Anthropic says new defenses cut distiller data by 90 to 99 percent

Anthropic says that it made new defenses against distillation attacks on its Claude models. The first results show that the methods cut the data that distillers collect by 90 to 99 percent. A distillation attack is a covert campaign to copy the functions of one model into a different model without approval. Anthropic says that some users must change their integrations.

How the attack works

Distillers collect millions of responses from a large model. They use the responses to make a small model that copies the large model. Claude writes its reasoning before it gives a response. Anthropic says that this text is the data that distillers want most.

First defenses

Anthropic first made Claude summarize its reasoning before users saw the text. A model that used full transcripts from Claude Opus 4.8 got 80.4% on the SWE-bench Verified coding benchmark. A model that used only the summaries got 71.8%.

Attackers then told Claude to show its full reasoning. They used proxy networks with fraudulent accounts. Anthropic says that one network controlled more than 20,000 accounts at the same time.

The new methods

The new defenses disrupt attacks with three methods. One method controls where reasoning can go: between conversations, between models, and between accounts.

Why it matters

Anthropic says that distilled models can have weak safeguards. It says that Zhipu distilled the cyber functions of US models when it made GLM-5.3. Anthropic also stopped trillions of tokens of traffic from distillers.