A model can refuse one suspicious request and still lose the larger contest if an attacker repeats it through thousands of accounts. In an October 12 technical post, Anthropic explains how it began treating illicit distillation as a system problem rather than a collection of bad prompts.

The company estimates that its new defenses reduced the amount of Claude reasoning extracted by unauthorized distillers by roughly 90% to 99%. That figure comes from internal measurements on Anthropic's own platform. It is not an independent benchmark, and Anthropic says the full stack has yet to face a highly sophisticated and persistent effort to defeat it.

That qualification changes how the number should be read. It reflects the traffic Anthropic can observe and classify as distillation, not proof that every extraction path is closed. The technical value is less about claiming a perfect barrier and more about joining context boundaries, content detection and behavioral enforcement.

Three controls aimed at one operation

Distillers try to collect millions of outputs from a more capable model and use them to train another system. Reasoning transcripts are particularly useful because they contain intermediate steps rather than only final answers. Summarization helped at first: in an Anthropic SWE-bench Verified experiment, a model trained on full transcripts scored 80.4%, compared with 71.8% when trained on summarized reasoning.

Attackers then adapted. They asked Claude to reconstruct hidden content, moved protected blocks across conversations and model families, and distributed traffic through account networks. Anthropic's current response combines three controls:

  • Context boundaries: a feature called preserved thinking prevents newer API accounts from editing prior context for selected models; on Claude Sonnet 5.5, the transcript is tied to the organization that produced it.
  • Two-stage classification: a system based on constitutional classifier research analyzes extraction attempts. Anthropic says it catches every technique described in its September report while keeping false positives below 0.1%.
  • Repeated-behavior enforcement: tighter limits, charges for blocked requests in areas with very low false-positive rates, and account bans make persistence more expensive.

Anthropic says it has banned tens of thousands of accounts associated with distillation, often within two hours of a campaign starting. After the classifier was deployed, the estimated volume of exposed reasoning fell by a factor of ten to more than one hundred.

The defense boundary is no longer one prompt. It includes the transcript, organization, account network and the attacker's economics.

Legitimate users absorb some of the cost

The system introduces friction. Some developers had to update integrations because earlier context can no longer be modified in the same way. Benign requests can be blocked, even if Anthropic's reported rate remains below 0.1%, and the company resumed charging for certain requests stopped before the model responds.

At platform scale, a small percentage can still affect many customers. A false-positive rate therefore needs an appeal path, observability and recovery-time data. Anthropic did not publish an error breakdown by workload or an external evaluation of the classifier in this announcement.

The coordinated campaign previously reported by OpenAI showed how reasoning artifacts can move across accounts, sessions and models. Anthropic's new account covers the defensive side: reducing that surface without relying on a single rule. Together, they point to the same architectural shift. Controls need to extend across partner inference platforms because abuse traffic can migrate toward the channel with weaker visibility.

For technical leaders, the useful question is not whether a vendor has an “anti-distillation filter.” Ask for separate measures of detected attempts, reasoning actually exposed, false positives, containment time and coverage across inference channels. Distributed attacks live in the gaps between those numbers. A mature defense starts by measuring each one without pretending they are interchangeable.

Sources: Anthropic's technical account of the new defenses, its preserved-thinking documentation and the underlying constitutional-classifiers research.