Anthropic Says New Defenses Cut Model Distillation Data by Up to 99 Percent

On October 12, 2026, Anthropic published a research post describing new defenses against “distillation attacks.” These are campaigns that query Claude en masse to train competing models on its responses. The company says the new measures cut the volume of data harvested by distillers by roughly 90 to 99 percent. That means extractable data drops to one-tenth or one-hundredth of previous levels. The company also says the new safeguards catch all of the distillation techniques described in its own September report on the problem.

What the new defenses do

Anthropic describes three new technical defenses. The first is controls on inference output channels. That limits how much data a single request or session can return, making bulk harvesting slower and less efficient. The second and third defenses form a two-stage classifier system. The first stage filters obvious distillation patterns. The second stage catches more subtle attempts that mimic normal usage. Together, the classifiers flag requests that look like they are trying to extract training data. Anthropic reports that the system’s false-positive rate is below 0.1 percent for certain blocked categories, including distillation. That means very few legitimate users get caught in the net.

The cost of enforcement

The company says it has been deliberately turning away paying traffic to enforce these rules. Per the company’s report, that means “meaningful revenue and trillions of tokens worth of paying traffic” are being refused. This is a notable business decision. Distillers are often high-volume API customers. By blocking them, Anthropic is giving up short-term revenue to protect its model’s long-term value. The company also resumed charging for blocked requests in certain categories. That includes distillation. When the classifiers flag a request as a distillation attempt, the request is still processed, but the customer is billed. This changes the economics of stealing data — it no longer costs nothing to try.

Why distillation matters

Distillation attacks are not just a nuisance. Anthropic describes them as a serious risk vector for biosecurity, cybersecurity, and national security. The logic is simple: if a rival can copy a frontier model’s capabilities cheaply, they can use those capabilities for harmful purposes without paying the development cost. For example, a model that can help with biological research could be distilled and repurposed for bioweapon design. A model with strong cyber defense knowledge could be turned into an attack tool. The cheaper and easier distillation becomes, the more accessible these dangerous capabilities become. Anthropic’s September report on distillation laid out the problem in detail. It described specific techniques that attackers use to extract responses from Claude. The new defenses reportedly catch all of those techniques.

What this means for users

For legitimate API customers, the impact should be minimal. The false-positive rate below 0.1 percent suggests that normal usage patterns will rarely be blocked. If you are running a standard application or research project, you should not see a change in service. For those attempting to train competing models on Claude’s outputs, the calculus has changed. You now get far less data per query, and you pay for blocked attempts. The cost of distillation has gone up substantially. The company did not release specific numbers on how much revenue it is turning away. It also did not provide details on the classifier architecture beyond the two-stage description. Those details remain internal.

Coverage and context

The announcement was covered on October 13-14 by outlets including The Economic Times, Pulse2, and technology.org. The coverage has been factual, describing the technical changes and the revenue trade-off. This is not the first time Anthropic has addressed model copying. The September report was a detailed analysis of the problem. The October post is the response — a set of working defenses that the company says are already deployed.

The bigger picture

Distillation is a known problem across the AI industry. Many model providers have tried to limit bulk extraction, but most rely on rate limits and usage caps. Anthropic’s approach is more aggressive: it uses classification to identify intent, not just volume. That is a meaningful shift. It moves from passive limits to active detection. The two-stage classifier is designed to catch both obvious and subtle patterns. The low false-positive rate is key — if the system blocked too many legitimate users, it would be unusable. The revenue trade-off is also telling. Anthropic is willing to lose money to protect its model. That signals that the company sees distillation as an existential threat, not just a cost issue. If a competitor can clone Claude’s capabilities for a fraction of the development cost, Anthropic’s competitive advantage erodes quickly. The company’s claim of a 90 to 99 percent reduction in extractable data is significant. If accurate, it makes distillation from Claude much harder and much more expensive. It does not make it impossible — determined attackers will find new methods — but it raises the bar substantially.

What to watch next

The key question is whether these defenses hold up over time. Distillation techniques evolve. Attackers will study the new classifiers and try to find workarounds. Anthropic will need to update its defenses continuously. Another question is whether other model providers adopt similar approaches. If classification-based defense becomes standard, the entire industry gets harder to exploit. If it does not, Anthropic’s advantage may be temporary. For now, the facts are clear. Anthropic has deployed new defenses. They cut extractable data by 90 to 99 percent. They catch all known distillation techniques. And the company is paying a real cost in revenue to enforce them. That is a concrete, measurable response to a serious problem.