Anthropic Says New Defenses Cut Claude Distillation Data Harvest 90% to 99%

Anthropic says its new defenses have cut the amount of data harvested from Claude by distillers by around 90 to 99 percent. The company calls the estimate "early evidence." The post gives a range, not a measurement method, and no baseline.

Anthropic describes distillation attacks as "covert, industrial-scale campaigns" to copy one model's capabilities into another without authorization. One network it described in a February report managed more than 20,000 fraudulent accounts at once. The company says it has banned tens of thousands of accounts, often within two hours of a campaign starting, and has turned away trillions of tokens of paying traffic. It does not say how much revenue that cost.

The defenses include "preserved thinking" on Claude Fable 5.1 and Claude Opus 5.5, which stops API accounts created on or after August 31, 2026, from editing Claude's prior context, and reasoning transcripts on Claude Sonnet 5.5 visible only to the requesting organization. A two-stage classifier runs on its top models with a false positive rate under 0.1%. On September 24, Anthropic resumed charging for requests blocked before Claude responds in categories, including distillation, where safeguards have false positive rates below 0.1%.

The stakes: Anthropic says Zhipu tried to distill Claude Fable 5 for GLM-5.3, then switched to an older Claude model and another lab's model when cyber safeguards degraded the attacks. CAISSI has since assessed GLM-5.3 as the most cyber-capable open-weights model released to date.

My take: a 90 to 99 percent range is a nine-point shrug in the error bars, and "early evidence" is doing real work. Anthropic does report a concrete benchmark comparison: a pretrained Claude model distilled using summarized Claude Opus 4.8 transcripts scored 71.8% on SWE-bench Verified, versus 80.4% using full transcripts. That is an eval. The headline figure is a vibe with a percent sign.