Anthropic reports stronger distillation defenses
Anthropic says its defenses have cut the reasoning data extracted from Claude by distillers on its own platform by roughly 90 to 99 percent. Its October 12, 2026 report describes measures introduced over recent months.
The approach restricts how protected reasoning travels between conversations, models and accounts. A two stage classifier screens extraction attempts, while usage limits and account bans make repeated probing harder. Some developers have had to update their integrations. The controls vary by model and account.
Anthropic reports a false positive rate below 0.1 percent, but legitimate requests can still be blocked and charged. It resumed charges on September 24 for specified areas including distillation. It does not know how durable the gains will be and says it has not faced a highly sophisticated, persistent attempt to defeat the measures.
Why model outputs have value
Distillation has a longer history. Geoffrey Hinton, Oriol Vinyals and Jeff Dean’s March 2015 paper described transferring knowledge from cumbersome models into a smaller model that was easier to deploy. Its examples included digit recognition and a commercial speech system.
The smaller model learned from the larger model’s probability estimates across possible answers. Those estimates carry information about similarities that a single correct label leaves out. This helps explain why richer model outputs can be valuable training material. The historical work examined a compression method, with its own tasks and evaluation settings.
Earlier research exposed a portability problem
An August 10, 2026 paper by Alexander Panfilov and colleagues examined APIs available in early July. They found that reasoning blocks could travel across sessions, users and models, allowing a less protected model to expose another model’s reasoning within the same provider’s system.
The study covered Anthropic, OpenAI and Google. After disclosing the findings, the researchers said they could no longer perform the same attacks. Those results provide historical context and do not independently verify Anthropic’s October defenses. The authors also could not verify every reconstructed token against the original plaintext reasoning.
The paper also examined publicly shared session logs. Across 315,320 reasoning blocks, the researchers found personal information and credentials. Some material came from synthetic benchmark identities. Their analysis also identified genuine user secrets, including information absent from the visible conversation.
The researchers recommend removing opaque reasoning fields before public release when an agent has encountered sensitive information. They also propose binding protected blocks to their original user and conversation. Such restrictions can complicate legitimate history editing and model switching, making integration design part of the security tradeoff.
