Anthropic blocks tens of thousands of accounts linked to distillation

Anthropic blocked tens of thousands of accounts to halt distillation attacks on Claude, cutting extracted reasoning data by 90% to 99% across its platform.

Anthropic claims to have significantly curtailed attempts to replicate Claude’s capabilities without authorization. In an October 12 post, the company details new protections against distillation attacks, reporting a 90% to 99% reduction in extracted reasoning data on its platform. According to its internal metrics, this represents major progress, though Anthropic acknowledges that these defenses will still need to withstand more sophisticated attacks. When models learn to copy Claude

Distillation involves leveraging the outputs of an advanced model to train another system to replicate certain capabilities. While this technique exists in AI research, Anthropic here denounces its clandestine, large-scale use by actors seeking to siphon Claude’s performance without authorization.

The most sought-after data is reportedly not the final answers, but the detailed reasoning traces produced by the model. Anthropic explains that a system trained on this information can learn more efficiently than by studying final results alone.

To measure this advantage, the company compared two training runs using data derived from Claude Opus 4.8. On SWE-bench Verified, the model trained with full reasoning traces achieved 80.4%, compared to 71.8% with summarized versions. Three protections against mass extraction

Faced with networks capable of mobilizing thousands of fraudulent accounts, Anthropic strengthened its defenses on three fronts.

The first involves the flow of protected reasoning between conversations, accounts, and models. With preserved thinking mechanisms, introduced notably on Claude Fable 5.1 and Opus 5.5, new API accounts can no longer modify certain parts of the prior context in an attempt to extract its content.

The second relies on a two-stage classification system tasked with identifying suspicious requests. Anthropic reports a false positive rate of less than 0.1% in its evaluations.

Finally, accounts that repeatedly attempt extraction face restrictions or suspension. The company indicates it has banned tens of thousands of accounts associated with these practices. Since September 24, certain requests blocked prior to generating a response are also billed, in order to make repeated attacks more costly. A technical and geopolitical battle

Anthropic frames this offensive within the context of international competition surrounding AI models. The company notably accuses Chinese lab Zhipu of leveraging the capabilities of US models during the development of GLM-5.3. It also cites practices attributed to Moonshot AI, developer of Kimi, where certain queries were allegedly redirected to Claude.

These accusations originate from Anthropic and do not, on their own, constitute an independent demonstration of all reported facts. However, the company sees a dual risk: the replication of advanced capabilities without equivalent safeguards, and their potential use in sensitive domains, particularly cybersecurity and surveillance. Effective defenses, but not without consequences

According to Anthropic, the new measures have reduced the volume of reasoning data harvested by identified distillation actors by a factor of 10 to 100. The company nonetheless admits that some legitimate developers had to adjust their integrations, and that rare ordinary requests may be blocked by mistake.

A key difficulty remains: preventing the unauthorized copying of models without penalizing their users, in an industry where access to advanced capabilities is also a commercial stake. Anthropic acknowledges foregoing significant revenue by blocking these activities. Protecting models is thus becoming a new battleground among laboratories, beyond the mere race for performance.