Anthropic says new safeguards cut Claude distillation attacks by up to 99%

Someone has been siphoning off Claude’s brain, at industrial scale. On Monday, Anthropic said it’s finally getting good at catching them.

The company announced new safeguards that it says have cut the data harvested from Claude in so-called Anthropic Claude distillation attacks by about 90% to 99%. “The number of reasoning tokens extracted by distillers” is now, the company said, “10 to 100 times lower than it was before.”

That’s not a small gap.

Distillation has quietly become one of the most contested fronts in the US-China AI race. Anthropic, OpenAI, and Google have all warned that the practice lets rivals reproduce frontier capabilities faster and at a fraction of the cost. Now Anthropic is showing its hand. And naming names.

How the safeguards work

Distillation is essentially theft by questions. A would-be copycat fires millions of prompts at a frontier model through networks of accounts, harvests the answers (especially the chain-of-thought reasoning Claude writes before it answers) and trains a cheaper model to imitate the original. The reasoning transcript is the real prize. It teaches the student model how an answer was reached, not just what the answer was.

Anthropic’s fix is to choke off access to that reasoning. The company said its safeguards restrict how much of Claude’s internal reasoning distillers can extract, and that it’s gotten much harder to use proxy networks to repeatedly probe the protected reasoning. Blocking those extraction attempts, Anthropic said, has hindered large-scale distillation efforts across the board.

Then it went after the accounts. Anthropic banned tens of thousands of accounts linked to distillation campaigns.

And then it did something frontier labs rarely do: it named a target. Anthropic cited Chinese AI startup Z.ai, also known as Zhipu, as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model. It warned that such practices pose safety and national security risks. Z.ai did not immediately respond to a request for comment, Reuters reported.

Anthropic is confident about the results. It put its anti-distillation defenses on par with the safeguards that prevent Claude from assisting with bioweapon development, and claimed a false positive rate of less than 0.1%. In other words, fewer than one in a thousand legitimate users gets wrongly flagged.

The defenses weren’t free. According to a summary of Anthropic’s announcement carried by ResultSense, the safeguards came with real costs: turned-away revenue, integration changes for some developers, and charges for blocked requests. Nobody talks much about this part, but walls cost money, even digital ones.

Why the distillation fight matters

Done legitimately, distillation is a standard technique for making models smaller and cheaper. Done at industrial scale against a competitor’s model, it’s how you build a frontier-class rival without paying the frontier-class training bill.

That’s what makes this a geopolitical story, not just a product one. The US AI labs are spending billions on compute, then watching competitors try to compress that investment into a training dataset. Anthropic, OpenAI, and Google have all argued that unchecked distillation lets rivals, especially Chinese labs, skip years of research by siphoning American models’ hard-won reasoning ability.

The scale of the effort is hard to overstate. Per ResultSense’s summary of Anthropic’s announcement, attackers built proxy networks with hundreds of thousands of accounts, some funded with stolen payment details, to evade detection. One lab reportedly tested 12,000 differently worded requests trying to coax out Claude’s full reasoning. Earlier, Anthropic tried a simpler countermeasure: summarizing Claude’s reasoning before showing it to users, which made the transcripts less useful for training. Attackers adapted. So Anthropic escalated.

There’s a certain irony here. Anthropic has positioned itself as the safety-first AI lab, and it’s now running one of the most aggressive defensive operations in the industry: account bans at scale, behavior detection modeled on its highest-stakes safety systems, all to protect its commercial moat. When the threat is a rival training on your model, the safety framing and the business strategy overlap neatly.

The bigger picture

Here’s what most coverage of the Anthropic Claude distillation attacks misses: the defense is a treadmill. Every countermeasure Anthropic deploys teaches distillers what to try next. Summarized reasoning worked until attackers learned to prompt for the full chain. Proxy-network detection works until the networks get better at looking human. The 90%-to-99% number is impressive today. It’s a baseline tomorrow.

The naming of Zhipu may matter more than the percentages. Publicly accusing a Chinese startup of distilling Claude’s capabilities while building GLM-5.3 draws a line that customers, investors, and regulators can see. Private bans are invisible. Public attribution is cheaper than technical enforcement, and it scales better.

The open question is whether any of this slows the race or just relocates it. If distilling Claude gets harder, distillers will look elsewhere. There’s always another model.

Frequently asked questions

What is AI model distillation? Distillation is a technique where a cheaper “student” model is trained on the outputs of a powerful “teacher” model. Done at industrial scale against a competitor’s model, which involves firing millions of prompts through networks of accounts and harvesting the reasoning transcripts, it lets rivals reproduce frontier capabilities faster and far more cheaply.

How did Anthropic cut Claude distillation attacks by up to 99%? Anthropic said it restricted access to Claude’s reasoning transcripts, made it harder to use proxy networks to repeatedly probe the protected reasoning, blocked extraction attempts, and banned tens of thousands of accounts linked to distillation campaigns. It says the number of reasoning tokens extracted by distillers is now 10 to 100 times lower than before.

Why did Anthropic name Zhipu (Z.ai)? Anthropic cited the Chinese AI startup Z.ai, also known as Zhipu, as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model. The company warned that such practices pose safety and national security risks. Z.ai did not immediately respond to a request for comment.

Is AI model distillation illegal? It’s a gray area. Distillation is also a legitimate technique for building smaller, cheaper models. But Anthropic, OpenAI, and Google argue that large-scale extraction from a rival’s model, especially amid US-China AI competition, lets competitors leapfrog years of research and raises safety and national security concerns.

Sources: Reuters, The Straits Times, BusinessWorld Online, ResultSense.