A competitor does not need a model’s weight files to learn from its answers. With enough carefully chosen responses, it may train a smaller system to imitate valuable capabilities. Anthropic says its new Claude safeguards have sharply reduced one especially valuable source of such training data: detailed reasoning transcripts. Here is what its figures measure and where the defensive boundary ends.
Quick Take
- The claim: In an article published on 12 October 2026, Anthropic estimated that its suspected distillers now extract 10 to 100 times fewer Claude reasoning tokens from its own platform after new defenses were introduced.
- The strategy: Shorter displayed reasoning, restrictions on reusing protected thinking blocks, a two-stage detection system and account enforcement make repeated extraction harder.
- The important limit: The reported 90–99% concerns harvested reasoning data in Anthropic’s measurement. It does not mean 90–99% of all AI model copying worldwide has stopped.
- The trade-off: Anthropic reports some benign requests can be flagged, some developer integrations need updates, and certain requests blocked before an answer can now incur charges.
What Is AI Model Distillation?
In model distillation, a more capable teacher system produces examples that a smaller student system learns from. A developer might use an authorized teacher to make a cheaper model more useful on a narrow task. That is a normal engineering technique when the access and reuse rights permit it.
A distillation attack is different in purpose and authorization. Anthropic describes campaigns that use networks of accounts to collect large numbers of Claude outputs without its permission, then train another model to reproduce valuable behavior. The attacker does not have to download Claude’s model weights. The information sought is in the responses, particularly detailed text showing intermediate steps that Claude provides during reasoning.
Those distinctions matter in a discussion about copyright and competition. Not every compressed model or student trained with permission is an illicit copy. Conversely, access to a paid API does not automatically grant a right to collect and repurpose its outputs at industrial scale. Contracts, data rights and the circumstances of reuse have to be evaluated in the relevant jurisdiction.
What Exactly Did Anthropic Measure?
Anthropic’s October report says it estimated the volume of Claude reasoning tokens extracted by suspected distillers on its own platform. After introducing its newer classifier, it says the observed daily amount was about 10 to 100 times lower than before. Expressed as a percentage reduction relative to that baseline, this is roughly 90–99%.
The company presents this as early evidence. It does not give a public, independently audited count of every campaign on other cloud platforms or competing APIs. It also acknowledges that it has not yet faced a highly sophisticated, persistent attempt against all the new measures and does not know how long the observed gains will last. Both the attacker identification and the before-and-after measurement come from Anthropic’s own systems.
Most of all, fewer captured reasoning tokens is not the same metric as fewer stolen model weights, zero copied capabilities or a 99% reduction in every attacker’s success rate. The result describes a narrower, important input to an extraction campaign. It should be judged on that basis.
Why Are Reasoning Transcripts Valuable to a Distiller?
If a teacher model supplies only a final answer, a student can copy the answer but sees less of the path that led to it. Detailed reasoning transcripts supply additional examples of how to approach a complex task. Anthropic says its defenses therefore focus on limiting access to the text it regards as most useful for unauthorized training.
Its separate training experiment illustrates that distinction. Anthropic reports that a student trained on full Claude Opus 4.8 reasoning transcripts scored 80.4% on SWE-bench Verified, while one trained on summarized reasoning scored 71.8%. That is an 8.6 percentage-point gap under the conditions Anthropic describes. It supports the idea that fuller transcripts can be more useful training data in that experiment.
The benchmark result is not the 90–99% extraction figure. It also does not prove a universal performance penalty for every student model, data mixture or task. Summaries may still convey enough information to help a student. Anthropic’s larger defensive plan therefore combines changes to what reasoning is exposed with controls on how protected blocks can be reused.
The Defense Layers and Their Limits
Anthropic describes several controls. Each addresses a different stage of collecting and reusing model responses.
| Defense layer | What Anthropic says it does | Remaining question |
|---|---|---|
| Summarized reasoning | Shares a shorter account of reasoning instead of a fuller transcript. | How much useful training information still appears in a normal response? |
| Preserved thinking | Restricts whether a protected thinking block can be reused across changed context, models or accounts. | Will a legitimate integration that edits history still work correctly? |
| Two-stage classifier | Detects requests Anthropic judges to be attempts to extract protected reasoning. | How many genuine users are misidentified and how does the decision adapt? |
| Account enforcement | Applies stricter limits or bans after repeated suspected extraction behavior. | Can campaigns move to other accounts or distribution channels? |
| Platform coordination | Encourages cloud and inference providers to identify and disrupt abuse. | How consistently do outside platforms detect the same activity? |
No single row is a complete guarantee. Limiting the information in a response, verifying reuse conditions and restricting repeated abuse work at different points of the process. Their combined effect is what Anthropic is estimating on its own platform.
What Is “Preserved Thinking” for Claude Developers?
Anthropic’s Claude Platform documentation describes preserved thinking as a control over whether a previously returned thinking block remains valid in a later request. The API checks that an eligible model can read the block and, for supported accounts, that earlier conversation context has not been changed. Some blocks are also tied to the account that produced them.
For developers, the implication is practical. Software that appends new turns to a conversation may need little adjustment, while an integration that rewrites earlier messages or tool definitions may have a thinking block rejected or dropped. The documentation says the relevant prefix check is enforced by default for API accounts created on or after 31 August 2026; older accounts have different default handling.
These integration rules are part of the defense and also part of its cost. A developer should test long-running agent sessions, model switches and context-management code against the current API documentation. If a protected block is dropped, later answers may lose useful prior context and use more tokens to reconstruct it. The goal is to preserve legitimate work without making every past reasoning block portable for an extractor.
How Do Detection and Account Controls Work Together?
Anthropic says its detection system uses two stages of classification and has been tested by internal and external red teams. The company reports a below 0.1% false-positive rate for this classifier and says it now runs on several of its most capable generally available models. This is Anthropic’s reported evaluation result; the announcement does not provide an independent audit of the complete customer experience.
Repeated suspected extraction can lead to stricter limits or account bans. Anthropic says it has banned tens of thousands of accounts associated with distillation. It also says that, since 24 September, it resumed charging for certain requests blocked before a model responds in categories with low reported false positives. Those measures can raise an attacker’s cost, but they also mean a genuine user needs a clear route to diagnose and contest an incorrect classification.
Anthropic acknowledges that it has turned away paying traffic and that some developer integrations had to change. That is a real operating trade-off: a stricter boundary can protect valuable model behavior while making access less predictable for an edge-case legitimate workflow. Measuring and disclosing both effects matters.
Four Stakeholders in the Distillation Debate
Protect model capabilities while tracking whether safeguards reduce extraction across their own API and outside distribution channels. Publish measurement definitions and customer impact.
Work with model providers on suspected abusive accounts and appeal processes. Align enforcement across interfaces without treating every high-volume developer as an attacker.
Check documented thinking-block behavior, preserve conversation integrity and measure how changes affect latency, cost and answer quality in real applications.
Seek authorized access and transparent evaluation terms. Distinguish legitimate model compression and scientific study from unauthorized bulk collection.
Questions of market access, safety and intellectual property can point in different directions. A useful policy debate should identify whose model, outputs and data are involved instead of treating all distillation as one activity.
What Would Convincing Long-Term Evidence Look Like?
A durable assessment would follow reasoning-data exposure over time, account for activity that shifts to other platforms, and report how often legitimate users are blocked. It would also test whether a student trained on data gathered after the defenses still acquires the targeted capabilities. A token-volume drop is a useful leading indicator, but the downstream training outcome is a separate measurement.
Comparable measurements need a stated baseline, consistent time window and a way to estimate undetected campaigns. If a safeguard discourages obvious requests, observed extraction can fall even while quieter attacks evolve. Anthropic itself describes this as a continuing contest and says it expects to update its safeguards when new bypasses are found.
Security is also not a single-company property. Anthropic notes that traffic may flow through third-party cloud platforms and inference providers. A control on its own service cannot alone establish the same result everywhere Claude is served. Buyers and partners should ask for channel-specific enforcement, documented incident handling and transparent redress for false alarms.
Copyright, Privacy and the EU AI Act
Companies building authorized student models should document permission to use the teacher’s service and outputs, rights in any included third-party material and the source of training examples. Rules differ by contract, content and jurisdiction. Anthropic’s claim about illicit campaigns should not be turned into a blanket assertion that all model distillation is unlawful or that all generated text belongs to the model provider.
Detection also involves data handling. If accounts, prompts or flagged interactions contain personal information, organizations serving European users should apply appropriate purpose, retention, access and security controls. The European Commission’s GDPR guidance sets out the principles for personal-data processing; fraud prevention does not erase them.
The Commission’s AI Act guidance distinguishes obligations by actor, model and an AI system’s intended use. An anti-extraction feature does not, by itself, certify a hosted application as compliant or determine its risk category. A provider should assess applicable model-level and downstream system obligations in its actual deployment.
MaGeN-AI View
A useful result with a narrow measurement
Anthropic’s reported reduction is substantial for the reasoning data it estimates suspicious accounts harvested on its own platform. Preserved thinking, classifiers and account enforcement show how a model provider can make mass collection harder without claiming to hide every capability exposed by an API. The next test is whether the improvement persists as attackers adapt, while legitimate developers can still build dependable applications and resolve mistakes.
Frequently Asked Questions
What is an AI model distillation attack?
It is an unauthorized attempt to use responses from a more capable model to train another model to imitate its behavior. In Anthropic’s account, attackers particularly sought detailed Claude reasoning transcripts.
Did Anthropic stop 90–99% of all model theft?
No. Anthropic estimates that suspected distillers extracted about 90–99% fewer reasoning tokens from Claude on its own platform after its defenses. This is not a measured reduction in all model theft, all providers or every future attack.
What is preserved thinking in Claude?
It is an API safeguard that restricts when a prior thinking block can be reused, based on its model, account where relevant, and whether the earlier conversation context was changed. Supported developers may need to adjust integrations that edit previous context.
Does distillation always violate rules or copyrights?
No. Authorized distillation can be a legitimate way to build smaller models. Permission, contracts, applicable rights and the way outputs are obtained or reused matter; a single legal conclusion does not fit every case.
Can legitimate Claude users be affected by anti-distillation safeguards?
Yes. Anthropic reports a classifier false-positive rate below 0.1% in its evaluations, says some integrations needed changes for preserved thinking and notes that certain blocked requests can be billed.
