Anthropic says Claude distillation defenses cut extraction 10–100 times

Why simple defenses failed

Distillation lets a company train a model to imitate a stronger one by collecting its responses at scale. Anthropic says the most useful material is Claude’s reasoning traces: the steps formed before a response. Its initial defense shortened those traces, but attackers moved from passively collecting ordinary answers to actively trying to make Claude reveal its full reasoning.

One test shows why the distinction matters. A pretrained Claude model scored 80.4% on SWE-bench Verified after training on full Claude Opus 4.8 traces, compared with 71.8% after training on shortened traces.

Attackers then tried to work around the restrictions with prompts designed to extract hidden reasoning. One lab tested 12,000 prompts, each intended to trick Claude in a different way. As defenses improved, distillation operators also used proxy networks with hundreds of thousands of fake accounts. Anthropic said one network operated more than 20,000 accounts at once.

The activity went beyond model training. Anthropic says these networks also resold access to Claude in regions where it was unavailable and created accounts using false information and stolen payment details.

Summarizing Claude's reasoning makes its transcripts less useful for distillation. A model trained on transcripts with summarized reasoning scored 71.8% on SWE-bench Verified, compared to 80.4% for a model trained on the full reasoning.

Source: anthropic.com

A layered defense

Anthropic says its latest measures address three parts of the problem:

The classifier currently runs on Anthropic’s most capable publicly available models: Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. The company plans to use it on future models that are similarly attractive for distillation. It says the system has already been updated to catch tactics such as asking Claude to translate earlier reasoning or reproduce it in tags alongside an answer.

What the reduction does—and does not—show

Anthropic measures the defenses by counting reasoning tokens extracted through its platform. After introducing the classifier, the number fell by 10–100 times compared with before, on top of the effect from preserving reasoning context. The company says it used the defenses to block tens of thousands of accounts linked to distillation, often within two hours of a campaign starting.

Once our new safeguards were fully implemented, the reasoning that distillers could extract from Claude on our own platform fell by a factor of 10 to 100+. On some days, the number of reasoning tokens distillers could extract was too small to measure.

Source: anthropic.com

That is a meaningful operational result, but it is not the same as showing that distillation has been stopped. Anthropic says it does not know how long the reduction will last and has not yet faced a highly sophisticated, persistent attempt to bypass the measures. I think that caveat matters more than the impressive range: the reported metric tracks extraction on Anthropic’s platform, while the company also says attackers spread traffic across its API, cloud platforms and other inference providers.

The defenses also impose costs on legitimate users. Some developers had to update integrations to accommodate preserved reasoning context; classifiers can occasionally flag a safe request; and blocked requests are now charged in some cases. Anthropic says those trade-offs are justified by the national-security risks of models built through unauthorized distillation, including capabilities that could be used in biology and cybersecurity.

The burden, though, cannot sit with one model provider. Anthropic says the protections lose much of their value if attackers can obtain comparable capabilities from models with weaker defenses, such as GLM-5.3 from Zhipu. It is also asking platforms and inference providers to identify abuse and shut down fake accounts. The hard part is that those measures cost money, while distillation traffic can still generate revenue. Anthropic’s numbers make a case for stronger defenses; whether the rest of the supply chain will accept the same trade-off remains unresolved.