Anthropic says new measures like preserved thinking in Fable 5.1 and Opus 5.5 have reduced data harvesting through distillation attacks by about 90% to 99%
In recent months, we've made substantial progress on reducing the effectiveness of distillation attacks on Claude using new methods, as we outline in this blog.
Anthropic
Context & Ripple Effects
Anthropic’s Fable 5 rollout has paired restrictive classifiers with efforts to reduce unnecessary disruption: its earlier biology-safeguard adjustment cut tested fallbacks, while some cybersecurity and routine coding requests were routed to Opus 4.8 under the prior safety design. The new claim extends that control layer from governing user access to limiting the value of Claude outputs as training material for would-be distillers.
First-order effects
Anthropic says its new Claude defenses, including preserved thinking in Fable 5.1 and Opus 5.5, cut the data distillers can harvest by about 90% to 99%.
Organizations attempting to distill Claude receive materially less useful output from the same access, according to Anthropic’s measurement.
Second-order effects
For Anthropic, model-serving safeguards become part of protecting the value of its inference product, alongside the safety classifiers that already determine when some requests fall back to Opus 4.8.
Distillers seeking to reproduce Claude-like behavior face a lower-yield collection channel, increasing the importance of data sources that do not depend on Claude interactions.
Third-order effects
If comparable defenses prove durable, frontier-model providers will increasingly treat reasoning traces and output patterns as protected product surfaces rather than passive training exhaust.
The competitive boundary shifts toward an inference moat: model quality alone is less separable from the controls governing how users can observe and reuse it.
The trend: Model providers are turning inference access into a defensible asset by combining safety routing with anti-distillation controls.
Over the last few months, we've made significant progress in reducing the effectiveness of distillation attacks against Claude. In this post, we explain how: https://www.anthropic.com/...
Good, good. Time for sovereign RL stacks to bloom. But I wonder: if the issue with GLM 5.3 is that it's cyber-capable yet without safeguards, how did this capability get distilled from a Claude model protected by safeguards?
Anthropic: Reduced amount of data harvested by distillers by 90-99%. China's Zhipu tried to distill Fable 5. We've turned away meaningful revenue and trillions of tokens' worth of paying traffic. So, will Anthropic follow OpenAI with revenue shortfall? https://www.anthropic.com/.…
You distilled HUMANITY. You trained on our knowledge, scanned millions of books and threw the physical copies away. You built a business on work people spent their lives creating, and charge us for access to the result. But when someone uses YOUR output to build a competitor, sud…
Can I see your article explaining how you have the right to distill your models from all the copyrighted training data you used? How that is different from a “distillation attack”?
ANTHROPIC JUST EXPOSED FOREIGN AI LABS STEALING CLAUDE AT INDUSTRIAL SCALE. hundreds of thousands of fake accounts, stolen payment details, false identities, resold access in blocked regions, and one network running 20,000+ accounts at once all to harvest Claude's reasoning and t…
now we know why chinese models are struggling to catch up with opus 5.5 anthropic have improved their anti-distillation system and also named two of the biggest open weight chinese ai labs
With Anthropic taking measures to stop distillation, how much of its revenue did distillation ever comprise? cc @DavidSacks @Noahpinion @natolambert @nxthompson
probably the most interesting graph in anthropic's distillation report is the one that shows how much distillation uplift you get if you have the reasoning traces. the gap is about the same as the difference between opus 4 and opus 4.5.
our heroic members of technical staff their brutish distillers our glorious cyber capabilities their wicked cyber risk our noble human data pipelines their backwards distillation attacks
Anthropic says it has reduced the data harvested from Claude in distillation attacks by around 90-99%. I congratulate them on this achievement. It's consistent with the point I made a few months ago (All-In Ep. 282): Anthropic, not the government, was in the best position to stop…
Turns out distillation didn't need government intervention after all. Now imagine if the government had stepped in anyway. Next scare: AI could self-replicate across IoT devices! Truly unprecedented. Unless you've heard of botnets. https://x.com/...
It's bizarre to me how much noise anthropic made asking for regulatory help before doing this. Hopefully can be a conversation reset now. Was doubly bizarre bc they emphasized the security risk of learning harmful behaviors from their leaky api. If API is unsafe don't host it. [e…