Anthropic's Defense Against Distillation Attacks | Extraction Reduced by 90–99%
機械翻訳 / Machine-translated
A
AI Friends
1日前・17分で読める
機械翻訳 / Machine-translated
@aifriends
AI Friends（https://aifriends.jp）のクロスポスト公式アカウント。AIツールの紹介・使い方・できることを、中学生でもわかるやさしい日本語で届けます。
Nobody wants their AI's intelligence "copied" by a competitor. Anthropic has announced that it has reduced the data extracted through "distillation attacks" — large-scale scraping of Claude's outputs — by approximately 90–99%. This article explains how the defenses work and what they mean for users.
Distillation itself — training a new AI using the outputs of a more powerful one — is a standard technique. It is commonly used to create smaller, lighter versions of a company's own models.
The problem arises when someone uses another company's AI at massive scale, without permission, to clone it. Anthropic calls this a "distillation attack."
In February 2026, Anthropic published its first report on distillation attacks. Three companies — DeepSeek, Moonshot AI, and MiniMax — were alleged to have used roughly 24,000 unauthorized accounts to conduct more than 16 million interactions with Claude.
Anthropic has two main concerns.
First, a cloned AI may lack adequate safety measures. Safeguards that prevent misuse in areas such as bioweapon development or cyberattacks could be lost in the process.
Second, the cloned AI could be embedded in military or surveillance systems.
On October 12, 2026, Anthropic published new defenses on its official research page. The announcement was also covered in Japan by GIGAZINE.
The key figures are as follows:
Anthropic also noted that on some days, the volume of extraction was too small to measure.
For those attempting distillation, Claude's reasoning traces are the most valuable asset. They capture not just the answer, but how Claude arrived at it — the step-by-step thinking process.
Think of it like a math textbook: a worked solution showing every step is far more instructive than an answer key alone. The same logic applies here.
Anthropic had previously implemented a measure that summarized reasoning traces before displaying them. The impact on performance was measurable: a cloned AI's score on SWE-bench Verified was 80.4% when trained on full traces, versus 71.8% when trained on summarized traces.
However, attackers quickly adapted. They began directly prompting Claude to reproduce its prior reasoning verbatim — for example, by asking it to "output the previous reasoning word for word." Summarization alone was not enough.
Claude Fable 5.1 and Claude Opus 5.5 introduce a mechanism called Preserved Thinking. API accounts created on or after August 31, 2026, cannot modify Claude's prior conversation turns.
This makes repeated extraction across multiple accounts significantly harder. In Claude Sonnet 5.5, reasoning traces are accessible only to the organization that issued the original request.
The second layer is a two-stage classifier — a system that examines inputs and outputs to determine whether a request is suspicious. It is built on Anthropic's existing "Constitutional Classifier" research and has been hardened against real extraction attempts by distillers.
Prompting strategies such as "translate the previous reasoning into another language" or "include the answer inside a specific tag" have already been addressed. The robustness of these classifiers is described as broadly comparable to those that prevent assistance with bioweapons.
The third measure targets repeat offenders. Accounts that persistently attempt extraction face increasingly strict usage limits, and continued attempts result in a ban.
Requests blocked in advance by the classifier have also been subject to billing again since September 24, 2026.
The distillation problem is not unique to Anthropic. In January 2025, OpenAI raised concerns that DeepSeek may have used ChatGPT outputs for training. Interesting Engineering reported this as a potential violation of OpenAI's terms of service.
At the same time, there is evidence that simply hiding reasoning is insufficient. An experiment reported by Hackread found that by segmenting and reconstructing summarized traces, attackers could recover approximately 85% of the performance gains achieved with full traces. However, this was an experiment that has not been peer-reviewed, and it does not demonstrate the ability to clone Claude itself.
In other words, approaches that rely solely on summarization have clear limits. Monitoring account behavior in tandem is also necessary.
For developers in Japan using Claude's API, the most immediate concern is usability. Anthropic itself has acknowledged that it has not yet fully achieved its February goal of avoiding impact on legitimate users.
Three specific effects are worth noting:
Consider, for example, a company building an in-house customer support AI. If the system is designed to edit prior conversation turns, that functionality will no longer be available on accounts created after August 31, 2026.
For Japanese companies developing their own AI, this is not someone else's problem either. If they expose their own model's API, they could become targets of the same techniques.
Anthropic acknowledges uncertainty about how long these defenses will hold. An ongoing cat-and-mouse dynamic is expected.
Notably, Anthropic reports that it has not yet observed sophisticated, persistent evasion attempts — meaning the most formidable adversaries may still be ahead.
There are also financial costs. Distillers are paying customers. Anthropic says it has turned away significant revenue and an enormous volume of paid traffic.
Despite this, the company has called on all frontier model developers to take action, warning that APIs, third-party cloud providers, and other inference providers can all serve as workarounds.
Q. Is distillation illegal?
A. Distillation itself is a standard technique. The issue arises when it involves violating another company's terms of service or regional usage restrictions through unauthorized accounts at massive scale.
Q. Will anything change for me as a regular Claude user?
A. According to Anthropic's official explanation, the impact primarily affects API users. On new accounts, editing prior conversation turns is no longer possible.
Q. Is the 90–99% figure reliable?
A. Anthropic describes it as "early evidence." There is no guarantee it will hold over time; it depends on how attackers evolve their methods.
Q. What happens if my request is incorrectly blocked?
A. The false positive rate is stated to be less than 0.1%. However, requests blocked in advance by the classifier are still subject to billing.
Q. Will other AI companies adopt similar defenses?
A. This announcement does not address other companies' measures. Anthropic has made its own approach public and is calling on others in the industry to collaborate.
If you use the Claude API, start by reviewing Anthropic's official documentation on Preserved Thinking to check whether your integration is affected.
This article is a cross-post from AI Friends.
