Anthropic cuts distillation data theft by 90–99%

Anthropic frames distillation as a two-sided problem. On one side, a company can use a frontier model to train its own cheaper model that performs close to the original, while the model being copied absorbs the load. On the other, Anthropic says illicitly distilled models can pose national-security risks, citing a past case in which requests to Chinese company Moonshot AI's Kimi series were forwarded to Claude and showed signs of trying to analyze a specific individual from surveillance footage; Anthropic believes the user behind those requests is connected to the People's Liberation Army.

Anthropic says the most valuable data for distillers is the record of the reasoning process — the thinking Claude writes out before answering — so its defenses focus almost entirely on making that reasoning hard to reach. Its first measure summarized reasoning before showing it to users, which it says dropped benchmark scores from 80.4% to 71.8% compared with distilling the raw reasoning. Distillers pushed back with tactics ranging from simply asking for verbatim reasoning to methods that tried more than 10,000 requests to draw it out. Anthropic says distillers operate hundreds of thousands of fraudulent accounts, which its original safeguards could not handle.

The newer measures include "held-out thinking" in Claude Fable 5.1 and Claude Opus 5.5, which stops API accounts created after August 31, 2026 from editing Claude's past context, and lets only the organization that sent the original request view reasoning records in Claude Sonnet 5.5. Anthropic also applies a "constitutional classifier" that screens inputs and outputs, which it introduced in January 2026 for fields such as biology to block bioweapon and nuclear weapon requests, and says its distillation defenses are roughly as robust. Anthropic says it expects the contest over distillation to continue, and argues that stopping it requires effort and cooperation from every company developing frontier models, since attackers with easy access to similarly capable models could undermine its work.