Anthropic distillation defenses — Layered defense against reasoning-trace distillation — What does it mean?
The news. On October 12, 2026, Anthropic published Strengthening our defenses against distillation attacks. It reports that a pretrained Claude model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified versus 71.8% when trained on summarized transcripts, and that after a two-stage classifier was introduced, the reasoning tokens distillers extracted from its platform were consistently 10 to 100 times lower. It also reports a false positive rate below 0.1% and tens of thousands of banned accounts, often within about two hours of a campaign starting. Read the report →
Picture a restaurant that keeps getting copied. Rival owners send diners who order the signature dish, taste it, and go home to reproduce it. The dish alone is hard to copy well. What the rivals really want is the chef's notebook, which records why each step happens in that order. A language model is the same. Distillation means training a small student on a strong model's outputs, and the most useful output is the reasoning the model generates before it answers. Anthropic's own test puts a number on the notebook's value: the same student scored 80.4% when trained on full reasoning and 71.8% on summaries, a gap of 8.6 points.
The first defense was the summary card at the pass: show diners a short description, never the notebook. Copycats stopped ordering normally and started asking for the notebook directly. One lab tested 12,000 different prompts, each trying a different trick, such as asking Claude to output its prior reasoning character for character, translate it into another language, or repeat it inside tags. When single accounts were cut off, they spread the requests across proxy networks controlling hundreds of thousands of fraudulent accounts. Attackers adapted after the summary defense and again after single accounts were cut off, which is the classic argument for defense in depth: stack independent layers so one bypass does not open everything.
The three new layers each close a different door. Containment keeps the notebook in the kitchen: with preserved thinking, new API accounts created on or after August 31, 2026 cannot edit Claude's prior context, earlier models with weaker safeguards cannot read the newer models' reasoning, and with Claude Sonnet 5.5 a reasoning transcript is visible only to the organization whose request produced it. Classification is the host at the door: a two-stage classifier, built on Anthropic's constitutional classifiers research, works as an input filter that recognizes extraction attempts before Claude responds. Anthropic says it red-teamed the classifier (attacked it on purpose to find holes) internally and externally and patches it as new tricks appear, but publishes few implementation details. Escalation handles the diner who keeps asking: repeat attempts trigger stricter usage limits, persistent campaigns get the accounts banned, and since September 24 blocked requests are charged in areas, distillation included, where the false positive rate is below 0.1%. The layers matter because each one targets a different attacker move: copying normal answers, moving reasoning between accounts, asking for it outright, and retrying at scale.
| Layer | Attacker move it targets | Reported evidence |
|---|---|---|
| Summarized reasoning | Training on ordinary responses (passive distillation) | Student scored 71.8% on summaries vs 80.4% on full transcripts, SWE-bench Verified (source) |
| Preserved thinking | Moving reasoning across conversations, models and accounts | No effect size published; applies to new accounts from Aug 31, 2026 (source) |
| Two-stage classifier | Asking for the reasoning outright | Extracted reasoning tokens 10 to 100x lower; false positives below 0.1% (source) |
| Limits, bans, charging | Retrying at scale through proxy networks | Tens of thousands of accounts banned, often within about 2 hours (source) |
Here is how the numbers compose, holding the student and the benchmark fixed. Full reasoning is worth 80.4 − 71.8 = 8.6 points on SWE-bench Verified to a distiller, which is why the trace is the target. Now take an illustrative campaign that harvested 1,000,000 reasoning tokens a day before the classifier (illustrative). A 10 to 100x drop leaves 10,000 to 100,000 tokens a day, and Anthropic separately estimates, from early evidence, that its changes cut harvested data by around 90 to 99%. The price falls on legitimate users too: at a false positive rate under 0.1%, fewer than 100 of every 100,000 legitimate requests in a guarded area are wrongly blocked (illustrative volume), and those blocked requests are now charged.
Back in the restaurant, a strict host also turns away a few honest diners, and that is the real tradeoff here. Anthropic chose to fail closed on extraction (block when in doubt) and accepts the costs it names: some developers had to update integrations for preserved thinking, under 0.1% of benign requests can be blocked, and it has turned away what it calls trillions of tokens of paying traffic from distillers. Anthropic does not claim the problem is solved: it calls distillation a cat-and-mouse game, says it has not yet seen a highly sophisticated and persistent attempt against the new layers, and notes that distillers also use third-party clouds and other providers that these defenses do not cover.
Goes deeper in: Agent Engineering → Layered Guardrails → Defense-in-Depth for Agents