Distillation attacks are covert, industrial‑scale campaigns in which attackers harvest millions of responses from a frontier model—especially the model’s internal reasoning traces—to train a smaller replica without the developer’s authorization. Anthropic warns that such activity enables companies to approach the capability frontier without proportionate safety safeguards, creating risks in biology and cybersecurity and allowing foreign military and intelligence systems to integrate stolen capabilities.
This graph shows that models trained on complete reasoning traces perform significantly better than those trained on summarized traces, which motivates distillation attackers to extract full internal reasoning from frontier models.
The company’s new defenses work in three complementary ways. First, with Claude Fable 5.1 and Claude Opus 5.5 it introduced “preserved thinking,” which blocks API accounts created on or after August 31 2026 from editing Claude’s prior context, thwarting proxy‑network attempts to repeatedly extract protected reasoning. Second, it deployed a two‑stage classifier—similar to the system used to block bioweapon‑related requests—that detects attempts to extract hidden reasoning; internal and external red‑team testing lowered its false‑positive rate below 0.1% and it now runs on all currently attractive generally available models. Third, Anthropic makes repeated extraction attempts harder by imposing stricter usage limits on accounts showing persistent distillation behavior and, since September 24, charging for requests blocked by the classifier in low‑false‑positive categories.
This diagram depicts the three complementary defenses introduced by Anthropic: preserved thinking that blocks context editing, a classifier detecting extraction attempts, and usage limits with charges for blocked requests.
According to Anthropic’s internal metrics, after deploying the classifier the number of reasoning tokens distillers could extract fell by a factor of 10 to 100+, on some days becoming too small to measure, which corresponds to a 90‑99% reduction in harvested data. The defenses have also enabled the banning of tens of thousands of accounts linked to distillation campaigns, often within two hours of an account starting such activity. Trade‑offs include the need for some developers to update their integrations for preserved thinking, occasional misidentification of benign requests (<0.1% of cases), and charges for blocked requests, but Anthropic holds that these costs are justified for national security and for ensuring powerful models are released with adequate safeguards.
The log-scale plot shows a dramatic decrease in extractable reasoning tokens after Anthropic's two-stage classifier went into effect, corresponding to a 90‑99% reduction in harvested data.