Anthropic says anti-distillation defences cut attackers' haul by roughly 90-99%

FACT. On 2026-10-12 Anthropic published a research blog post titled "Strengthening our defenses against distillation attacks" at https://www.anthropic.com/research/distillation-defenses. The post:

1. Describes illicit distillation as "covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorization of the original model's developers", typically conducted "using networks of fraudulent accounts".
2. States a headline result: "Early evidence suggests that these methods have reduced the amount of data harvested by distillers by around 90 to 99%."
3. Gives the underlying measurement in a different unit: the volume of Claude reasoning tokens extracted by distillers "is consistently 10 to 100 times lower than it was before".
4. Describes three defence layers now in production (Section 5).
5. Names two adverse actors as worked examples: Zhipu (GLM-5.3, cyber capability) and Moonshot (Kimi, request relaying).
6. Concedes trade-offs: turned-away revenue, "trillions of tokens' worth of paying traffic" refused, developers forced to update integrations, a classifier that misidentifies benign requests in fewer than 0.1% of cases, and billing for blocked requests.
7. Concedes uncertainty: "We don't yet know how long these gains will last… we have yet to see a highly sophisticated and persistent attempt to circumvent them."

FACT. The post is the fourth in a series of Anthropic distillation disclosures (February 2026, then a September 2026 threat-intelligence report, now this defence-side post).

COMPANY CLAIM. The 90–99% reduction, the 10×–100× token reduction, the sub-0.1% false-positive rate, the "roughly as robust as those that prevent Claude from helping build bioweapons" comparison, and the "tens of thousands" of accounts banned (often "less than two hours" after a campaign begins).

INDEPENDENT EVIDENCE (weak form). Multiple independent outlets covered the post within a day — Cryptobriefing, a Reuters wire item, Resultsense, explainx.ai, aiweekly, superpowerdaily, finance.biggo, dealroom. This corroborates that Anthropic published this and said this. It does not corroborate the effect size.

INDEPENDENT EVIDENCE (negative). explainx.ai states plainly that it "found no independent audit of the 90 to 99 percent reduction, the 10x to 100x drop in extracted reasoning tokens, or the false positive rate, and Anthropic does not publish its methodology for measuring attempts it never sees."

Three distinct things changed, and they should not be conflated.

The most consequential change for a developer audience is the third-order one: an anti-abuse control on reasoning has become a breaking change in how multi-turn context is assembled. That is new. Earlier anti-distillation work (summarising reasoning before display) was invisible to integrations. Preserved thinking is not.

Anthropic's post describes three layers, all aimed at the same asset: Claude's reasoning trace, because "a model's general reasoning ability drives its performance on nearly every task" and reasoning teaches a student how an answer was reached, not merely what it was.

Layer 1 — Control where reasoning can go (structural). Per the platform documentation (https://platform.claude.com/docs/en/build-with-claude/preserved-thinking), preserved thinking works by checking each returned thinking/redacted_thinking block on two axes:

• Model binding. "The model can read the block." Each model reads its own blocks and those of a fixed set of other models. Claude Fable 5.1 reads blocks from Opus 5 and (on the Claude API) Opus 5.5; neither Opus 5 nor Opus 5.5 reads Fable 5.1's. Unreadable blocks are dropped silently (or reported as model_binding_mismatch under the beta header).
• Prefix binding. "Nothing before the thinking block has changed." The checked prefix is the top-level system prompt, the set of tools, and every message before the block. If the prefix differs from when the block was produced, that block and every later thinking block are invalid; the API returns a 400 invalid_request_error by default, or drops them if thinking.block_binding.prefix_mismatch_behavior is set to "drop_block".
• Account binding. On Claude Sonnet 5.5 and Haiku 5.5, thinking blocks are tied to the account that produced them; another account's blocks are dropped.

Enforcement: the prefix check applies to all accounts for the model check, but is enforced by default only for accounts created on or after 2026-08-31 00:00 UTC. Older accounts must opt in via the beta header thinking-binding-controls-2026-08-01. This is precisely the loophole the Anthropic post refers to as "prevents new API accounts… from editing Claude's prior context".

Layer 2 — Block and patch extraction attempts (classifier). A two-stage classifier detects requests that attempt to extract hidden reasoning, following the architectural pattern of Anthropic's constitutional-classifier work. Anthropic says it was red-teamed internally and externally, vulnerabilities found were fixed, and the design now blocks specific enumerated techniques (asking Claude to translate earlier reasoning into another language; asking it to write reasoning out inside tags).

Layer 3 — Make repetition expensive (friction). Repeated extractors get stricter limits; persistent extractors get banned; and blocked-before-inference requests are billable. This converts probing from free to metered.

Measurement. Anthropic estimates extracted reasoning tokens on its own platform, before versus after the classifier. A 10× drop is a 90% reduction; a 100× drop is a 99% reduction. The "90–99%" headline is therefore a restatement of the "10 to 100 times lower" platform-side measurement — the same number in two units, not two independent results.

FACT-level. Model distillation is the mechanism by which a well-resourced competitor can approximate frontier capability without the compute, the research organisation, or the safety training budget. It is also the one capability-transfer channel that runs through the victim's own infrastructure.

COMPANY CLAIM. Anthropic's stated dual rationale: (a) distilled models are released "without proportionally robust safeguards", so distilled biology and cyber capability is a misuse risk; (b) distilled capability flows into foreign "military, intelligence, and surveillance systems", making this a national-security matter rather than a terms-of-service matter.

INDEPENDENT EVIDENCE. The framing is no longer Anthropic-only. A joint NSA/CISA/FBI Cybersecurity Advisory (AA26-251A, 2026-09-08) describes China-based industrial-scale distillation, names DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI, and states that distillation "is not a supplement to these companies' AI model development, but the critical core of it". It follows earlier White House instruments (NSTM-4 on adversarial distillation, April 2026; NSPM-11, June 2026).

INTERPRETATION. The strategic significance is not the percentage. It is that:

1. Defences are now the product surface. An anti-abuse measure changed API semantics for paying developers. Reasoning access is being rationed.
2. The economics cut against defending. Anthropic says the quiet part out loud: "Defenses are expensive, and illicit distillers are still paying customers. Against that backdrop, it would be easy for companies to do nothing, or not enough."
3. The defence is only as good as the weakest link in a multi-provider market. Anthropic says its work "would be undermined if attackers could easily access similarly capable models that lack similarly robust anti-distillation safeguards" — the GLM-5.3 case is offered as exactly that: Zhipu switched away from Claude Fable 5 after finding its cyber safeguards degraded the attacks.
4. Attribution asymmetries persist. Distillers route across native APIs, cloud platforms and third-party aggregators; a single provider can only see its own slice.

• FACT. A documented, model-agnostic contract for reasoning-trace binding (model binding, prefix binding, account binding) that other providers can copy or interoperate with. Anthropic explicitly frames the post as a template: "We hope this post helps developers and platforms better understand how they can prevent these attacks."
• FACT. A measurable operational lever: metering blocked requests turns extraction probing into a cost line for the attacker.
• INTERPRETATION. An audit surface for legitimate users: input_transformations (under the beta header) tells an integration which thinking blocks were dropped and why, which converts a previously invisible context-management bug into an observable event.
• INTERPRETATION. A testable public claim. For the first time the effect size is stated in a form a third party could in principle falsify — by measuring whether distilled students of Claude stop improving at the previous rate.
• PREDICTION. Reasoned that competitors will publish competing anti-distillation designs (OpenAI's September 2026 report on disrupting distillation, including "encrypted reasoning replay", is the obvious parallel), and that "reasoning access policy" becomes a line item in enterprise procurement.

1. Does any third party reproduce or falsify the 90–99% reduction? What would a falsification even look like given the measurement is on Anthropic's own platform?
2. Is there a published measurement of the classifier's recall against a held-out, adversarial set — as opposed to the September report's known-technique inventory?
3. What is the actual false-positive and false-negative profile at enterprise volume, and is there an appeal/allowlist path for legitimate research that asks models about their reasoning?
4. Does the summarisation control measurably degrade chain-of-thought monitorability for auditors? Anthropic quantifies the attacker-side loss (80.4% → 71.8% SWE-bench Verified) but not the oversight-side loss.
5. Do other frontier labs adopt the same binding model (model + prefix + account) — and do they interoperate, or do they create a fragmented reasoning-portability landscape? OpenAI's September 2026 disruption report (including "encrypted reasoning replay") is the obvious comparator.
6. Does the capability-gap narrative change? Specifically: does the growth rate of the best open-weight models slow measurably after these controls, or does it continue on schedule from other data sources?
7. Does enforcement asymmetry (accounts pre- vs post-2026-08-31) create a durable, exploitable two-tier surface as those accounts age, are migrated, or are resold?
8. Does the "defences are expensive and distillers pay" incentive problem get addressed by policy (the White House NSTM-4 / NSPM-11 line of instruments) or remain a voluntary-commitment race to the top?
9. Will any named lab give a substantive, point-by-point response, and has any relayed-customer privacy harm (Anthropic alleges relaying of customer data including a PLA-affiliated CCTV case) been independently confirmed client-side?
10. Is the 90–99% figure stable, or does Anthropic revise it in a later post? This is the cleanest forward test of the claim.

PREDICTION (ranked by likelihood)

1. Near term (days–weeks). More coverage, most of it restatement; a handful of developer-facing explainers focused on the preserved-thinking migration. Expect at least one "does this break my agent harness?" piece and continued aggregation of the 90–99% figure without qualification.
2. Near term. Model-lab symmetry: OpenAI (and possibly Google) publishing or extending their own anti-distillation controls; the "encrypted reasoning replay" line is the obvious parallel.
3. Medium term. An adversarial test. Anthropic says it has not yet seen "a highly sophisticated and persistent attempt". The most informative next data point is either a sophisticated bypass (a new extraction technique that survives the classifier) or a durable absence of one.
4. Medium term. Named-lab responses, or continued silence. Point-by-point rebuttal would be new; blanket rejection at the ministry level has precedent.
5. Medium term. A revision or restatement of the effect size, or a follow-up post with an updated curve. The explicit uncertainty ("We don't yet know how long these gains will last") all but commits Anthropic to one.
6. Longer term. Reasoning access becomes a governed, metered, contracted resource across providers, with some inter-provider portability rules emerging (the model-reads-model matrix in the docs is already a portability policy).
7. Watch indicators. (a) Whether the best open-weight models' capability trajectory visibly slackens — the only externally observable test of the claim. (b) Whether any competitor adopts prefix/account binding. (c) Whether any regulator or auditor demands the measurement methodology. (d) Whether the relaying/privacy allegations (which are separate from the effect-size claim) produce a client-side confirmation or a lawsuit.

The headline is a vendor's own measurement, in a vendor's own unit, on a vendor's own platform, against attacks the vendor itself detected — and that should be said plainly, not because Anthropic is being dishonest (it is unusually candid about trade-offs and about not yet facing a serious adversary) but because the number is now load-bearing in a national-security argument.

The genuinely new thing here is not the percentage. It is that reasoning traces have become a governed resource. Anthropic's anti-distillation control is now an API contract: a thinking block is bound to a model, to its exact prefix, and in some cases to an account. That is a breaking change for developers, a new cost line for blocked requests, and a quiet reduction in how much of a model's thinking anyone — attacker, auditor, or researcher — can read. The security gain and the oversight loss ride on the same control.

Read the piece as three separable claims: the post exists (verified); named competitors did specific things at specific scale (single-source, unfalsifiable from outside, and made by a competitor); and the defence cut extraction by 90–99% (self-reported, unaudited, and unproven against a persistent adversary). The first is journalism. The second is a diplomatic document. The third is a hypothesis with a deadline — the gap between open-weight and frontier models will either stop closing as fast, or the number will quietly be revised.

Artifact contains story ID S12. Evidence labels used: FACT, COMPANY CLAIM, INDEPENDENT EVIDENCE, INTERPRETATION, PREDICTION. Status label: EARLY RESEARCH.