SafetyPublished Top storyAll news from that day
Anthropic says new safeguards cut distillers' extraction of reasoning tokens
Anthropic's 12 October post describes preserved thinking, a two-stage classifier and charging for some blocked requests, and says its own estimate shows far less extraction.
Check our sources · 12 facts from 1 source
Image: Anthropic
Key points
- Anthropic says that, by its own estimate on its own platform, extraction of reasoning tokens by distillers is consistently 10 to 100 times lower after the classifier.
- Anthropic says preserved thinking stops accounts created on or after 31 August 2026 from editing Claude's prior context, and Sonnet 5.5 reasoning transcripts go only to the requesting organisation.
- Anthropic says its two-stage classifier has a false positive rate under 0.1%; since 24 September it has resumed charging for blocked requests in areas where the rate is that low.
What happened
Anthropic published a post on 12 October 2026 on how it defends against distillation attacks, which it describes as covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorisation of the original model's developers.
By Anthropic's own estimate on its own platform, since it introduced the classifier, the number of reasoning tokens extracted by distillers is consistently 10 to 100 times lower than it was before.
The post describes three kinds of defence. The first is preserved thinking, which stops new API accounts created on or after 31 August 2026 from editing Claude's prior context. Starting with Claude Sonnet 5.5, reasoning transcripts are accessible only to the organisation whose request produced them.
The second is a two-stage classifier, which Anthropic says has a false positive rate under 0.1% and which runs on the most capable generally available models.
The third is stricter limits and bans for persistent distillers; Anthropic says that since 24 September it has resumed charging for requests that its safeguards block before Claude responds, in the specific areas, including distillation, where they have a false positive rate under 0.1%.
Anthropic says it has banned tens of thousands of accounts associated with distillation, often in under two hours after a campaign starts.
In Anthropic's own test, a pretrained Claude model trained on full reasoning transcripts from Claude Opus 4.8 reached 80.4% on SWE-bench Verified, against 71.8% for one trained on summarised transcripts.
It says preserved thinking has required some developers to update their integrations, and expects distillation to remain a cat-and-mouse game.
Underlined sentences link to the facts we checked. Dotted words open a short explainer.
Fact 3 of 12 · from Anthropic, 12 Oct 2026
To measure the effectiveness of our system, we estimate how many tokens of Claude's reasoning distillers have extracted on our own platform. After introducing the classifier, the number of reasoning tokens extracted by distillers is consistently 10 to 100 times lower than it was before
Fact 4 of 12 · from Anthropic, 12 Oct 2026
With Claude Fable 5.1 and Claude Opus 5.5, we introduced preserved thinking, a measure that prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context.
Fact 5 of 12 · from Anthropic, 12 Oct 2026
with Claude Sonnet 5.5, we've made reasoning transcripts accessible only to the organization whose request produced the transcript.
Fact 8 of 12 · from Anthropic, 12 Oct 2026
Additionally, since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds, in the specific areas (including distillation) where they have a <0.1% false positive rate.
Fact 9 of 12 · from Anthropic, 12 Oct 2026
We've used these defenses to ban tens of thousands of accounts associated with distillation, often in less than two hours after such an account begins a distillation campaign.
Fact 10 of 12 · from Anthropic, 12 Oct 2026
We tested how well a pretrained Claude model performed on the SWE-bench Verified coding benchmark after it was trained on transcripts from Claude Opus 4.8. When training on the full transcripts, the distilled model achieved 80.4%; with only the summarized transcripts, it achieved 71.8%.
Fact 11 of 12 · from Anthropic, 12 Oct 2026
We haven't met this goal completely: preserved thinking has required some developers to update their integrations, our classifiers can (in fewer than 0.1% of cases) misidentify or block benign requests, and we now charge users for those blocked requests.
What it means for you
Our viewThe 10 to 100 times figure is Anthropic's own estimate on its own platform, tied to the classifier, so it says nothing about extraction elsewhere. Charging for blocked requests applies only in areas where the false positive rate is under 0.1%, and Anthropic says some developers had to update their integrations.
The SWE-bench comparison in the post is Anthropic's own test on Claude Opus 4.8 transcripts; it does not measure what the new safeguards achieve. Anthropic expects a cat-and-mouse game. If you build on Claude, check whether your integration edits prior context and whether blocked requests now appear on your bill.
It adds no new facts.
Your reaction
We count reactions per story and day, never who reacted. The counts help us choose what goes in the monthly issue. If you are signed in, your own page shows yours too.
We count reactions per story and day, never who reacted. They help choose what goes in the monthly issue.
Check our sources
Every sentence above is checked against this source.
1 Strengthening our defenses against distillation attacks
Open the source archived copy-
Anthropic published the post "Strengthening our defenses against distillation attacks" on 12 October 2026.
citeStrengthening our defenses against distillation attacks ... Oct 12, 2026
-
The post describes distillation attacks as "covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another."
citeDistillation attacks are covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorization of the original model's developers.
-
The post says that, by Anthropic's own estimate of reasoning tokens extracted on its own platform, after it introduced the classifier the number extracted by distillers is "consistently 10 to 100 times lower than it was before."
Toned down to what the source says
citeTo measure the effectiveness of our system, we estimate how many tokens of Claude's reasoning distillers have extracted on our own platform. After introducing the classifier, the number of reasoning tokens extracted by distillers is consistently 10 to 100 times lower than it was before
-
The post says preserved thinking prevents new API accounts, those created on or after 31 August 2026, from editing Claude's prior context.
citeWith Claude Fable 5.1 and Claude Opus 5.5, we introduced preserved thinking, a measure that prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context.
-
The post says that starting with Claude Sonnet 5.5, "we've made reasoning transcripts accessible only to the organization whose request produced the transcript."
citewith Claude Sonnet 5.5, we've made reasoning transcripts accessible only to the organization whose request produced the transcript.
-
The post says Anthropic built a two-stage classifier system with a false positive rate of less than 0.1%.
citeSpecifically, we built a two-stage classifier system of the kind we described in our constitutional classifiers research. ... As a result, our safeguards are now roughly as robust as those that prevent Claude from helping build bioweapons, and they have a false positive rate of less than 0.1%.
-
The post says the classifier runs on the most capable generally available models, currently Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1.
citeWe run this two-stage classifier on our most capable generally available models (currently, Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1)
-
The post says that since 24 September Anthropic has resumed charging for requests blocked by its safeguards before Claude responds, "in the specific areas (including distillation) where they have a <0.1% false positive rate."
Toned down to what the source says
citeAdditionally, since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds, in the specific areas (including distillation) where they have a <0.1% false positive rate.
-
The post says Anthropic has banned tens of thousands of accounts associated with distillation, often in less than two hours after such an account begins a distillation campaign.
citeWe've used these defenses to ban tens of thousands of accounts associated with distillation, often in less than two hours after such an account begins a distillation campaign.
-
The post says that in Anthropic's own test a pretrained Claude model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified, against 71.8% when trained on summarised transcripts.
Toned down to what the source says
citeWe tested how well a pretrained Claude model performed on the SWE-bench Verified coding benchmark after it was trained on transcripts from Claude Opus 4.8. When training on the full transcripts, the distilled model achieved 80.4%; with only the summarized transcripts, it achieved 71.8%.
-
The post says preserved thinking has required some developers to update their integrations.
citeWe haven't met this goal completely: preserved thinking has required some developers to update their integrations, our classifiers can (in fewer than 0.1% of cases) misidentify or block benign requests, and we now charge users for those blocked requests.
-
The post says Anthropic expects that distillation will remain a cat-and-mouse game.
citeWe expect that distillation will remain a cat-and-mouse game, and that we'll need to continue iterating on our defenses over time.
Every sentence above is checked against this source. Each fact has its own address you can cite.
Source 1 · Anthropic · 12 Oct 2026
Strengthening our defenses against distillation attacks
Anthropic published the post "Strengthening our defenses against distillation attacks" on 12 October 2026.
Strengthening our defenses against distillation attacks ... Oct 12, 2026
The post describes distillation attacks as "covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another."
Distillation attacks are covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without the authorization of the original model's developers.
The post says that, by Anthropic's own estimate of reasoning tokens extracted on its own platform, after it introduced the classifier the number extracted by distillers is "consistently 10 to 100 times lower than it was before."
Toned down to what the source saysTo measure the effectiveness of our system, we estimate how many tokens of Claude's reasoning distillers have extracted on our own platform. After introducing the classifier, the number of reasoning tokens extracted by distillers is consistently 10 to 100 times lower than it was before
Show all 12 factsShow fewer facts
The post says preserved thinking prevents new API accounts, those created on or after 31 August 2026, from editing Claude's prior context.
With Claude Fable 5.1 and Claude Opus 5.5, we introduced preserved thinking, a measure that prevents new API accounts (those created on or after August 31, 2026) from editing Claude's prior context.
The post says that starting with Claude Sonnet 5.5, "we've made reasoning transcripts accessible only to the organization whose request produced the transcript."
with Claude Sonnet 5.5, we've made reasoning transcripts accessible only to the organization whose request produced the transcript.
The post says Anthropic built a two-stage classifier system with a false positive rate of less than 0.1%.
Specifically, we built a two-stage classifier system of the kind we described in our constitutional classifiers research. ... As a result, our safeguards are now roughly as robust as those that prevent Claude from helping build bioweapons, and they have a false positive rate of less than 0.1%.
The post says the classifier runs on the most capable generally available models, currently Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1.
We run this two-stage classifier on our most capable generally available models (currently, Claude Sonnet 5.5, Claude Opus 5 and 5.5, and Claude Fable 5 and 5.1)
The post says that since 24 September Anthropic has resumed charging for requests blocked by its safeguards before Claude responds, "in the specific areas (including distillation) where they have a <0.1% false positive rate."
Toned down to what the source saysAdditionally, since September 24, we have resumed charging for requests that are blocked by our safeguards before Claude responds, in the specific areas (including distillation) where they have a <0.1% false positive rate.
The post says Anthropic has banned tens of thousands of accounts associated with distillation, often in less than two hours after such an account begins a distillation campaign.
We've used these defenses to ban tens of thousands of accounts associated with distillation, often in less than two hours after such an account begins a distillation campaign.
The post says that in Anthropic's own test a pretrained Claude model trained on full reasoning transcripts from Claude Opus 4.8 scored 80.4% on SWE-bench Verified, against 71.8% when trained on summarised transcripts.
Toned down to what the source saysWe tested how well a pretrained Claude model performed on the SWE-bench Verified coding benchmark after it was trained on transcripts from Claude Opus 4.8. When training on the full transcripts, the distilled model achieved 80.4%; with only the summarized transcripts, it achieved 71.8%.
The post says preserved thinking has required some developers to update their integrations.
We haven't met this goal completely: preserved thinking has required some developers to update their integrations, our classifiers can (in fewer than 0.1% of cases) misidentify or block benign requests, and we now charge users for those blocked requests.
The post says Anthropic expects that distillation will remain a cat-and-mouse game.
We expect that distillation will remain a cat-and-mouse game, and that we'll need to continue iterating on our defenses over time.
Topics
The morning email
On the mornings we publish: the three top stories and up to four short ones. Free.
We email you a link to confirm. An issue may include one sponsor, always labelled Sponsored · Advertisement. Our emails count opens and clicks, not who made them. Unsubscribe in one click. What we keep