Michael JohnsonOn October 12, Anthropic described a new set of measures against unauthorized distillation of Claude models. The company estimates that, after introducing classifiers, the number of reasoning tokens extracted by malicious actors on its platform fell by 10–100x. This is an estimate of activity on Anthropic’s own platform, not an industry-wide measure of distillation.
Distillation is a training method in which one model learns from another model’s responses. Anthropic’s new restrictions target cases where networks of accounts try to extract protected reasoning records to train other models on them. The company also describes proxy services that distribute requests across accounts, models, and infrastructure providers.
Three layers of protection
The first layer restricts the transfer of protected reasoning blocks between conversations, accounts, and models. For Claude Fable 5.1 and Opus 5.5, Anthropic introduced preserved thinking mode: new API accounts created on or after August 31, 2026, cannot edit the model’s preceding context. For Sonnet 5.5, reasoning records are available only to the organization whose request generated them.
The second layer consists of two-stage classifiers designed to detect attempts to extract hidden reasoning. Anthropic says it tested the system with internal and external red-team exercises, and that the false-positive rate is below 0.1%. The company applies the classifiers to its most capable publicly available models, as listed in its description of the new safeguards.
The third layer makes repeated attempts more difficult: accounts showing persistent signs of extraction face stricter limits or are suspended. Anthropic says it has suspended tens of thousands of accounts linked to distillation; according to the company, many were detected within two hours of a campaign starting.
What the reported reduction measures
The 10–100x estimate compares the number of Claude reasoning tokens that Anthropic considers extracted on its own platform before and after the new classifiers were introduced. This metric describes activity observed by the company, not the quality of other models or the volume of distillation across the industry. Anthropic says the classifiers detect all extraction techniques described in its September report when applied to the listed models.
The company separately reports a test on SWE-bench Verified. A pretrained model fine-tuned on full Claude Opus 4.8 transcripts scored 80.4%; a model trained on shortened transcripts scored 71.8%. In this experiment, the shortened records provided less benefit to the model on SWE-bench Verified tasks. Anthropic does not present these results as an assessment of the effectiveness of the entire new set of safeguards.
Implications for developers
The safeguards affect API integrations and billing. Anthropic says preserved thinking mode required some developers to update their systems, classifiers may mistakenly block benign requests in fewer than 0.1% of cases, and since September 24 the company has charged for requests stopped by safeguards in categories where the stated false-positive rate is below 0.1%.
Teams that pass context between calls should check whether their logic is compatible with protected reasoning blocks and test how their systems handle refusals and billing in normal scenarios. Anthropic advises API platform providers to monitor abuse through intermediaries and third-party infrastructure and to disable confirmed account networks.
Anthropic expects attackers to adapt and says it continues to update its classifiers. The practical task for developers is already clear: account for restrictions on context transfer and check how integrations handle blocks and billing.