you build agent platforms, this is a rare look from the defender's side.

Anthropic defines it as covert, large-scale extraction of one model's capabilities to build another, without permission, often through networks of fraudulent accounts. It gives two worries: distilled models may approach the frontier without matching safeguards (biology and cybersecurity are the examples), and the copied capability may end up in military, intelligence and surveillance systems.

Why reasoning? Because a transcript shows how Claude reaches an answer, not just the answer. The post has a concrete comparison: a pretrained model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified; trained on summarized transcripts only, it scored 71.8%. That 8.6-point gap is the number behind "reasoning is valuable".

The post splits the methods in two. Passive distillation: send ordinary requests and train on the responses; early defenses targeted this. Active extraction: once Claude began showing only summarized reasoning, attackers looked for ways to make it reveal the full reasoning. Examples include telling Claude to output its earlier reasoning verbatim, and one lab testing 12,000 requests, each with a different trick.

The scale and evasion are large: proxy networks controlling hundreds of thousands of fraudulent accounts, resold access in unsupported regions, accounts opened with false identities and stolen payment details, and reasoning moved between conversations, between models (using one with weaker safeguards) and between accounts after bans. A February report described one network managing more than 20,000 fraudulent accounts at once.

Layer 1: control where reasoning goes. First, show only summaries of reasoning. Then preserved thinking (introduced with Claude Fable 5.1 and Opus 5.5): new API accounts created on or after August 31, 2026 cannot edit Claude's prior context, so attackers can't use doctored context to coax reasoning out. Reasoning is also no longer readable by earlier models with weaker safeguards. With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.

Layer 2: block and patch. A two-stage classifier, built on Anthropic's constitutional classifiers research and trained on distillers' real extraction attempts. Anthropic says its robustness roughly matches the safeguards against bioweapons help, with a false positive rate below 0.1%. It is deployed on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. New tricks get patched quickly; asking Claude to translate earlier reasoning into another language, or to write it in tags next to the answer, are both blocked now.

This post doesn't describe what "two-stage" looks like inside. A separate Anthropic research post on next-generation constitutional classifiers describes a lightweight linear probe that reads the model's internal activations and screens all traffic, with flagged exchanges passed to a more expensive probe-plus-classifier ensemble, at roughly 1% extra compute. That is a different article, and I can't confirm the distillation classifier is identical, so treat it as background only.

Layer 3: make repeated attempts hard. Stricter usage limits for accounts that keep trying to extract reasoning, and bans on associated accounts after persistent attempts. Since September 24, requests blocked by safeguards before Claude responds are also billed, in several areas including distillation, with a stated false positive rate below 0.1%.

Anthropic's reported results: early evidence of a 90-99% reduction in data harvested by distillers; after the classifier launched, reasoning tokens extracted on Anthropic's platform were consistently 10 to 100 times lower, and on some days too small to measure; tens of thousands of distillation-linked accounts were banned, often within two hours of a campaign starting; and Anthropic says it turned away meaningful revenue and "trillions of tokens" of paying distiller traffic.

Three ways I read this. First, these are Anthropic's own statistics; the post has no third-party data, and wording like "early evidence" and "consistently" says it's still a watching period. Second, the reduction measures what was taken from Anthropic's platform; distillers use other platforms too, and the post admits the defense depends on others. Third, it says Anthropic hasn't yet seen a highly sophisticated, persistent bypass attempt, so how these numbers hold up against a strong adversary is an open question.

The post doesn't hide the cost. Anthropic admits it hasn't fully met the goal of not affecting legitimate users: preserved thinking forced some developers to update their integrations, and the classifier misidentifies benign requests in fewer than 0.1% of cases, and blocked requests are now billed.

If you build agents on the Claude API, worth checking:

• Does your framework rewrite, trim or reorder reasoning blocks in history? On new accounts (created on or after 2026-08-31) that may no longer work.
• Do you rely on sharing reasoning transcripts across organizations, say with a third-party evaluator or archive? From Sonnet 5.5, transcripts are readable only by the organization that made the request. I didn't read the API details, so check the official docs.
• Does your cost monitoring assume safeguard-blocked requests are free? They now show up on the bill.

The post names two Chinese companies. Zhipu: distilled the cyber capabilities of leading US models while developing GLM-5.3; after Claude's cyber safeguards degraded its attacks, it tried an older Claude model and another lab's model. The US CAISSI assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and Anthropic's research found its safeguards easy to bypass. Moonshot (Kimi): requests to Kimi models were secretly forwarded to Claude for distillation; one user, believed to be affiliated with China's People's Liberation Army, sought to analyze CCTV surveillance of a specific individual.

These are Anthropic's claims alone. I found no response from the named companies, so: I couldn't find that.

Anthropic calls this a cat-and-mouse game that needs continued iteration. It asks all frontier developers to invest in anti-distillation safeguards, since weak safeguards at any lab undermine the others, and asks cloud, inference and API platforms to detect and disrupt abuse fast and offboard fraudulent accounts. It also admits the incentives run the other way: defense is costly, and illicit distillers are paying customers. It published its methods to show that a workable alternative exists.

One tension I think is worth holding: summarizing reasoning and restricting who can read it protects the model maker's investment, but also makes it harder for developers to see, debug and reuse the model's thinking. The post doesn't discuss that trade-off. That's my judgment, not its conclusion.

distillation

Training one model on another model's outputs. Using your own model is one thing; unauthorized extraction is another.

reasoning transcript

The thinking a model writes before its final answer.

preserved thinking

Anthropic's mechanism: new API accounts cannot edit Claude's prior context.

constitutional classifiers

Anthropic's line of safety-classifier research, trained against a written set of rules to block harmful requests.

false positive

A legitimate request blocked as if it were an attack.

SWE-bench Verified

A benchmark of coding agents on real GitHub issues.

• Anthropic: Strengthening our defenses against distillation attacks (2026-10-12; primary source, all figures come from here)
• Anthropic Research: Next-generation constitutional classifiers (background on two-stage design only)
• Anthropic Newsroom (to confirm the publication date)

I read only this one primary source, and found no third-party verification or response from the named companies. An aggregator report cited in the 2026-10-14 briefing points the same way, but the original post governs.