Anthropic's anti-distillation defenses: 10 to 100x less reasoning leaks, and your integration pays part of the bill

On October 12, 2026, Anthropic published "Strengthening our defenses against distillation attacks". It says three layers of protection have cut the data distillers harvest from Claude by "around 90 to 99%", and that the reasoning tokens they can extract are "consistently 10 to 100 times lower" than before. The post names Zhipu, saying it distilled US models' cyber capabilities while building GLM-5.3. It also says requests sent to Moonshot's Kimi models were secretly forwarded to Claude.

This is more than lab politics. The mechanisms that stop distillers also change how ordinary integrations handle thinking blocks, which requests get blocked, and what you pay for. They also sharpen the provenance questions to ask before deploying an open-weight model.

What actually shipped

Anthropic describes three layers.

The first is preserved thinking. This came with Claude Fable 5.1 and Opus 5.5. It "prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context". Reasoning from these models can no longer be read by earlier models with weaker safeguards. On Sonnet 5.5, transcripts are "accessible only to the organization whose request produced the transcript."

The second is a two-stage classifier. It is red-teamed internally and externally, and Anthropic reports a false-positive rate below 0.1%. It runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. Anthropic says it patched specific bypasses quickly, such as translating prior reasoning into another language or wrapping it in tags.

The third is account enforcement. Repeat extractors get tighter limits and then bans. Since September 24, Anthropic has resumed charging for requests that safeguards block before Claude responds, in categories including distillation.

The post reports tens of thousands of banned accounts, often within two hours of a campaign starting (secondary coverage). It also explains why reasoning matters. A model trained on full Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained on summarized transcripts. That 8.6-point gap is the value Anthropic is trying to deny distillers.

The thinking changes are already visible in the API contract. The Haiku 5.5 migration guide says thinking blocks from another account are "silently dropped" and the request still succeeds. Editing system, tools or earlier messages before a replayed thinking block returns a 400 for accounts created after August 31, 2026, 00:00 UTC. Haiku 5.5 also won't read thinking blocks from Opus 5, Opus 5.5, Sonnet 5.5, Fable or Mythos models.

Numbers that matter

That 8.6-point gap is the value Anthropic is trying to deny distillers.

Illustrative false-positive cost. Take a support pipeline sending 2M requests/month at an average of $0.004 each. A 0.1% false-positive rate is the ceiling, so up to 2,000 blocked requests a month, or about $8 billed. The money is trivial. The real cost is 2,000 users who got no answer, unless your code handles the block and retries or routes around it. Note that Anthropic only says the billed categories carry a false-positive rate below 0.1%. It does not give the rate for your traffic.

What it means in practice

If you build on visible reasoning, assume you'll see less. On Haiku 5.5, the docs say thinking text is omitted by default and returned only as a signature unless you ask for a summary. The post presents summarization as a countermeasure. Pipelines that parse chain-of-thought for debugging, grading or audit logs should treat summarized thinking as the long-term format. Anything that edits history, splices conversations across accounts, or replays thinking blocks between models is also exposed. Think multi-tenant proxies and eval harnesses that rewrite system prompts mid-run.

If you distil from frontier APIs, read the contract, not the blog. The commercial terms I read (effective date shown: June 17, 2025) bar using the services "to build a competing product or service, including to train competing AI models" unless Anthropic approves. Anthropic's February post still calls distillation "a widely used and legitimate training method" when done on your own models. My read: fine-tuning an internal classifier on Claude outputs for your own product is a different situation from training a general model you sell, but that line belongs to your lawyer, not your ML lead. Operationally, sustained high-volume prompting for "show your reasoning" now carries a ban risk even for honest customers.

If you buy open-weight models, provenance is now a security question. Anthropic says GLM-5.3's safeguards "can easily be bypassed". It cites CAISI, which assessed GLM-5.3 as "the most cyber-capable open-weights model released to date." A model whose capabilities were partly lifted from a frontier system without its safety training plausibly ends up "capable, weakly aligned". I covered the procurement side in Kimi K3 distillation due diligence and the regulatory angle in the NSA distillation advisory.

What I'd do

Start by auditing history mutation. Find every place your code mutates conversation history or forwards thinking blocks across accounts or models, and fix those before a silent drop turns into a quality regression nobody can explain.

Handle classifier blocks as a first-class outcome. Log them with request IDs, alert on rate changes, and keep a fallback path. Blocked requests can now cost money.

Stop depending on raw chain-of-thought. If audits need reasoning, request summarized thinking and store your own structured rationale fields.

Get a written position on output reuse. If you train anything on Claude outputs, get legal sign-off against Section D.4, or written approval from Anthropic.

Add a provenance row to open-weight model evals. Record the lab, any distillation allegations, independent safety evals such as CAISI, and your own red-team results on refusal bypass, especially for cyber use.

What I couldn't verify

All headline numbers are Anthropic's own estimates (90 to 99%, 10 to 100x, FPR below 0.1%). No independent measurement exists, and Anthropic says it has "yet to see a highly sophisticated and persistent attempt to circumvent" the defenses. The Zhipu and Moonshot attributions come from Anthropic alone; I found no response from either company, and I did not read CAISI's GLM-5.3 assessment directly. The "tens of thousands of accounts banned, often within two hours" figure comes from secondary coverage, and I didn't find it in my extract of Anthropic's post. The September threat-report figures circulating in coverage (Alibaba, Xiaomi exchange counts) were not checked against a primary source, so I left them out.

I'll revisit when someone outside Anthropic measures reasoning leakage.

Sources

Primary: Anthropic, Strengthening our defenses against distillation attacks; Anthropic, Detecting and preventing distillation attacks (Feb 2026); Claude Docs, Migrating to Claude Haiku 5.5 (thinking block binding); Anthropic, Commercial Terms of Service. Coverage: The Cryptonomist, AI distillation attacks defense; Unite.AI, Anthropic reports distillation defenses reduced extracted reasoning tokens.