Anthropic says its new defenses cut distillation data by 90 to 99%. Nobody outside can check that number.

Anthropic published a long post on October 12 about distillation. In plain terms, distillation means training your own model on the answers another model gave. Done quietly, at scale, through networks of fake accounts, it lets a rival copy a frontier model’s skills for a fraction of the cost. Anthropic calls these campaigns “distillation attacks,” and it says its new defenses have cut the data harvested this way by about 90 to 99 percent.

Reuters ran the same figure that day. The post also gives a second number, that reasoning tokens pulled by distillers are now “10 to 100 times lower” than before.

What the defense actually does

Most of the work goes into one thing: Claude’s reasoning. Anthropic says the most valuable training data is the reasoning Claude writes before it answers, so the defenses are built to keep that reasoning out of reach.

There are three layers. The first limits where reasoning can travel. New API accounts created after August 31 can’t edit Claude’s earlier context, which shuts down a trick where attackers move reasoning blocks between conversations to convince Claude it’s allowed to repeat them. The second is a two-stage classifier that looks for requests trying to pull the reasoning out. Anthropic says its false positive rate is below 0.1 percent. The third is tighter usage limits and bans. The company says it has banned tens of thousands of accounts, often within two hours of a campaign starting.

Anthropic also says the safeguard is “roughly as robust” as the one that stops Claude from helping build bioweapons. That’s a comparison the company picked, and a fair one, since bio safeguards get tested hard. It doesn’t tell you how often the classifier fails on real traffic.

Where the 90 to 99 percent comes from

Read this part slowly. Anthropic calls the figures “early evidence,” and they cover its own platform. The company counted what got through its own gates. It can’t see what distillers collect from other providers or from copies that reached them some other way. So the number says the defense works against the traffic Anthropic can see. It doesn’t say what share of the total attack that traffic is.

The reasoning-token figure has the same limit. It’s Anthropic’s measurement, shown in a chart, and I didn’t find an outside audit of it.

The post does include one case from outside. Anthropic says Zhipu, the Chinese lab behind GLM-5.3, tried to distill Claude Fable 5 while building that model. After finding that Claude’s cyber safeguards degraded its attacks, Zhipu switched to an older Claude model and another lab’s model. That’s a case where the defense appears to have worked. But it’s Anthropic’s account of Zhipu’s behavior, and I didn’t find a response from Zhipu in the sources I read. For the cyber side of that model, see our earlier piece on GLM-5.3’s exploit results and NIST’s numbers.

The cost falls on normal developers too

The post is more candid about downsides than most security announcements. Anthropic writes that preserved thinking “has required some developers to update their integrations,” that the classifiers can, in fewer than 0.1 percent of cases, block benign requests, and that it now charges for requests its safeguards block before Claude responds.

That last point is the one to watch. A 0.1 percent error rate sounds tiny until you multiply it by a heavy API user’s volume. Then it becomes a line on the invoice. If you build on Claude, check your blocked-request logs instead of assuming the rate is the same for your traffic.

My take

The question I keep coming back to is the trade, not whether Anthropic can stop copycats. Reasoning hidden from people trying to copy it is also reasoning hidden from people trying to check it. For Claude Sonnet 5.5, Anthropic says reasoning transcripts are visible only to the organization whose request produced them, which is a reasonable privacy choice. But the part of the post I could read didn’t describe any way for outside safety researchers to examine how Claude reaches its answers.

I’d watch two things. Does Anthropic publish the base the 90 to 99 percent is measured against? And does the 0.1 percent false positive rate hold for developers outside its own tests? Until it answers both, the number is a company’s own scorecard, and a good one, but still only its own.

Sources

1. Anthropic, “Strengthening our defenses against distillation attacks,” October 12, 2026: anthropic.com/research/distillation-defenses
2. Reuters, “Anthropic says new safeguards sharply reduce AI distillation attacks,” October 12, 2026, as republished by The Straits Times: straitstimes.com
3. Reuters, same story, as republished by The Economic Times: economictimes.indiatimes.com