Anthropic Takes Strong Action Against Distillation, Cutting Data Theft by 99%

October 13, 2026, Product Update

Anthropic is adding a much harder-to-bypass barrier to Claude.

On October 12 local time, Anthropic announced the launch of several measures to prevent model distillation, saying that the new system had already reduced the reasoning data attackers could steal from Claude by approximately 90% to 99%. In other words, whereas a single distillation attack might previously have obtained 100 usable pieces of training material, it may now yield only 1 to 10.

This is not an ordinary account risk-control upgrade. Anthropic has defined the issue as “industrial-scale model capability extraction” and placed it at a security level comparable to biological safety protections: the new classifier has a false-positive rate below 0.1%, accounts that repeatedly extract protected reasoning traces are rate-limited, and accounts that continue trying are banned outright.

As of October 12, Anthropic had banned tens of thousands of accounts associated with model distillation activity. The company also specifically named Zhipu AI, saying that it had attempted to extract capabilities from Claude while developing GLM-5.3. Zhipu has not yet responded to the allegations.

Protection Focus: No Longer Allowing the Model to Expose Its Reasoning Without Restrictions

Model distillation itself is neither a new technology nor inherently illegal.

It is more like having an experienced teacher train a lower-cost student. The teacher model handles a large number of problems and provides high-quality answers, while the student model gradually learns the teacher's problem-solving methods by studying the inputs, outputs, and intermediate signals. This can compress an expensive, large model into a smaller, faster, and cheaper version.

Nearly all leading model companies use similar methods. Large-model providers use stronger models to generate synthetic data for training smaller or specialized models; some companies also distill their own reasoning capabilities to reduce inference costs. The problem lies in the target and method of distillation: if a competitor uses large numbers of accounts, proxy networks, and automated scripts to systematically extract the most valuable capabilities of a closed-source model and then use them to train a directly competing model, this is no longer ordinary model compression. It is closer to unauthorized model extraction.

Anthropic's first measure is to strengthen protection for reasoning contexts starting with Claude Fable 5.1 and Claude Opus 5.5. Supplementary materials indicate that new API accounts created on or after August 31, 2026, cannot modify Claude's previous context. The purpose of these restrictions is to reduce attackers' ability to repeatedly rewrite context and induce the model to expose its internal reasoning process.

For developers, the key change can be summarized in one sentence: the model will still answer questions, but it will no longer readily hand over complete data structures that can be used directly for training.

What attackers actually want is usually not a final answer, but intermediate information with greater training value, including:

• Step-by-step reasoning processes for complex tasks;
• Tool calls and agent-planning processes;
• Comparisons and scores for multiple candidate answers;
• Complete execution traces for coding, data analysis, and web-operation tasks;
• Data that can be directly converted into supervised fine-tuning data or reinforcement-learning feedback.

The more complete this content is, the more suitable it becomes for bulk collection and conversion into training samples for another model. Anthropic's goal now is to reduce the usability of this data before it leaves Claude.

A Two-Stage Classifier for Identifying Bulk Extraction Behind “Normal Use”

The second measure is the deployment of a two-stage classifier to identify requests that attempt to extract reasoning content.

The most difficult aspect of model-distillation attacks is that an individual request often does not look suspicious. For example, the following sentence could be a perfectly normal user request:

You are a senior data-analysis expert. Please provide data-driven insights and fully explain your reasoning process.

But if variations of the same prompt are sent tens of thousands of times within a short period by hundreds of affiliated accounts, with targets consistently focused on capabilities such as code generation, complex reasoning, web operations, or agent planning, the nature of the activity changes.

Anthropic currently focuses on several types of signals:

1. Whether requests focus on the model's core capabilities: such as programming, complex reasoning, tool use, computer operation, and cybersecurity.
2. Whether prompts are highly repetitive: many requests merely change variables, task contexts, or wording while keeping the overall template unchanged.
3. Whether outputs are suitable for direct use as training data: users repeatedly request complete reasoning, generate samples covering different tasks, or ask the model to evaluate another model's answers.
4. Whether multiple accounts exhibit coordinated behavior: including shared payment methods, synchronized requests, similar device fingerprints, and proxy networks.
5. Whether requests change rapidly after the release of a new model: traffic that quickly shifts toward new capabilities after a model launches often resembles a data-collection operation more than ordinary user activity.

The two-stage classifier does not examine a single prompt in isolation. It combines account, request, network, and time-series behavior to make its assessment. Anthropic says that the overall robustness of this protection is “roughly comparable to the safeguards that prevent Claude from assisting in the creation of biological weapons,” with a false-positive rate below 0.1%.

If accurate, this figure means Anthropic is trying to solve not only the question of “how many attacks to block,” but also “how many legitimate users not to harm.” For API customers, this is an important metric: overly aggressive risk controls can disrupt automated workflows, while overly permissive controls can leave attackers with enough sampling capacity.

A 90% to 99% Reduction in Data Does Not Mean Distillation Has Been Eliminated

Anthropic's central result is that after the classifier was introduced, the amount of reasoning content available to distillers fell by a factor of 10 to 100. The company also said that early evidence showed the overall volume of data obtained by attackers had decreased by approximately 90% to 99%.

This result is valuable, but its meaning needs to be understood precisely.

First, it refers to a decline in the amount of data attackers can extract. It does not mean that the model has been completely isolated, nor does it mean that all forms of capability replication have ceased to work. As long as attackers can still obtain some high-quality samples, they may be able to improve the proportion of usable data through filtering, resampling, and cross-validation with other models.

Second, a reduction in reasoning content does not necessarily mean a corresponding decline in the quality of final answers. For some tasks, the final code, tool-call results, and structured outputs are sufficient to provide training signals. Attackers may not need to see the model's complete internal reasoning. As long as they can continuously obtain large volumes of high-quality inputs and outputs, they can still train a competitive student model.

Third, the effectiveness of protection depends heavily on the broader ecosystem. Anthropic can restrict its own Claude API, but it cannot determine whether other model service providers will adopt similar strategies. If attackers distribute requests across multiple API platforms, cloud services, and inference providers, the effectiveness of any single provider's blocking measures may be diluted.

Anthropic itself acknowledges that this will be a long-term “cat-and-mouse game.” The company has not yet encountered highly complex, persistent evasion attempts, so it remains to be seen whether the new system can maintain the same effectiveness after attackers upgrade their automation tools.

Why Anthropic Has Elevated This to a Security Issue

Anthropic's concerns have two layers.

The first is commercial competition. Training frontier models requires substantial compute, data, engineering investment, and safety research. Through bulk API sampling, competitors can shift part of the cost to the provider of the teacher model and then train their own models at lower cost. The smaller the capability gap, the greater the economic value of distillation.

The second is security risk. Model capabilities and safety guardrails are not necessarily transferred together in full.

Consider it this way: a car may have a high-performance engine, automatic braking, and airbags. Distillation can more easily replicate the engine's power without necessarily replicating the automatic braking and collision protection. A student model may learn to write code, call tools, and perform complex tasks without inheriting the refusal boundaries formed through extensive training of the teacher model.

This is also the point Anthropic repeatedly emphasizes: distillers may focus on capabilities rather than safety alignment. If the resulting model is deployed in high-risk cybersecurity, intelligence, surveillance, or automation systems, the spread of capabilities may outpace the speed of safety evaluations.

However, this argument also requires some qualification. Distillation does not automatically cause safety mechanisms to disappear. A model's safety still depends on its training data, fine-tuning methods, reward models, deployment strategy, and post-launch review mechanisms. Describing all distillation activity as a security threat can blur the boundary between normal model compression and unauthorized capability extraction.

At present, “distillation attack” is also not a universally defined technical term within the industry. At least several questions remain unanswered publicly: How many calls constitute an attack? How high must the capability similarity between a student model and a teacher model be to demonstrate extraction? What proportion of the training data must come from a particular model before it constitutes unauthorized distillation?

Anthropic currently relies primarily on behavioral evidence rather than a single threshold. This is a realistic choice for risk control, but it remains insufficiently clear at the level of law and industry rules.

The Zhipu Case Illustrates How the Scale of Attacks Is Changing

Anthropic specifically mentioned Zhipu this time, saying that the company had attempted to extract capabilities from Claude while developing GLM-5.3. Supplementary materials state that Zhipu rotated through 273 accounts over a 10-day period and generated more than 3.4 million interactions attributable to the relevant activity; the related traffic was concentrated over 17 days in June and July.

If these figures are accurate, they show that the dispute is no longer about a research team occasionally calling a competitor's model. It is about turning an API into an automated data-production line.

A typical large-scale distillation system would have several characteristics:

• Using large numbers of accounts to distribute call volume;
• Hiding the true source through residential proxies or dynamic networks;
• Quickly replacing an account after it is banned;
• Adjusting prompts and request targets in response to updates to the teacher model;
• Uniformly cleaning and scoring outputs before feeding them into the student model's training process.

Anthropic says it has already banned tens of thousands of accounts associated with distillation and that many accounts were banned less than two hours after beginning the relevant activity. This means the protection system is analyzing not only model outputs, but also an entire infrastructure of accounts and behavioral relationships.

However, facts and allegations still need to be distinguished here. The available material comes primarily from Anthropic's security report and company statements, making it difficult for outside readers to independently verify all attribution conclusions. Whether Zhipu actually controlled the relevant accounts, how many of these requests ultimately entered the GLM-5.3 training pipeline, and what proportion distillation data contributed to the model's capabilities all require more public evidence.

What This Means for Model Providers and API Developers

The impact of this update on model providers is direct: APIs are no longer merely a matter of billing and concurrency controls. They are increasingly becoming training services with data-security boundaries.

Future model APIs may need to answer several questions at once: Who is calling? What is the purpose of the calls? Do the requests exhibit bulk-sampling characteristics? Is the output being systematically collected? Do multiple accounts belong to the same organization?

For developers, there are also three practical implications.

First, workflows that require complete reasoning traces will become less stable. Model providers may reduce the amount of raw chain-of-thought output and instead provide summaries, structured explanations, or filtered reasoning results. Products that rely on complete internal reasoning text for secondary training will need to redesign their data pipelines.

Second, account and request behavior will become part of risk control. Even if an individual request is entirely reasonable, the combination of bulk accounts, synchronized calls, shared payment methods, proxy networks, and highly repetitive templates may trigger restrictions. Enterprise users should prioritize clearly structured organizational accounts, stable network egress, and auditable calling methods.

Finally, compliant distillation will become a clearer product requirement. Model providers may introduce authorized distillation, restricted data exports, dedicated teacher models, or watermarked synthetic-data services, allowing customers to obtain training samples while respecting usage boundaries.

This approach has more commercial value than simply banning accounts: customers with genuine needs will not disappear. They will shift from gray-market sampling to paid authorization.

This Competition Has Only Just Entered the Defensive Phase

Anthropic's protection figures are striking. A 90% to 99% reduction is enough to change the economics of large-scale distillation. If an attack requires 100 times as many accounts, proxies, and requests, many low-cost replication schemes will lose their viability.

But this should not be interpreted as meaning that “model distillation has been solved.” Attackers can reduce their dependence on any single model by combining multiple teacher models. They can shift their focus toward final answers, tool calls, and scoring signals instead of insisting on complete reasoning chains. They can also fill data gaps through public benchmarks, human annotation, and open-source models.

Going forward, model providers will face not a one-time round of account bans, but an ongoing adversarial process. The more accurate detection systems become, the more attackers will alter the shape of their traffic. The stricter the protections, the more compliant customers will need stable and transparent authorization mechanisms.

For the industry, the truly important change is that model capabilities have become an asset whose outward flow needs to be controlled. Competition among closed-source models such as Claude, GPT, and Gemini is taking place not only in training sets, parameter scale, and benchmark scores, but also at the API boundary, in output granularity, and within risk-control systems.

By reducing extractable data to between one-tenth and one-hundredth of its previous level, Anthropic has temporarily won the defensive round. But as long as models continue to serve external users through APIs, capability extraction will not disappear. The question will shift from “can it be obtained?” to “how much can be obtained, how costly is it, and can it be reproduced reliably?” That will become a core battleground in the long-term operation of closed-source model platforms.

References

• ITHome: Anthropic launches new protective measures, reducing data stolen by model-distillation attacks by up to 99%: Reports on Anthropic's newly announced protection mechanisms, the reduction in data volume, the false-positive rate, and the associated account bans.