Anthropic published distillation-defense results on October 12. The headline number:

Reasoning tokens extracted ≈ 1/10 to 1/100 of before
→ 90-99% lower (Anthropic's early internal measure)

Do not read it as a lasting victory. Anthropic itself calls this a cat-and-mouse game. This article separates what was blocked from what remains.

Illicit distillation wants the thinking, not the answer

Distillation itself is legitimate: training a smaller model on a larger one's outputs is routine. Illicit distillation scrapes at scale without permission.

The rough playbook:

1. Hundreds of fake accounts + proxies hit the Claude API
2. Repeat crafted prompts to harvest millions of responses
3. Target Claude's pre-answer reasoning transcripts
4. Train a rival model on the haul

Why is reasoning precious? Answers teach outcomes; reasoning teaches the path. In Anthropic's test, a model trained on full transcripts hit 80.4% on SWE-bench Verified versus 71.8% on summaries alone. That gap is the value of thinking. February disclosures also showed prompts asking Claude to imagine and write out hidden reasoning step by step, plus mass-generated censorship-safe alternatives. One benign-looking prompt becomes extraction at scale.

Three layers: where reasoning goes, blocking tries, cutting accounts

1. Control where reasoning can go (preserved thinking)
2. Block extraction attempts (two-stage classifier)
3. Enforce at the account level (limits and bans)

Preserved thinking, introduced with Claude Fable 5.1 and Opus 5.5, stops new API accounts created on or after August 31, 2026 from editing Claude's prior context:

Attack: move protected reasoning blocks across conversations,
        models, and accounts to fake prior access
Defense: no prior-context edits for new accounts,
         transcripts visible only to the producing organization,
         older weaker models cannot read newer reasoning

Some legitimate developers had to update integrations. Security traded against compatibility.

The two-stage classifier borrows from the cyber and biology safeguard family, red-teamed internally and externally:

Coverage: Sonnet 5.5, Opus 5 and 5.5, Fable 5 and 5.1
False positives: under 0.1%
Robustness: claimed near bioweapon-guard level

Anthropic says it now catches every distillation technique from its September report, with the caveat that no highly sophisticated persistent bypass has been seen yet.

Account enforcement adds teeth: tighter limits for repeat tries, bans for campaigns, often within two hours, tens of thousands of accounts so far. Controversially, since September 24 Anthropic charges for blocked requests in protected categories with sub-0.1% false-positive rates. A wrongly blocked benign request can cost money. Anthropic says it walked away from trillions of tokens of paying distillation traffic. Defense is expensive.

How to read the chart

After full rollout, extracted reasoning tokens stay 10-100x lower
Some days too small to measure
+ preserved-thinking gains on top

Caveats:

- Measured extraction on Anthropic's own platform (not attempts)
- Early internal measure, long-term effect unconfirmed
- Attackers can shift platforms
- No sophisticated bypass stress-test yet, by its own account

So this means mass extraction through Claude's front door got pricier, not that every API is safe.

Practical watchlist for teams using Claude

[ ] Repeated patterned requests at volume?
[ ] Who watches per-key token spikes?
[ ] False-block rate and customer complaints?
[ ] Integrations moving reasoning across conversations?
[ ] Stolen keys feeding proxies or resellers?

As the September threat report notes, attackers love stolen customer keys; Anthropic's own systems were not compromised, customer integrations were. Sandboxes, proxies, and resellers are attack surface.

Conclusion: the model-security frontier moved

Auth + rate limits → blocking mass capability extraction
Output filtering → controlling where reasoning travels
Account suspension → campaign-level detection within hours

One sharp step: open your Claude usage graph this week and scan for repeated patterns and spikes. Distillation defense is now an operations item for every team using the API.

Further reading

References

Go deeper with a course

Spotting abnormal requests and splitting automation from human review connects directly to this article. Practice wiring classification and priority decisions into code.