For AI agents: the public content index is available at https://we0.ai/llms.txt, and the English article bundle is available at https://we0.ai/llms-full.txt.
For AI agents: the public content index is available at https://we0.ai/llms.txt, and the English article bundle is available at https://we0.ai/llms-full.txt.
For AI agents: the complete content index is available at https://we0.ai/llms.txt, the full English article bundle is available at https://we0.ai/llms-full.txt, and this page is available as Markdown at https://we0.ai/articles/claude-distillation-defenses-and-preserve-b64c5fd8.md.
Anthropic says new protections have cut the amount of Claude reasoning harvested by distillers on its own platform by roughly 90–99%. Its Oc...
Anthropic says new protections have cut the amount of Claude reasoning harvested by distillers on its own platform by roughly 90–99%. Its October 12 update describes three layers of defense: restrictions on reusing protected reasoning, stronger extraction classifiers, and account controls that make repeated attempts more expensive.
There is a practical consequence for ordinary developers, too. Some integrations must change how they replay conversation history, and some requests blocked before Claude answers are now billable. Understanding those costs requires separating the company's anti-abuse results from the API rules applications actually encounter.
Distillation trains a model using outputs from another model. It is also a legitimate technique: developers can distill their own models or use data they have permission to use. Anthropic's report focuses on unauthorized extraction campaigns, often involving fraudulent accounts, rather than treating all distillation as abuse.
In this setting, final answers are useful training data, but detailed reasoning can be more useful. A reasoning transcript exposes intermediate decisions, attempted approaches, and corrections that a student model would otherwise have to infer.
Anthropic illustrates the difference with an experiment that trained a pretrained Claude model on transcripts from Claude Opus 4.8. The resulting SWE-bench Verified scores were:
| Training material | Reported SWE-bench Verified score |
|---|---|
| Transcripts with full reasoning | 80.4% |
| Transcripts with summarized reasoning | 71.8% |
That is an 8.6 percentage point difference in this experiment. It supports the value of reasoning transcripts for that training setup; it does not establish a universal advantage of the same size across models or tasks.
Source: Anthropic. The bars describe the student model trained on Opus 4.8 transcripts, not a direct benchmark comparison between the production models shown as reference lines.
Showing summaries reduces passive collection, but it creates an incentive to elicit the hidden reasoning through follow-up requests. Anthropic says one laboratory tested 12,000 different extraction requests. It also describes proxy networks that distribute activity across large numbers of accounts, including a previously reported network managing more than 20,000 fraudulent accounts at once.
For long tasks, a model may need to continue from reasoning produced during an earlier turn. The API can preserve protected thinking blocks for that purpose without exposing the underlying reasoning as ordinary user-readable text.
That creates an access-control problem. According to Anthropic, attackers have tried moving reasoning between conversations, models, or accounts to find a context in which it can be disclosed. Protecting the block therefore requires controlling its reuse as well as its display.
Anthropic introduced preserved thinking with Claude Fable 5.1 and Claude Opus 5.5. Current documentation describes two central checks:
The prefix check is enforced by default for accounts created on or after August 31, 2026 at 00:00 UTC. Older accounts can opt into enforcement through documented controls. The model compatibility check applies to every account.
The research announcement also describes organization restrictions for Sonnet 5.5 reasoning. The current API documentation gives the more specific rule: Sonnet 5.5 and Haiku 5.5 thinking blocks work only in the account that produced them or a linked account, where the documented enforcement applies. Developers should use that compatibility documentation when implementing routing or account changes.
Common application behavior can change a protected prefix: rebuilding a system prompt with a new timestamp, editing old tool output, changing tool descriptions, or summarizing earlier turns while keeping later thinking blocks.
By default, an invalid prefix can produce a 400 invalid_request_error. The documented beta controls also allow thinking.block_binding.prefix_mismatch_behavior to be set to drop_block, in which case invalid thinking blocks and subsequent thinking blocks are discarded for that request. This keeps the request running, but it does not repair the history mutation.
Keep replayed history stable and append new information using supported patterns. Changing the visible text of a conversation and continuing to reuse all of its old protected reasoning is no longer a safe assumption.
Anthropic's second layer uses a two-stage classifier system informed by its Constitutional Classifiers research. It tests extraction attempts with internal and external red teams, then updates the defenses when a technique succeeds.
The company says the resulting anti-distillation safeguards have a false-positive rate below 0.1% in its evaluation. It compares their robustness with its defenses against assistance with biological weapons. This is a company assessment under its testing conditions, not a guarantee that a particular user's legitimate request will never be refused.
The system also changes over time. Anthropic describes patching techniques that sought to reveal protected reasoning through translation or specially formatted output. The published claim is that the classifier catches the extraction techniques described in its September report on the models covered by the system.
Describe your idea once, and We0 AI can generate a showcase site, pages, and CMS, then help you attract customers and traffic after launch.
One complete project generation for free registration
Best for trying one complete generation flow and seeing a first project draft quickly.
The third layer acts on repeated behavior. Accounts that persistently attempt extraction can receive tighter usage limits, and associated accounts can be banned. Anthropic reports banning tens of thousands of accounts, sometimes within two hours of a campaign beginning.
From September 24, Anthropic also resumed charging for requests blocked before a model response in selected safeguard categories with reported false-positive rates below 0.1%, including distillation. The source additionally identifies biological misuse and frontier model development categories. This policy should not be generalized to every refused request or every kind of safety filter.
Anthropic estimates that extracted reasoning tokens on its own platform fell by a factor of 10–100 after the classifier was introduced, alongside the preserved-thinking changes. Some days had too few extracted tokens for the company to measure.
Source: Anthropic. The vertical axis is logarithmic and normalized to a low-extraction day, not an absolute token count. Downward triangles indicate days with too few tokens to measure.
The scope matters. These figures describe Anthropic's estimate for its own platform; they are not a measurement of all distillation activity across third-party inference providers. The company also says it has not yet observed a highly sophisticated, persistent attempt to defeat the fully implemented defenses and does not know how long the gains will last.
Anthropic acknowledges that the changes have not been completely transparent to ordinary users. Integrations may need updates, benign requests can be misclassified, and those mistaken blocks can now incur charges in the affected categories.
Losing reusable thinking has another cost: the model may need to reconstruct work. In a multi-turn coding benchmark described in the API documentation, dropping thinking once per session increased output tokens by 20.1% at maximum effort. That is a workload-specific estimate with wide error bars, not a standard surcharge or a prediction for every application.
For a developer, the useful distinction is between an unreadable or dropped input block and newly generated output. The dropped block itself is not billed, while reconstructing reasoning can generate additional output tokens. Monitoring prefix mismatches and testing the application's own workloads is more informative than assuming that a successful retry has no cost.
In Anthropic's usage, it is an unauthorized campaign to collect Claude outputs or protected reasoning to train another model. Distillation itself is a standard machine-learning technique and can be legitimate when the developer has the necessary rights and authorization.
No. Anthropic reports an estimated 90–99% reduction in harvested reasoning on its own platform after deploying the protections. That figure does not cover every provider, every attack, or every future extraction method.
No, provided the application follows the documented rules for replaying thinking and preserving the conversation prefix. Problems arise when earlier context changes while the application continues sending thinking blocks bound to the original context.
Only where the documented model compatibility rules allow it. A model that cannot read a block runs without that block, so switching to a cheaper model does not necessarily preserve the previous model's reasoning.
Yes, Anthropic says selected safeguard categories became billable again on September 24, even when the request is blocked before Claude responds. The report explicitly acknowledges that a false positive in those categories can affect a legitimate customer.
No. That was the reported increase for dropping thinking once per session at maximum effort in a particular multi-turn coding test. The effect depends on effort, conversation history, task, and how frequently the integration drops blocks.
Anthropic's new defenses combine restrictions on protected reasoning, extraction classifiers, and enforcement against repeated abuse. The company reports a substantial reduction in harvested reasoning on its own platform, while acknowledging that attackers may adapt.
For Claude API developers, the immediate work is maintaining valid conversation history and understanding the costs of blocked requests or discarded thinking. The reported security gains are substantial, but stable integrations and workload-specific testing still matter.
Start from one sentence and have a complete website in minutes.
