Anthropic announces next-generation anti-distillation defenses
The volume of reasoning tokens attackers extracted from the Claude platform has dropped by 90%–99%. Zhipu's GLM-5.3 model training has once again been singled out, and Moonshot's Kimi user requests being forwarded for distillation has once again substantiated the source of military surveillance imagery.
Anthropic has once again made clear that distillation is a national security issue:
1. Distilled models approach frontier capabilities but lack commensurate safety safeguards (especially in biological and cybersecurity domains), effectively releasing dangerous capabilities "naked";
2. The stolen capabilities are integrated into foreign military, intelligence, and surveillance systems.
A key finding about the attack surface: reasoning chains are the main target!
· Passive distillation: using replies to normal requests as training data;
· Active extraction: inducing Claude to leak its hidden complete chain-of-thought. For example, directly instructing it to "output your previous reasoning verbatim," and one lab tested more than 10,000 different elicitation prompts.
The value of chain-of-thought is supported by hard data: a model trained on complete Opus 4.8 reasoning records scored 80.4% on SWE-bench Verified, while one trained only on summarized reasoning records dropped to 71.8%. A gap of nearly 9 percentage points shows that raw reasoning traces contain a large amount of capability gains that can be "freeloaded"; this is why attackers bypass the summarization mechanism to directly steal raw reasoning.
The defense system: three layers
Layer 1: Reasoning summarization. Claude summarizes its reasoning before displaying its thinking process, so the raw reasoning chain is not directly exposed. This was an early defense, but attackers kept finding ways around it (such as translating reasoning into another language or writing it into special tags), proving that it alone is not enough.
Layer 2: Preserved thinking, the key innovation this time, launched with Claude Fable 5.1 and Opus 5.5. Core mechanisms:
· New API accounts created after August 31, 2026 cannot edit Claude's prior context;
· A model's reasoning content cannot be read by earlier models with weaker safeguards;
· For Sonnet 5.5, reasoning records are visible only to the organization that generated them.
This directly targets a common proxy-network trick: shuttling content between different conversations, models, and accounts so that Claude "mistakenly believes" it already holds unsummarized reasoning, thereby tricking it into repeating it. Cutting off context editing and cross-model reading dismantles the infrastructure underlying this scheme.
Layer 3: Two-stage constitutional classifiers plus account-level enforcement.
· The classifiers were trained on distillers' traffic logs and, after internal and external red-team testing, can identify all the attack techniques recorded in the September report, with a false positive rate below 0.1%. They are currently applied to Sonnet 5.5, Opus 5/5.5, and Fable 5/5.1, and will cover all models attractive to distillers in the future.
· At the account level: tightened limits and large-scale bans (often completed within two hours of detection, totaling tens of thousands of accounts). Notably, since September 24, Anthropic has resumed charging for requests blocked by safety filters; this is a deliberate economic measure to raise attack costs, enforced only in domains where the false positive rate is below 0.1%.
Two named cases, re-cited (Zhipu and Moonshot)
Zhipu (GLM-5.3): Anthropic directly named Zhipu for distilling the cyberattack capabilities of leading US models during GLM-5.3 development. One intriguing detail: Zhipu tried to distill Claude Fable 5, but after finding that its cybersecurity safeguards weakened the attack's effectiveness, it switched to an older Claude version and a model from another lab. This indirectly validates that the safeguards work, and also exposes a structural problem: "attackers flow toward the model with the weakest safeguards." CAISI (the US Center for AI Standards and Innovation) assessed GLM-5.3 as the most cyber-capable open-weight model to date, while Anthropic's own testing found its safeguards "can be easily bypassed," and that it was willing to develop security exploits end to end.
Moonshot (Kimi): Kimi user requests were covertly forwarded to Claude as a distillation data source. One request came from a user Anthropic believes is affiliated with the military, aimed at analyzing television surveillance footage targeting a specific individual.