Anthropic strengthens its defenses against AI distillation

Anthropic says it has reduced the amount of information attackers can extract from its models to copy their capabilities by between 90% and 99%. The company describes these operations as industrial campaigns built around fraudulent accounts and indirect access networks.

The goal of so-called distillation is easy to understand: use millions of responses from an advanced model to train a smaller one that imitates its behavior. This allows a company to approach frontier capabilities without taking on the full time and cost of developing the original model.

What attackers are trying to steal

Final answers are not the only target. The most valuable material for those running these campaigns is the model's internal reasoning transcripts: the process it follows before answering.

This material can teach another system not only what to answer, but how to reach the answer. In an Anthropic test using the SWE-bench Verified coding benchmark, a model trained on complete transcripts reached 80.4%. When it received only summarized versions of the reasoning, that figure fell to 71.8%.

Anthropic began summarizing this reasoning to make it less useful to imitators. But attackers changed their strategy. They tested instructions designed to make Claude show its process word for word, translate earlier reasoning, or hide it in tags alongside the answer.

The company says some networks came to control hundreds of thousands of fake accounts. In one case described previously, a single network managed more than 20,000 fraudulent accounts at the same time, using fake identities and stolen payment details.

Three barriers against extraction

Anthropic says its new defenses operate on three fronts:

• Context controls: with Claude Fable 5.1 and Claude Opus 5.5, new accounts created from August 31, 2026 onward cannot modify the model's previous context. This makes it harder to move protected reasoning between conversations, accounts, or models.
• Detection of extraction attempts: the company uses a system of two classifiers, trained and tested through internal and external attack exercises. According to Anthropic, its false-positive rate is below 0.1%.
• Limits and blocks: accounts that repeatedly attempt to extract reasoning receive stricter limits and may be blocked. Since September 24, Anthropic has also charged for certain requests rejected before the model responds, including those related to distillation.

These measures apply to its most capable models generally available, including Claude Sonnet 5.5, Claude Opus 5, Claude Opus 5.5, Claude Fable 5 and Claude Fable 5.1.

The results it says it has achieved

Anthropic calculates how many reasoning tokens, meaning units of text processed by the model, distillers have managed to extract within its platform. After the new classifier was activated, that amount became between 10 and 100 times lower than before, according to the company.

Anthropic also says it has blocked tens of thousands of accounts linked to distillation campaigns, sometimes in less than two hours after the activity began.

The company acknowledges that it does not know how long these results will last. It expects a constant race between defenses and new evasion techniques, and admits that it has not yet observed an extremely sophisticated and persistent attack attempting to overcome all the current barriers.

The cost for legitimate users

The protection is not free or completely invisible. Some developers have had to modify their integrations because of changes in context management. There is also a small chance that the system will block a legitimate request and, in certain cases, Anthropic will charge for it anyway.

For you, this may mean more checks when using advanced model APIs, stricter limits if an account makes many similar requests, and technical changes to applications that depend on preserving or reusing the reasoning from a conversation.

Anthropic argues that the problem does not affect just one company. Campaigns can distribute traffic across APIs, cloud platforms, and external providers, so developers and access platforms also have to detect fake accounts, stop abuse, and shut down coordinated networks.

The underlying concern goes beyond protecting a product. Anthropic argues that a copied model can approach advanced capabilities without incorporating equivalent safety controls, especially in biology and cybersecurity. That is why it considers defenses against distillation part of the basic infrastructure every powerful-model provider should have. The next step will be seeing whether these barriers hold when attackers adapt their methods again.