Anthropic cuts distillation attacks on Claude by up to 99%
New safeguards, including a reasoning classifier and stricter account limits, now block most attempts to copy Claude by training on its output. Blocked requests in high-confidence cases are billed, and some integrations may need updating.
Anthropic published a research post on 12 October setting out three new defences against distillation attacks: industrial-scale campaigns that harvest a frontier model’s output, especially its written reasoning, to train a rival model without permission. The company says the measures have cut the data a distiller can extract by 90 to 99 percent.
The core change is “preserved thinking” on Claude Fable 5.1 and Opus 5.5. New API accounts can no longer edit back into a prior reasoning turn, a transcript stays visible only to the organisation that generated it, and reasoning can no longer be carried across models. Anthropic says this alone cuts the reasoning tokens a distiller can pull out by 10 to 100 times. A two-stage classifier, with a false-positive rate it puts under 0.1 percent, catches extraction attempts directly, and tens of thousands of accounts showing persistent extraction behaviour have been banned, often within two hours of a campaign starting. Anthropic has also resumed charging for requests its safeguards block, in cases it rates high-confidence abuse.
Why it matters: if you build on the Claude API and your integration reads back or edits a previous reasoning turn, preserved thinking on Fable 5.1 and Opus 5.5 can change that behaviour, so check it against those two models. You can also now be billed for a request that gets blocked, if Anthropic’s classifier is confident it was an extraction attempt rather than ordinary use.
The caveat: Anthropic is reporting its own numbers here. There is no independent figure for how much distillation these defences actually stop, or how often the classifier catches a legitimate integration by mistake.