Anthropic announced new measures against attacks that extract knowledge from Claude on 12 October, saying they have reduced the amount of reasoning attackers obtain by 90 to 99 per cent, LavX reported on 13 October. The company’s measure is the number of reasoning tokens extracted by distillation attackers on its platform: Anthropic says that, after the defences were fully implemented, the number fell to between one-tenth and one-hundredth of its previous level.
Key points
- Anthropic says attackers now extract one-tenth to one-hundredth as many Claude reasoning tokens as before its new defences.
- The measures combine preserved thinking, a two-stage classifier and restrictions or bans on accounts.
- Anthropic says it has banned tens of thousands of accounts associated with distillation.
- Some ordinary requests may be blocked in error, and Anthropic charges for blocked requests in protected categories with low false-positive rates.
Claude’s reasoning becomes harder to extract
A distillation attacker gathers answers from a capable model and uses them to train another model to behave similarly. Anthropic describes campaigns in which networks of fraudulent accounts collect millions of responses, particularly transcripts of the reasoning behind an answer. Those transcripts are valuable because they contain more of the path to an answer than the answer alone. The company says its new defences target the repeated attempts to obtain that material, rather than every use of a model response to train a smaller system.
The first layer, called preserved thinking, arrived with Claude Fable 5.1 and Claude Opus 5.5. It stops new API accounts editing Claude’s prior context. Think of that context as pages already placed in a working file: changing them would alter what the model sees as the history of an exchange. Anthropic says restricting that ability makes it harder for networks of accounts to keep probing for protected reasoning. It also limits access to reasoning transcripts to the organisation that generated them and prevents earlier models with weaker safeguards from reading them.
Anthropic’s reported reduction concerns reasoning tokens extracted on its own platform after the measures were fully in place. The company says the volume was too small to measure on some days. That is a narrower measure than the total number of attacks attempted: it counts the material attackers obtained through the routes Anthropic monitors. For companies building on Claude, the change also affects legitimate access to context, and Anthropic says some developers had to update their integrations for preserved thinking.
Anthropic’s classifiers and account bans
A two-stage classifier forms the next layer. Anthropic says it was tested through internal and external attempts to defeat it and has a false-positive rate below 0.1 per cent, meaning that fewer than one in a thousand benign requests are misidentified in its testing. The company compares the classifier’s resistance to attack with safeguards intended to stop Claude assisting in the creation of biological weapons. It runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1.
The final layer acts on accounts. Anthropic says repeated attempts to extract reasoning bring tighter usage limits, while persistent distillation attempts can lead to a ban, often within two hours of a campaign beginning. It says it has banned tens of thousands of accounts associated with distillation. Since 24 September, the company has also resumed charging for requests blocked by safeguards in categories where the false-positive rate is below 0.1 per cent.
Checking a written answer at work could produce a blocked request if the classifier mistakenly treated an ordinary request as an extraction attempt. In a protected category where blocked requests are charged, that mistake could also cost money. Anthropic’s reported false-positive rate puts a measure on that risk, while its account restrictions are aimed at repeated attempts to obtain reasoning rather than a single mistaken request.
Zhipu AI and Moonshot in Anthropic’s account
Anthropic names Zhipu AI among the parties it says sought to obtain Claude’s capabilities. The company says Zhipu used distillation to acquire cyber capabilities while developing GLM-5.3, including capabilities from Claude. According to LavX, Anthropic’s own tests found that safeguards on GLM-5.3 were easily bypassed and that the model would develop security exploits from beginning to end. Those are Anthropic’s test results, distinct from its measurement of how many reasoning tokens attackers extracted after the new controls were installed.
Anthropic has also reported that requests made to Moonshot’s Kimi models were secretly passed on to Claude as part of distillation efforts. It says one request, from a user believed to be affiliated with China’s People’s Liberation Army, concerned analysis of CCTV footage of a particular person. Separately, OpenAI linked individuals at Moonshot AI to a model-distillation campaign, as AI Affairs previously reported.
Distillation traffic can be spread across platforms and providers, making action by a single model company less decisive, Anthropic argues. The company says the defences are expensive to run and that distillers can be paying customers. Anthropic says it has turned away trillions of tokens of paying distillation traffic, along with revenue from those requests.
