Anthropic says new Claude safeguards have cut data harvested in distillation attacks by about 90% to 99%, and it named China's Z.ai as one company that tried it.
Key Points:
- Anthropic says new defenses cut the data distillers pull from Claude by roughly 90% to 99%.
- The company has banned tens of thousands of accounts tied to distillation campaigns.
- Anthropic said Z.ai, also known as Zhipu, tried to distill Claude while building its GLM-5.3 model.
Claude Distillation Defenses
Anthropic laid out the results in a research post on Monday, Oct. 12, describing changes it has rolled out over recent months. The company said early evidence shows its new methods have reduced the amount of data harvested by distillers by around 90% to 99%, though it cautioned that it does not know how long the gains will last. The defenses center on Claude's reasoning, the step-by-step thinking the model writes before it answers.
With Claude Fable 5.1 and Claude Opus 5.5, new API accounts created on or after Aug. 31 can no longer edit Claude's prior context, a feature Anthropic calls preserved thinking. A new two-stage classifier also blocks extraction attempts with a false positive rate below 0.1%, and the company says distillers now pull out 10 to 100 times fewer reasoning tokens than before.
Anthropic has also banned tens of thousands of linked accounts, often within two hours.
Also Read: GPT-6.1 Sol Helped Cut Asana’s Agent Costs 76 Times, But Here’s The Catch
Z.ai Distillation Allegations
Distillation trains a smaller model on a stronger model's answers, and OpenAI and Google have joined Anthropic in arguing that it lets rivals copy advanced capabilities faster and more cheaply. Reasoning transcripts matter most, and in Anthropic's own test a model trained on full Claude reasoning scored 80.4% on the SWE-bench Verified coding benchmark, compared with 71.8% when trained on summaries.
The company warned that such copying poses safety and national security risks, because distilled models often reach the public without proportionally robust safeguards. It said Z.ai, also known as Zhipu, tried to distill Claude Fable 5 while building GLM-5.3, then switched to an older Claude model and another lab's model after cyber safeguards degraded its attacks. Z.ai did not immediately respond to a request for comment.
No outside party has verified the figures yet. Anthropic also admitted trade-offs, including turned-away revenue, integration changes for some developers, occasional blocks on legitimate requests and charges for blocked requests, which it resumed on Sept. 24.
The announcement follows months of accusations. In February, Anthropic accused DeepSeek, Moonshot AI and MiniMax of generating more than 16 million exchanges with Claude through about 24,000 fraudulent accounts to improve their own models. Then on Sept. 17, U.S. evaluators at the National Institute of Standards and Technology rated GLM-5.3 the most cyber-capable open-weight model released so far, though it still trails U.S. frontier models by about four months.
Read Next: French Crypto Holders Could Owe Up To 10,000 Euros For Unreported Wallets
