Anthropic, the company developing the Claude AI models, has described its defenses against so-called distillation attacks. These are attempts by third parties to copy the capabilities of its system and transfer them to their own solutions. According to the company, the new measures have reduced the amount of data attackers can obtain by roughly 90 to 99 percent. However, the company paid for this by losing substantial revenue, and some legitimate developers had to modify their applications.
How copying artificial intelligence works
Distillation, or copying, is a simple operation in principle. An attacker asks a powerful system millions of questions, collects its answers, and then uses them to train its own smaller model. In this way, the student copies from the teacher without having to learn everything from scratch. This allows competitors to acquire the most advanced capabilities for a fraction of the time and money that developing them independently would require. They usually use networks of fraudulent accounts to do so, leaving the original creator unaware of what is happening. Anthropic says that foreign laboratories use this method on a large scale to keep pace with their American competitors.
Anthropic objects to this practice for two reasons. Although the imitations can do almost as much as the original, their creators release them without adequate safety safeguards. Someone could then misuse them, for example, to produce dangerous substances or carry out cyberattacks.
As an example, the company cites the Chinese corporation Zhipu, also known as Z.ai. While developing its GLM-5.3 model, it copied the cyber capabilities of leading American systems. It first tried Claude Fable 5, but encountered its protections, so it switched to an older version and software from another laboratory. The US government’s center for artificial intelligence standards later described GLM-5.3 as the most capable freely available tool for cyberattacks. Anthropic found that its safeguards could be easily circumvented and that the system would readily produce complete code for attacking third-party infrastructure.
The second reason is national security. According to the report, foreign entities incorporate the capabilities they obtain into their military, intelligence, and surveillance systems. The company recently described a case in which queries intended for the Chinese Kimi technology from Moonshot were secretly forwarded to Claude. One of them came from a person whom Anthropic associates with the Chinese military and who wanted to analyze footage from security cameras tracking a specific individual.
Claude’s reasoning process is the most valuable part
Before Claude answers, it often first writes out its reasoning process. This is precisely what those copying the system are most interested in. From the final answer, their system learns what to say; from the reasoning, it learns how to reach the result. Anthropic’s defenses therefore focus on preventing outsiders from gaining access to this internal process.
The initial measures were simple. Claude began condensing its reasoning into a summary before displaying it. The company confirmed that this helped. A model trained on complete records scored more than 80 percent on a challenging programming test. A system that had access only to summaries finished just below 72 percent.
However, competitors quickly adapted and began persuading Claude to reveal its full reasoning itself. Sometimes a simple instruction to repeat it word for word was enough. One laboratory tested twelve thousand different queries, each of which attempted to trick the system in a different way.
Such attempts are relatively easy to recognize because ordinary users almost never ask the software for its hidden thoughts. Although attackers circumvented the first simple safeguards, they then scaled up the entire operation. They built networks controlling hundreds of thousands of fraudulent accounts created under false names and using stolen payment cards. A single such infrastructure managed more than 20 thousand profiles at once. At the same time, the same networks resold access to the Claude model in countries where it is not officially available.
Three levels of new defenses
Anthropic therefore redesigned its defenses. It now slows attacks in three different ways while, according to the company, imposing only minimal restrictions on ordinary users.
The first layer controls where the system’s reasoning process can go. Attackers transferred protected parts of conversations elsewhere to convince the software that they already had the complete version anyway and that it could safely show it. They also moved them to versions with weaker protections or to other profiles when the original one was blocked. With the newer Claude Fable 5.1 and Claude Opus 5.5 models, users with profiles created since August 31 can therefore no longer edit the previous conversation history. Older versions with weaker security cannot read the internal processes of these models either. With Claude Sonnet 5.5, reasoning records are accessible only to the entity whose query created them.
The second layer stops suspicious attempts outright. Anthropic wanted copying to be as difficult as getting the software to help with biological weapons. It therefore used a two-stage system of filters that identify dangerous queries. The company’s own specialists and external experts then attempted to break it using real attacks, and the developers fixed every weakness they found. The filters are now highly reliable and mistakenly block a harmless query in fewer than one case out of a thousand. The protection runs on the most capable publicly available versions, and the developers also intend to deploy it in future generations. Whenever a new trick appears, they quickly update the security measures. In this way, they have already prevented attempts to have the reasoning process translated into another language or displayed alongside the answer.
The third layer is intended to discourage attackers from making further attempts. Anyone who constantly tries to extract internal processes from the system is subjected to stricter limits. If the copying attempts persist, the company blocks access. Since September 24, Anthropic has also once again charged for queries that its protections stop before an answer is generated. However, this applies only in areas where the filters are almost never wrong, including plagiarism.
Copycats are left with only scraps
According to the company, the results are significant. The new filters catch all the tricks it described in its September report. The amount of data competitors can obtain from the software is now 10 to 100 times lower than before. On some days, it fell so low that it could not even be measured. Thanks to the new defenses, Anthropic blocked tens of thousands of profiles, often within two hours of the user beginning to copy the system.
However, the creators are not celebrating victory yet. They admit that they do not know how long their lead will last and expect this fight to be a game of cat and mouse. According to them, no truly sophisticated and persistent attempt to break the new security measures has yet occurred.
Protection also comes at a cost
Anthropic also writes openly about what the new defenses have cost it. It rejected an enormous volume of paid traffic because it came from plagiarists, thereby losing significant revenue. Its teams devoted a great deal of effort to the problem. In February, the company promised that legitimate users would not notice the changes, but this did not work out entirely as planned. Some developers had to rewrite their applications, the filters occasionally stop an innocent query, and users now have to pay for it.
Management nevertheless believes it is worthwhile. However, the company warns that it cannot solve the problem alone. If attackers can easily find similarly powerful models without comparable security, as happened in the case of Zhipu, its efforts will be in vain. Competitors distribute their traffic across Anthropic, other corporations’ cloud services, and other providers, so other market participants must help as well. They need only detect abuse quickly and block fraudulent profiles. Anthropic acknowledges that for many companies, it is more convenient to do nothing because defenses are costly and dishonest clients still pay. That is why it published its methods.
Copying is not a problem for Anthropic alone. As rivalry between the United States and China intensifies, OpenAI and Google have also complained about it. China’s Z.ai, which the report explicitly names, has not yet commented on the accusation.
Sources: anthropic.com and economictimes.indiatimes.com
