Anthropic Distillation Defenses for Claude API Integrations

Anthropic announced expanded security controls on October 12, 2026, to counter industrial distillation campaigns targeting its reasoning models. These measures include preserved thinking context restrictions, two-stage classifiers, and billing adjustments for requests flagged by abuse filters.

Distillation attacks seek to extract proprietary reasoning patterns from frontier models to train competing systems without authorization. According to research published by Anthropic, unauthorized distillation attempts have used distributed proxy networks, fraudulent accounts, and stolen payment details across commercial interfaces.

What Preserved Thinking and the New Classifiers Change

Three things change. API accounts created on or after August 31, 2026 cannot edit Claude's prior context on Claude Fable 5.1 and Claude Opus 5.5 under preserved thinking. Two-stage classifiers block reasoning-extraction attempts on frontier models with a false positive rate under 0.1%. Blocked requests in areas such as distillation have been charged since September 24, 2026. Anthropic's October 12 post does not publish error codes, specific parameter changes, or an appeal process. The developer docs were not checked here; confirm details in Anthropic's developer documentation.

On Claude Sonnet 5.5, reasoning transcripts are accessible only to the organization whose request produced the transcript. Prior reasoning generated by Claude Fable 5.1 and Claude Opus 5.5 is blocked from being read by earlier models that carry weaker anti-distillation safeguards. These rules may affect pipelines that rewrite conversation history and pass intermediate reasoning blocks.

• Context restrictions under preserved thinking: API accounts created on or after August 31, 2026 cannot edit Claude's prior context on Claude Fable 5.1 or Claude Opus 5.5, and earlier models cannot access reasoning generated by these newer models.
• Two-stage distillation classifiers: The classifiers run on Claude Sonnet 5.5, Claude Opus 5, Claude Opus 5.5, Claude Fable 5, and Claude Fable 5.1 to intercept extraction attempts with a false positive rate below 0.1%.
• Billing for blocked requests: Since September 24, 2026, Anthropic charges for API requests blocked by safety filters before generating an answer in categories, including distillation, where the false positive rate is under 0.1%.

Distillation Mechanics and Reasoning Extraction

Anthropic defines distillation attacks as covert, industrial-scale campaigns to extract one model's capabilities and replicate them in another without authorization. Distillers generate millions of responses from a larger model and use them to teach a smaller model to mimic it. Full transcripts of intermediate reasoning represent the most valuable training material for these campaigns, which led Anthropic to concentrate its defensive controls on restricting access to Claude's internal thinking processes.

As an early defense, Claude summarized its reasoning before showing it to users. In a benchmark evaluation conducted by Anthropic, a model trained on full reasoning transcripts from Claude Opus 4.8 reached 80.4% on the software engineering benchmark (SWE-bench) Verified, whereas training on summarized transcripts achieved 71.8%.

When summarization limited passive scraping, distillers shifted toward active extraction techniques designed to force raw transcript disclosure. Attackers submitted explicit prompts instructing Claude to output prior reasoning verbatim and character for character. One lab tested 12,000 requests, each trying to trick Claude differently. Separately, proxy networks controlled hundreds of thousands of fraudulent accounts. In Anthropic's February report, a single proxy network operated over 20,000 fraudulent accounts simultaneously. Proxy networks also resold access in regions where Claude is not offered and opened accounts with false identities and stolen payment details.

Operation of the Three Defense Layers

Anthropic structures its defenses across three distinct layers covering context routing, prompt classification, and account penalties as documented on the Anthropic distillation defenses research page. The first layer controls where reasoning can travel across API boundaries. Attackers previously extracted protected reasoning blocks from high-capability models and inserted them into conversations with older, less protected models or alternate accounts. Preserved thinking is meant to restrict this pattern on Claude Fable 5.1 and Claude Opus 5.5 by preventing new accounts from editing prior context, while Claude Sonnet 5.5 restricts reasoning data to the originating organization.

The second layer deploys a two-stage classifier system of the kind described in Anthropic's constitutional classifiers research. Anthropic red-teamed these classifiers internally and externally, stating that their safeguards are now roughly as robust as those that prevent Claude helping build bioweapons. The classifier system monitors Claude Sonnet 5.5, Claude Opus 5, Claude Opus 5.5, Claude Fable 5, and Claude Fable 5.1, intercepting extraction patterns documented in Anthropic's September report alongside attempts to translate reasoning into alternate languages or output reasoning inside custom tags.

The third layer imposes escalating penalties. Users making repeated extraction attempts face stricter usage limits. Persistent attempts lead to account bans. Anthropic reports banning tens of thousands of accounts, often within two hours of a campaign launching.

Impact on Existing API Integrations

API integrations that alter conversational context or programmatically capture model reasoning face potential disruption under Anthropic's defensive controls. Pipelines that edit historical context blocks must be evaluated against preserved thinking rules, particularly when using newer API credentials. Teams should audit their request structures to ensure standard application logic does not resemble extraction patterns monitored by the two-stage classifier.

The following integration patterns require review by development teams to verify operational compatibility:

• Context rewriting: Pipelines that edit, inject, or rewrite assistant messages in historical conversation threads before sending subsequent requests to Claude Fable 5.1 or Claude Opus 5.5 on accounts created on or after August 31, 2026.
• Cross-model routing: Systems that take thinking blocks or reasoning outputs from newer models and pass them as input context into older Claude models.
• Reasoning extraction prompts: Prompts instructing Claude to reveal internal reasoning steps verbatim, translate reasoning traces into secondary languages, or wrap thinking processes in custom tags.

Steps for Addressing Broken Legitimate Workflows

If a legitimate request fails, check three things: the account registration date, the model endpoint, and the official documentation. When legitimate requests fail or return unexpected rejections, teams can run these checks.

Check whether the API account was registered on or after August 31, 2026. Check whether the integration calls Claude Fable 5.1, Claude Opus 5.5, or a model running the two-stage distillation classifier. Check the Anthropic developer documentation and contact Anthropic support.

Reported Extraction Reductions and Operational Trade-Offs

Anthropic reports that its new safeguards reduced data harvested by distillers by around ninety to ninety-nine percent while acknowledging operational trade-offs for legitimate developers. According to early data published by Anthropic, the volume of reasoning tokens captured by unauthorized distillers is consistently ten to one hundred times lower than before classifier deployment, reaching levels too small to measure on certain days. However, Anthropic notes that it does not know how long these gains will persist and has not yet observed a highly sophisticated, persistent campaign attempting to circumvent the controls.

These performance figures reflect Anthropic's internal estimates of extracted reasoning tokens on its own infrastructure, and the post reports no independent verification. Layer3Labs has not conducted independent testing of these security controls, and findings rest on Anthropic's published documentation.

Anthropic explicitly acknowledges several trade-offs associated with these security implementations. Preserved thinking required some developers to update their integrations to accommodate context constraints. The two-stage classifier blocks benign requests in fewer than 0.1% of cases, and those blocked requests incur billing charges. Finally, Anthropic states that it turned away meaningful revenue and trillions of tokens of paying traffic from distillers to enforce these protections.

Industry Distillation Allegations and Ecosystem Impact

Anthropic states that distilled models can approach the frontier without proportionally robust safeguards. Anthropic claims that Zhipu distilled cyber capabilities from leading United States models when developing GLM-5.3. According to Anthropic, Zhipu attempted to distill Claude Fable 5, but switched to an older Claude model and a competitor's system after Anthropic's cyber safeguards degraded the extraction attempts. The US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) assessed GLM-5.3 as the most cyber-capable open-weights model released to date, per Anthropic's report.

Anthropic also reports one case in which requests to Moonshot AI's Kimi models were secretly forwarded to Claude to support distillation. These statements represent Anthropic's claims, as responses from Zhipu AI and Moonshot AI are not published in Anthropic's policy document. These allegations follow Anthropic's statements on September 10, 2026, alleging that DeepSeek, Moonshot AI, and Xiaomi conducted unauthorized distillation; see DeepSeek data privacy and security risks.

Anthropic says platforms and developers also have a role. Because distillers distribute scraping operations across Anthropic's direct API, third-party cloud hosting platforms, and external inference providers, Anthropic calls on platform operators and developers to detect and disrupt abuse and offboard fraudulent accounts.