Anthropic says new defenses cut Claude distillation by 90 to 99 percent, on early evidence

Anthropic says its new anti-distillation defenses cut the data rivals harvest from Claude by roughly 90 to 99 percent. That is the headline of a research post the company published on October 12, 2026, and it is worth reading with the small print attached: the figures are Anthropic's own, the company calls them early evidence, and it concedes that no determined, sophisticated attacker has yet tested the new system.

What distillation is and why a lab cares

Distillation means training a weaker model on the outputs of a stronger one. Anthropic's February 23, 2026 report on the practice opens with a sentence that matters for fairness: "Distillation is a widely used and legitimate training method." Labs distill their own large models into cheaper ones all the time. The problem Anthropic describes is the unlicensed version, where a competitor buys access, or fakes it, and uses the answers to build a rival.

That February report named three Chinese labs. It said DeepSeek ran over 150,000 exchanges with Claude, Moonshot AI over 3.4 million and MiniMax over 13 million, more than 16 million in total through about 24,000 fraudulent accounts. Anthropic argues these campaigns undercut export controls and produce models without the original's safeguards.

What the October post claims

The new post sets out three layers. The first controls where reasoning can go. A feature called preserved thinking stops API accounts created on or after August 31, 2026 from editing earlier model context. Reasoning from older models with weaker safeguards is kept out of reach, and with Claude Sonnet 5.5 transcripts are visible only to the organization that generated them.

The second layer is a two-stage classifier, built on Anthropic's constitutional classifiers research, running on its most capable models. Anthropic says red-teaming fixed vulnerabilities and that the classifier now catches every distillation technique described in its September report. The stated false positive rate is below 0.1 percent.

The third layer is friction for repeat offenders: stricter usage limits, account bans and, since September 24, charges for requests that safeguards block. Anthropic says tens of thousands of distillation-linked accounts have been banned, often within two hours of a campaign starting.

The numbers, and what each one measures

Two figures circulate and they are not the same claim. The 90 to 99 percent figure describes the reduction in data distillers harvest. The separate 10 to 100 times or more figure describes how many reasoning tokens are extractable on Anthropic's platform after full rollout. Coverage that merges them overstates precision.

The post also explains why reasoning is the prize. A model trained on full Claude reasoning transcripts scored 80.4 percent on SWE-bench Verified, the post says, against 71.8 percent when the training data was reasoning summaries only. A gap of 8.6 points is the business case for the whole defensive effort, and it explains why Anthropic gives away so little reasoning text.

The named example and the cost

Anthropic names Zhipu as an example. It says Zhipu distilled cyber capability from leading US models while building GLM-5.3. After Anthropic's cyber safeguards degraded its attacks on Claude Fable 5, the post says, Zhipu switched to an older Claude model and another lab's model. Anthropic adds that the US government's CAISSI assessed GLM-5.3 as the most cyber-capable open-weights model released to date, and that its own research found the model's safeguards easy to bypass. We have not verified those assessments independently; they are Anthropic's account.

The defenses are not free. Anthropic says it has turned away meaningful revenue and trillions of tokens of paying traffic from distillers. Preserved thinking forces some developers to update integrations. And the classifier occasionally blocks benign requests, in under 0.1 percent of cases, which are now billed.

What is not known

Anthropic is candid about the limits. It expects distillation to remain a cat-and-mouse game, plans to keep iterating, and says: "we have yet to see a highly sophisticated and persistent attempt to circumvent them." It also says it does not know how long the gains will last. That is the honest reading: the defenses beat the attackers Anthropic has seen so far, which proves little about the attackers it has not.

No outside party has reproduced the 90 to 99 percent figure. The measurement method, the baseline period and the mix of attackers behind the number are not independently documented. A reasonable reader should hold the claim at "company claim" until a third party tests it or a lab changes behavior in a way the data can show.

What developers and buyers should check

Three details in the post touch real accounts. Preserved thinking applies to API accounts created on or after August 31, 2026, so teams that edit earlier context in a conversation should test their integrations. With Claude Sonnet 5.5, reasoning transcripts are visible only to the organization that generated them, which limits what a reseller can pass along. And since September 24, requests blocked by safeguards are charged, so a false positive now has a price, even if the rate is under 0.1 percent.

Secondary coverage adds one detail we could not trace to Anthropic's own post: that one lab reportedly tested 12,000 differently worded requests to coax out full reasoning. Treat that as unconfirmed. The post itself says the classifier now catches all the techniques described in Anthropic's September report, which implies attackers were already adapting before the October announcement.

Our take

This is a real product decision, not marketing: Anthropic is giving up revenue and annoying some developers to protect reasoning traces, and that is costly evidence it believes the threat is serious. But the headline number is self-reported and early. We would watch three things: an independent red-team result, whether the named labs shift to other providers, and whether the billing of blocked requests triggers disputes. For how this fits the wider race over who owns frontier capability, see our reporting on the Claude API grey market in China and on how Chinese labs make money.