Anthropic says layered safeguards reduced reasoning data harvested from Claude by 10 to 100 times, while acknowledging trade-offs and possible bypasses.
In a research post dated October 12, Anthropic described new measures intended to make it harder to extract Claude’s reasoning for training other models. The company says early evidence indicates the defenses reduced the data collected by distillers by about 90% to 99%. Anthropic also reports that reasoning tokens extracted on its platform fell by 10 to 100 times or more after the protections were implemented.
The defenses combine controls on where model reasoning can be transferred, a two-stage classifier to flag extraction attempts, and stricter limits and account bans for repeated abuse. Anthropic says “preserved thinking” prevents API accounts created on or after August 31, 2026, from editing Claude’s prior context. It also says some models’ reasoning can no longer be read by earlier models with weaker protections, while Claude Sonnet 5.5 transcripts are restricted to the organization that generated them.
The company reports that the classifier has a false-positive rate below 0.1% and is operating on its generally available Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1 models. Anthropic says it has banned tens of thousands of accounts associated with distillation, sometimes within two hours of a campaign starting. These figures and effectiveness estimates are Anthropic’s own assessments, based on activity it observed on its platform.
The changes have costs for legitimate users. Anthropic says some developers had to update integrations, benign requests can still be incorrectly blocked, and it has resumed charging for certain requests rejected by safeguards. It also warns that the protections may be circumvented and frames the effort as an ongoing contest with attackers; the company says it has not yet observed a highly sophisticated, persistent attempt to bypass the new measures.
Distillation is also used legitimately to create smaller models, but Anthropic’s announcement focuses on unauthorized extraction of its models’ capabilities. The measures show how a provider is trying to protect model reasoning while balancing abuse prevention against access and compatibility for customers.