Anthropic reported on October 12, 2026 that new anti-distillation safeguards have cut the amount of data that unauthorized model copiers harvest from its Claude models by roughly 90% to 99%. The defenses combine a feature called “preserved thinking,” a two-stage classifier system, and stricter usage limits and account bans.
Key Takeaways
- Anthropic says the volume of Claude reasoning extracted by distillers on its own platform fell by a factor of 10 to more than 100 after the safeguards took full effect.
- Preserved thinking prevents API accounts created on or after August 31, 2026 from editing Claude’s prior context on Claude Fable 5.1 and Claude Opus 5.5.
- The two-stage classifier runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1, with a false positive rate below 0.1%.
- Anthropic says it has banned tens of thousands of accounts tied to distillation, often less than two hours after a campaign began.
- Since September 24, Anthropic has charged for requests its safeguards block before Claude responds, in areas where the false positive rate is under 0.1%.
- The company says it does not yet know how long the gains will last.
Distillation Lets Developers Copy AI Capabilities for a Fraction of the Cost
Model distillation, as Anthropic describes it, means generating millions of responses from a more capable AI model and then using those responses to train a smaller model to imitate it. When it is done without the original developer’s permission, distillation lets a company approach frontier-level capability in far less time and at far lower cost than building the model independently.
The most valuable data for a distiller is not a model’s final answer but its reasoning, the step-by-step thinking a model writes out before it responds. Anthropic’s own test shows why. A model trained on Claude Opus 4.8’s full reasoning transcripts scored 80.4% on the SWE-bench Verified coding benchmark. The same model trained only on summarized reasoning scored 71.8%. That gap explains why Anthropic’s defenses focus almost entirely on keeping full reasoning out of distillers’ hands.
Distillers Moved From Passive Collection to Active Extraction
Anthropic’s early defense was to summarize Claude’s reasoning before showing it to users. Distillers adapted by trying to trick Claude into revealing its full reasoning. Their tactics ranged from directly asking for the reasoning verbatim to large-scale testing of thousands of request variations. They also built proxy networks controlling hundreds of thousands of fraudulent accounts, so that a banned account could be replaced immediately. Anthropic previously reported that one network managed more than 20,000 fraudulent accounts at the same time.
Three Layers Make Up the New Defense
The first layer controls where reasoning can travel. Under preserved thinking, newer API accounts cannot edit Claude’s prior context. Distillers had used that ability to move protected reasoning between conversations, between models, and between accounts. Anthropic has also blocked earlier models with weaker safeguards from reading the reasoning of its newer models.
The second layer is detection. Anthropic built a two-stage classifier using the same approach it applies to block dangerous requests in biology and cybersecurity, then tested it with internal and external red teams. The company says the result is roughly as robust as its safeguards against bioweapons assistance. The classifier is updated whenever a new extraction method appears, such as asking Claude to translate its earlier reasoning into another language.
The third layer raises the cost of trying again. Accounts that repeatedly attempt extraction face tighter usage limits and, eventually, bans. Paying for blocked requests adds a further financial cost to repeated attempts.
The Safeguards Come With Costs for Legitimate Developers
Anthropic is direct about the trade-offs. Preserved thinking has forced some developers to update their integrations. The classifier blocks benign requests in fewer than 0.1% of cases, and customers are now charged for those blocked requests. Anthropic also says it has turned away meaningful revenue and trillions of tokens of paying traffic from distillers.
These figures are self-reported and have not been independently verified. Anthropic says it has not yet faced a highly sophisticated, persistent attempt to get around the new defenses, and it expects the contest with distillers to continue.
Model Protection Is Becoming a Competitiveness Issue for U.S. AI Developers
The release comes as U.S. AI developers ship new capabilities at a rapid pace, including OpenAI’s launch of always-on Dots agents at DevDay in late September. Each new release raises the value of protecting the work behind it. Anthropic argues that unauthorized distillation lets overseas labs keep pace with U.S. companies. It also warns that distilled models are often released without comparable safety protections, which raises misuse risks in areas such as cybersecurity and biology.
Anthropic is also calling for wider participation. Distillers spread their traffic across direct APIs, third-party cloud platforms, and other inference providers, so one developer’s defenses can be undercut wherever weaker protections exist. Anthropic says platforms can slow distillation by detecting abuse quickly and removing fraudulent accounts. It acknowledges that industry incentives often cut the other way, because distillers are paying customers and defenses are expensive.
FAQs
What is AI model distillation?
Distillation is the process of training a smaller AI model on the outputs of a more capable one so that it imitates the larger model’s behavior. Unauthorized distillation does this without the original developer’s permission, often through networks of fraudulent accounts.
What is Anthropic’s preserved thinking feature?
Preserved thinking prevents API accounts created on or after August 31, 2026 from editing Claude’s prior context on Claude Fable 5.1 and Claude Opus 5.5. It blocks distillers from moving protected reasoning between conversations, models, and accounts.
How much did Anthropic’s safeguards reduce distillation?
Anthropic reports that the data harvested by distillers fell by roughly 90% to 99%. Reasoning extracted on its platform dropped by a factor of 10 to more than 100 after the safeguards took full effect.
Do the anti-distillation safeguards affect regular Claude users?
In some cases, yes. Some developers have had to update their integrations, and fewer than 0.1% of benign requests may be blocked by mistake. Anthropic now charges for those blocked requests.
Which Claude models use the new classifier?
The two-stage classifier runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic says it plans to apply it to future models that would be attractive targets for distillers.
