Anthropic says new Claude defenses blunt model distillation attacks

Anthropic says it has strengthened Claude against distillation attacks, where attackers use a frontier model’s outputs and reasoning traces to train another model without permission. The company says early evidence shows the new methods reduced the amount of data harvested by distillers by roughly 90 to 99 percent.

The defenses focus on Claude’s reasoning traces, which Anthropic says are especially valuable for copying model behavior. The changes include preserved thinking controls that limit how prior reasoning can be moved between contexts, safeguards that detect attempts to extract hidden reasoning, and stricter limits or bans for accounts that repeatedly try to do it.

Anthropic says the system now catches the distillation techniques it described in an earlier threat report on its most capable generally available models, including Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. It says the classifier has a false positive rate below 0.1 percent.

There are trade-offs. Some developers have had to update integrations, benign requests can still be blocked, and Anthropic has resumed charging for blocked requests in areas where it says the false-positive rate is very low. The broader signal is that frontier labs are treating model distillation as an abuse and national-security problem, not just a terms-of-service issue.