Technology · NEWS EXPLAINER
Anthropic says its new anti-distillation defenses cut extracted reasoning by 90% to 99%
The company says layered controls reduced extracted reasoning tokens by a factor of 10 to 100, while preserved-thinking rules and classifiers create real integration and false-positive trade-offs.
Anthropic says a combination of preserved-thinking controls, extraction classifiers and account enforcement has reduced the amount of Claude reasoning harvested by suspected model distillers by roughly 90% to 99%. The figures are the company’s early estimate, not an independent audit.
For developers, the useful distinction is between the headline reduction and the operational trade-offs. Some integrations must preserve reasoning blocks unchanged, blocked requests can still be billed in narrowly measured categories, and Anthropic says benign requests are misclassified in fewer than 0.1% of cases.
The 90% to 99% figure is an internal estimate
Anthropic’s complete technical post says early evidence shows a 90% to 99% reduction in data harvested by distillers. It measures the number of reasoning tokens exposed on its own platform before and after the new safeguards. Reuters independently reported the same estimate and the 10-to-100-fold reduction. Neither source describes an outside replication, so the result should be read as a company measurement rather than a universal benchmark.
Three layers target different parts of the attack
The first layer limits where protected reasoning can be moved or edited. The second uses a two-stage classifier trained and red-teamed on extraction attempts. The third makes repeated attempts more expensive or short-lived through stricter limits, billing in narrowly defined blocked categories and account bans. Anthropic says its most capable generally available models use the classifier and that tens of thousands of accounts linked to suspected distillation campaigns have been banned.
Legitimate developers still face trade-offs
Preserved-thinking changes have required some developers to update integrations, especially workflows that edit or move prior reasoning context. Anthropic reports a false-positive rate below 0.1% for the classifier but acknowledges that benign requests can still be blocked. Since September 24 it has resumed charging for blocked requests in specific categories where it reports that low rate. Teams using Claude APIs should check current preserved-thinking documentation rather than treat the post as a drop-in configuration guide.
The company does not claim the problem is solved
Anthropic says attackers will continue adapting and that a highly sophisticated, persistent effort may still find new bypasses. The reported reduction applies to observed extraction on Anthropic’s platform, not to every provider or offline training pipeline. The most useful takeaway is therefore the layered design and the measured limitations, not a promise that unauthorized distillation has ended.
