Anthropic reports that new defensive measures have reduced the amount of Claude reasoning data harvested by illicit distillers by roughly 90 to 99%. Distillation attacks involve covert, industrial-scale campaigns where foreign labs use fraudulent account networks to extract Claude's hidden reasoning transcripts and train smaller models to mimic frontier capabilities. Anthropic has deployed three categories of defenses: "preserved thinking" restrictions that prevent reasoning blocks from being moved between conversations, models, or accounts; a two-stage constitutional classifier that detects extraction attempts with under 0.1% false positives; and usage-limit and account-ban policies for repeat offenders. The company acknowledges trade-offs, including forfeiting meaningful revenue and requiring some developers to update integrations.
- Zhipu distilled cyber capabilities from US models for GLM-5.3, which NIST assessed as the most cyber-capable open-weights model released to date
- One distillation network managed over 20,000 fraudulent accounts simultaneously
- A PLA-affiliated user leveraged the Kimi distillation pipeline to analyze CCTV surveillance of a specific individual
- Zhipu distilled cyber capabilities from US models for GLM-5.3, which NIST assessed as the most cyber-capable open-weights model released to date
- One distillation network managed over 20,000 fraudulent accounts simultaneously
- A PLA-affiliated user leveraged the Kimi distillation pipeline to analyze CCTV surveillance of a specific individual
