Anthropic Says Claude Defenses Cut Extracted Reasoning by 90% to 99%

Anthropic said Monday that new Claude defenses have reduced the reasoning data extracted by distillers on its own platform by an estimated 90% to 99%. The controls screen attempts to extract Claude’s hidden reasoning and restrict its reuse across conversations, models and accounts. Legitimate developers face integration changes and can pay for a request even when the safeguards block it before Claude answers. The reduction is Anthropic’s estimate. It measures extracted reasoning on its platform, not industry-wide traffic or rival-model performance.

Distillation trains a model on another model’s outputs and is a legitimate training method when authorized. Anthropic’s defenses target unauthorized extraction campaigns, including those using fraudulent accounts. Its preserved-thinking controls check reasoning blocks returned through the API, rather than universally prohibiting conversation edits.

Anthropic acknowledges that it has yet to encounter a highly sophisticated, persistent attempt against its new measures.

Screening extraction requests

Anthropic’s two-stage classifier screens attempts to extract hidden reasoning on generally available Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. The company says the system has a false-positive rate below 0.1%. It also says the defenses have helped it ban tens of thousands of accounts associated with distillation, often within two hours of a campaign starting.

Anthropic initially had Claude summarize its reasoning before showing it to users to make the transcripts less useful for distillation. In an internal experiment described Monday, a pretrained Claude model trained on full Opus 4.8 reasoning scored 80.4% on SWE-bench Verified, a coding benchmark. Training on summarized reasoning produced 71.8%, a difference of 8.6 percentage points. That comparison measures the resulting student model’s performance, not the new defenses’ effectiveness or a quality loss for ordinary customers.

Checks on returned reasoning

Preserved thinking checks signatures on reasoning blocks sent back in later API requests. Model compatibility limits which Claude models can read those blocks, while organization binding restricts replay of Sonnet 5.5 reasoning across accounts.

The context check applies by default to accounts created on or after August 31, 2026. Older accounts opt in. Developers can append messages and use supported mechanisms for changing instructions or tools without rewriting the preceding context.

The context check covers the system prompt, tools and messages preceding a returned reasoning block. If that context changes on a request where the check is enforced, the API normally rejects the request with a 400 error. Developers can use a supported API configuration to drop invalid blocks instead, allowing the conversation to continue without that earlier reasoning.

Costs for legitimate developers

Since September 24, Anthropic has resumed charging for requests blocked before a response in categories, including distillation, where it claims a false-positive rate below 0.1%. A legitimate request mistakenly classified as extraction can therefore incur a charge without producing an answer.

Anthropic acknowledges that preserved thinking has required some developers to update their integrations. Dropping invalid reasoning blocks can keep requests working. The discarded blocks themselves are not billed, but Claude may then regenerate reasoning it can no longer read, increasing output-token use.

Limits of the reported gains

An earlier paper by Lena Libon and colleagues at ETH Zurich offers a methodological caution for evaluating the reported gains: defense effectiveness depends on attackers’ query budgets, available training data and API access. Its case study examined antidistillation sampling, which alters outputs to make them less useful for training. It did not test Anthropic’s controls.

Anthropic expects attackers to find ways around its new measures.

“We don’t yet know how long these gains will last,” the company said.

YC's Garry Tan Rejects Distillation Crackdown Days After NSA Names Six Chinese Firms

Y Combinator CEO Garry Tan said he would do nothing about AI model distillation. He wants regulators to focus on creating an equilibrium between open-weight and frontier models, as long as frontier m

The Implicator

White House Accuses Moonshot of Distilling Fable and Using Banned Nvidia Chips

Michael Kratsios, director of the White House Office of Science and Technology Policy, accused Moonshot AI on Wednesday of distilling Anthropic’s Fable to develop Kimi K3, the 2.8-trillion-parameter m

The Implicator

China Says US AI Firms Distilled Chinese Models, Cites No Evidence

China’s Ministry of Commerce on Monday accused “many American AI enterprises” of distilling Chinese models and promised “all necessary measures” if the Trump administration sanctions Chinese firms ove

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai