- Anthropic says that, by its own estimate on its own platform, extraction of reasoning tokens by distillers is consistently 10 to 100 times lower after the classifier.
- Anthropic says preserved thinking stops accounts created on or after 31 August 2026 from editing Claude's prior context, and Sonnet 5.5 reasoning transcripts go only to the requesting organisation.
- Anthropic says its two-stage classifier has a false positive rate under 0.1%; since 24 September it has resumed charging for blocked requests in areas where the rate is that low.
Anthropic published a post on 12 October 2026 on how it defends against distillation attacks, which it describes as covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorisation of the original model's developers. By Anthropic's own estimate on its own platform, since it introduced the classifier, the number of reasoning tokens extracted by distillers is consistently 10 to 100 times lower than it was before.
The post describes three kinds of defence. The first is preserved thinking, which stops new API accounts created on or after 31 August 2026 from editing Claude's prior context. Starting with Claude Sonnet 5.5, reasoning transcripts are accessible only to the organisation whose request produced them. The second is a two-stage classifier, which Anthropic says has a false positive rate under 0.1% and which runs on the most capable generally available models. The third is stricter limits and bans for persistent distillers; Anthropic says that since 24 September it has resumed charging for requests that its safeguards block before Claude responds, in the specific areas, including distillation, where they have a false positive rate under 0.1%.
Anthropic says it has banned tens of thousands of accounts associated with distillation, often in under two hours after a campaign starts. In Anthropic's own test, a pretrained Claude model trained on full reasoning transcripts from Claude Opus 4.8 reached 80.4% on SWE-bench Verified, against 71.8% for one trained on summarised transcripts. It says preserved thinking has required some developers to update their integrations, and expects distillation to remain a cat-and-mouse game.
What it means for you Our view
The 10 to 100 times figure is Anthropic's own estimate on its own platform, tied to the classifier, so it says nothing about extraction elsewhere. Charging for blocked requests applies only in areas where the false positive rate is under 0.1%, and Anthropic says some developers had to update their integrations. The SWE-bench comparison in the post is Anthropic's own test on Claude Opus 4.8 transcripts; it does not measure what the new safeguards achieve. Anthropic expects a cat-and-mouse game. If you build on Claude, check whether your integration edits prior context and whether blocked requests now appear on your bill.
TAGSAnthropicClassifiersClaudeDistillationPreserved thinking
