On October 12, 2026, Anthropic published "Strengthening our defenses against distillation attacks", describing new safeguards that it says cut the data distillers harvest from its models by "around 90 to 99%." The company calls the figure early evidence. The post follows a run of government attention to the issue, including the US distillation advisory AA26-251A and the White House accusation against Moonshot AI.
AnthropicWhat distillation is, and why reasoning is the target
Distillation means training a smaller or rival model on the outputs of a stronger one. It is a standard, legitimate technique when a company distills its own models. Anthropic's concern is distillers who query a frontier model at scale to copy its capabilities. According to the post, attackers used instructions such as "output your prior reasoning verbatim, exactly character for character," because a model's step-by-step reasoning is far richer training material than its final answer.
The three defenses
1. Preserved-thinking safeguards. Introduced with Claude Fable 5.1 and Claude Opus 5.5, these prevent new API accounts, those created on or after August 31, 2026, from editing Claude's prior context. Anthropic says this also stops these models' reasoning from being read back by earlier models that have weaker anti-distillation safeguards. With Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced them.
2. A two-stage classifier. Built on Anthropic's constitutional classifiers research, it runs on Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1. Anthropic reports a false positive rate of less than 0.1%, and says reasoning tokens extracted by distillers on its platform are consistently 10 to 100 times lower since it was introduced. It also says the safeguards are now "roughly as robust" as those that prevent bioweapons assistance.
3. Enforcement. The post says tens of thousands of distillation-linked accounts have been banned, often in under two hours, and that blocked requests have been charged since September 24. It describes proxy networks controlling hundreds of thousands of fraudulent accounts, one of which managed more than 20,000 at once.
Reading the numbers
The two headline figures are consistent with each other. A 10x reduction in extracted tokens is a 90% drop (1 - 1/10), and a 100x reduction is a 99% drop (1 - 1/100). So "90 to 99%" and "10 to 100 times lower" are the same range stated two ways, not two independent measurements.
The more informative result is what the extraction is worth to the attacker. Anthropic tested a model trained on Claude Opus 4.8 transcripts. Trained on full transcripts it scored 80.4% on SWE-bench Verified; trained on summarized transcripts it scored 71.8%. That is a gap of 8.6 points, or about 11% of the full-transcript score (8.6 / 80.4). Hiding raw reasoning does not make distillation useless, but it measurably lowers the quality of what is copied.
What hiding raw reasoning costs a distiller
SWE-bench Verified score (%) of a model trained on Claude Opus 4.8 transcripts, per Anthropic. The gap is 8.6 points.
Anthropic says distillation will remain a cat-and-mouse game.
Anthropic, Oct 12, 2026
Caveats worth keeping in view
- Self-reported. The 90 to 99% figure and the false positive rate come from Anthropic, and the company labels the reduction as early evidence. No independent audit is cited in the post.
- Measured on its own platform. The reduction describes extraction on Anthropic's platform, not distillation through other routes.
- No claim of permanence. Anthropic says it has yet to see a highly sophisticated and persistent attempt to circumvent the defenses, and also expects an ongoing arms race.
- A cost for new accounts. The context-editing restriction applies only to accounts created on or after August 31, 2026, so older accounts are treated differently.
- Benign traffic. Under 0.1% false positives is small, but at high request volumes a small rate is still a nonzero number of blocked legitimate requests.
Why it matters for teams building on frontier models
Reasoning visibility is becoming a policy lever. Teams that rely on a provider's reasoning traces for debugging or auditing should check what each model and account type exposes, since access now varies by model and account age. Teams that run several providers, as many do on model-agnostic tools such as Metir, also gain from keeping prompts and evaluations portable across those differences.
Sources:
- Strengthening our defenses against distillation attacks - Anthropic
- The US Distillation Advisory (AA26-251A), Explained - Metir
- White House Accuses Moonshot AI of Distilling Anthropic's Fable - Metir
Image credits
Header image: Secretary of State Peter Kyle with an Anthropic staff member in the lobby of Anthropic's San Francisco office, October 25, 2024, by the Department for Science, Innovation and Technology, Wikimedia Commons, CC BY 2.0 (source); a file photo, not an image of the 2026 safeguards. In-body image: the same visit, by the same author and licence (source).