The Pulse
Anthropic Says Claude Defenses Cut Distillation Data by Up to 99%
Anthropic says new safeguards reduced the reasoning data distillers extracted from Claude on its platform by 10 to 100 times. The measures include account restrictions, classifiers and changes to how Claude handles reasoning, with a false-p
AI.info Team · Written with AI ·
“After introducing the classifier, the number of reasoning tokens extracted by distillers is consistently 10 to 100 times lower than it was before.”
Anthropic
Anthropic reports a sharp drop in Claude data harvesting
Anthropic said on October 12 that new defenses have reduced the amount of data distillers harvest from Claude by about 90% to 99%. The company’s more specific measurement tracks tokens of Claude’s reasoning extracted by distillers on Anthropic’s own platform; it says that figure fell by a factor of 10 to 100 after the classifier was introduced. The reported decline is an estimate from Anthropic, not an independently audited measure of all distillation activity.
Distillation trains a smaller model on responses from a more capable one. Anthropic says the most valuable material for this purpose is often the teacher model’s reasoning, which can reveal how it reached an answer rather than just the answer itself. Its latest defenses aim to make those reasoning traces harder to obtain and to disrupt repeated extraction attempts.
Reasoning controls target account and model switching
One measure, called “preserved thinking,” applies to new API accounts created on or after August 31, 2026, for Claude Fable 5.1 and Claude Opus 5.5. It prevents those accounts from editing Claude’s prior context, a tactic Anthropic says attackers used to make the model reveal protected reasoning. Anthropic also says these models’ reasoning can no longer be read by earlier models with weaker safeguards; with Claude Sonnet 5.5, transcripts are accessible only to the organization whose request generated them.
A two-stage classifier looks for attempts to extract hidden reasoning. Anthropic says it now catches all the extraction techniques described in the company’s September report, and that red-team testing helped identify and fix weaknesses. The classifier runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1.
Account bans and blocked-request fees add friction
Anthropic says it has banned tens of thousands of accounts associated with distillation, often within two hours of a campaign starting. Accounts that repeatedly seek reasoning face tighter usage limits, while the company says it has patched methods including requests to translate earlier reasoning or reproduce it inside tags. Those controls address the persistence of extraction networks, which can move requests among accounts and models.
Since September 24, Anthropic has also charged for requests blocked before Claude responds in areas where its safeguards have a false-positive rate below 0.1%, including distillation. The company says the classifier’s false-positive rate is under that threshold, but acknowledges that legitimate requests can still be blocked. Anthropic also says preserved thinking has required some developers to update their integrations.
The percentage comes with a boundary
The 90% to 99% reduction describes data harvested from Claude, not a measured reduction in every distillation campaign across other providers. Anthropic says distillers distribute traffic across its API, cloud platforms and other inference services, and its published token estimate covers its own platform. The company also says it has not yet seen a highly sophisticated, persistent attempt to bypass the newer defenses.
Anthropic expects attackers to adapt and says it will keep updating the safeguards when it finds new extraction techniques. For developers using the covered models, the immediate trade-off is concrete: tighter handling of reasoning, occasional integration changes and charges for certain requests blocked by the system.