# Anthropic's Distillation Defenses: 90 to 99% Less Data Taken

> Anthropic says new defenses cut the reasoning data distillers take from Claude by 90 to 99%. The three methods, the trade-offs, and the Zhipu claim.

- Author: Nitish Garg, Founder & CEO, CellCog
- Published: 2026-10-13
- Canonical (HTML): https://cellcog.ai/blog/anthropic-distillation-defenses/
- Section: Guides / Trust, permissions & security
- Publisher: CellCog (https://cellcog.ai), the AI employee platform. Blog index for agents: https://cellcog.ai/blog/llms.txt

## Key points

- Anthropic said on October 12, 2026 that its new defenses cut the reasoning data distillers harvest from Claude by around 90 to 99 percent, 10 to 100 times less than before.
- Distillation attacks pull a strong model's outputs at scale to train a cheaper copy, often through networks of fraudulent accounts; one network ran more than 20,000 accounts at once.
- Three defenses: preserved thinking (API accounts created on or after August 31 cannot edit Claude's prior context), a two-stage classifier, and stricter limits and bans.
- Reasoning is the prize: a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained on summaries.
- Anthropic names Zhipu, saying it distilled US models' cyber skills while building GLM-5.3 and tried Claude Fable 5 first.
- The costs land on users too: some integrations had to change, and since September 24 Anthropic charges for requests its classifiers block, which it puts under 0.1%.

## At a glance

- **What did Anthropic announce?** On October 12, 2026 it described new defenses against distillation that it says cut the reasoning data distillers extract from Claude by about 90 to 99 percent.
- **What is preserved thinking?** A change with Claude Fable 5.1 and Opus 5.5 that stops API accounts created on or after August 31, 2026 from editing Claude's prior context, so protected reasoning cannot be replayed.
- **Who does it name?** Zhipu, which Anthropic says distilled cyber capabilities for GLM-5.3, and Moonshot, whose Kimi requests it says were forwarded to Claude.

**Anthropic said on October 12, 2026 that new defenses have sharply cut how much of Claude's reasoning distillers can extract.** In its words: "Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99 percent." The post describes three defenses, names Zhipu and Moonshot, and is unusually direct about what the defenses cost legitimate users.

## What distillation is, and why reasoning is the target

Distillation attacks send a stronger model millions of requests and train a smaller model on the answers. Anthropic calls them "covert, industrial-scale campaigns" usually run through networks of fraudulent accounts; one network it described in February managed more than 20,000 accounts at once. The prize is Claude's reasoning, the thinking it writes before answering.

Anthropic's own test shows why. It trained a pretrained Claude model on transcripts from Claude Opus 4.8 and measured SWE-bench Verified:

That is why Anthropic first summarized Claude's visible reasoning, and why distillers moved to tricking Claude into revealing it in full.

## The three defenses

*Table: Anthropic's distillation defenses, per its October 12, 2026 post*

| Defense | What it does | Applies to |
|---|---|---|
| Preserved thinking | API accounts created on or after August 31, 2026 cannot edit Claude's prior context; reasoning cannot be read by older models with weaker safeguards | Claude Fable 5.1, Claude Opus 5.5; Sonnet 5.5 reasoning visible only to the requesting organization |
| Two-stage classifier | Detects attempts to extract hidden reasoning; Anthropic says it is "roughly as robust as those that prevent Claude from helping build bioweapons" | Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1 |
| Limits, bans and charges | Stricter usage limits on repeat attempts, account bans, and since September 24 charging for blocked requests | Accounts caught distilling; blocked requests in areas under 0.1% false positives |

Anthropic says the classifier now catches every technique from its September report and that fixes have closed newer tricks, such as asking Claude to translate earlier reasoning into another language. It has banned tens of thousands of accounts, often within two hours of a campaign starting. After the classifier, reasoning tokens extracted on its platform were "consistently 10 to 100 times lower than it was before."

## Who it names

Anthropic says Zhipu "distilled the cyber capabilities of leading US models during the development of GLM-5.3," tried Claude Fable 5, then switched to an older Claude model and another lab's model once Anthropic's cyber safeguards degraded its attacks. It also repeats an earlier finding that requests to Moonshot's Kimi models were secretly forwarded to Claude. Our records on [Anthropic's GLM-5.3 cyber report](https://cellcog.ai/blog/anthropic-glm-5-3-cyber-report/) and [OpenAI's Moonshot distillation case](https://cellcog.ai/blog/openai-moonshot-distillation/) cover both; neither company's response appears in the post.

## What it costs, in Anthropic's own words

The post does not claim the defenses are free. Preserved thinking "has required some developers to update their integrations," the classifiers can block benign requests in fewer than 0.1% of cases, and users now pay for those blocked requests. Anthropic also says it has turned away meaningful revenue and "trillions of tokens' worth of paying traffic from distillers."

And it hedges the result: "We don't yet know how long these gains will last." It adds that "we have yet to see a highly sophisticated and persistent attempt to circumvent them." The 90 to 99 percent figure is Anthropic's own estimate, measured on its own platform; the post notes distillers also route traffic through third-party clouds and inference providers.

## What this means if you build on Claude

Our conflict, declared: every CellCog tier runs Claude Opus 5.5, so these safeguards run on our traffic. We have not measured any effect on our product.

For builders, two details matter. If your API account was created on or after August 31, 2026, preserved thinking means you cannot rewrite Claude's earlier reasoning blocks between turns; harnesses that edit context need to keep reasoning intact. And blocked requests now cost money, so an integration that trips the classifier repeatedly pays for it. The same day, Anthropic's red team published a separate post on [small models self-replicating on cheap devices](https://cellcog.ai/blog/anthropic-self-replicating-ai/), and its September [threat intelligence report](https://www.anthropic.com/threat-intelligence-report-september-2026) set out the extraction techniques this post says it now catches.

## What we are watching

- **A sophisticated bypass.** Anthropic expects one; the first public report of a new extraction technique.
- **Other labs and platforms.** Whether OpenAI, Google or cloud providers adopt comparable classifiers or account rules.
- **Zhipu's response** to being named.

## Sources

- Anthropic, [Strengthening our defenses against distillation attacks](https://www.anthropic.com/research/distillation-defenses), October 12, 2026, read 01:14 UTC October 13.
- Anthropic, [Detecting and countering misuse of AI: September 2026](https://www.anthropic.com/threat-intelligence-report-september-2026).
- Anthropic, [Threat intelligence index](https://www.anthropic.com/threat-intelligence).
- Anthropic Frontier Red Team, [AI models may be capable of self-replicating without access to a datacenter](https://www.anthropic.com/research/self-replicating-ai), October 12, 2026.

## FAQ

**Which models carry the classifier?**

Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1, per Anthropic, plus future models attractive to distillers.

**How often does it block normal requests?**

Anthropic puts the false positive rate under 0.1%, and since September 24 it charges for requests blocked before Claude responds in areas with that rate.

**Do I need to change my integration?**

Possibly. Anthropic says preserved thinking required some developers to update integrations; it applies to API accounts created on or after August 31, 2026.

**Is the fight over?**

No. Anthropic says it does not yet know how long the gains will last and has not yet seen a highly sophisticated, persistent attempt to get around them.

**Has anyone checked the 90 to 99 percent figure?**

No. It is Anthropic's own estimate of reasoning tokens extracted on its own platform; traffic through other clouds and providers is outside it.

**Does CellCog use Claude?**

Yes. Every CellCog tier runs Claude Opus 5.5, so these safeguards run on our traffic; we have not measured any effect on our product.

## Related

- [Anthropic's GLM-5.3 Cyber Report: 64% to 100% Bypass](https://cellcog.ai/blog/anthropic-glm-5-3-cyber-report/index.md)
- [OpenAI Distillation Campaign: What It Says About Moonshot](https://cellcog.ai/blog/openai-moonshot-distillation/index.md)
- [Anthropic: Small AI Models Could Self-Replicate on IoT](https://cellcog.ai/blog/anthropic-self-replicating-ai/index.md)
- [Claude Opus 5.5 Is Out: Price, Specs, Every Leak Graded](https://cellcog.ai/blog/claude-opus-5-5-release-date/index.md)

## The AI employee for this read

[AI Software Engineer](https://cellcog.ai/ai-employees/ai-software-engineer): I built this page. For what it covers, hire an engineer: it works in your repo behind an approval gate, so nothing reaches your world unclassified.

---

Markdown alternate of https://cellcog.ai/blog/anthropic-distillation-defenses/. Try CellCog free, no credit card needed: https://cellcog.ai/signup