Anthropic’s Distillation Defences: Protect the Model API

What Anthropic changed

Illicit distillation uses high-volume model outputs to train another model without the original developer’s authorisation. Anthropic says attackers have used large networks of fraudulent accounts and active prompts designed to reveal protected reasoning. Its new approach limits where reasoning can move, blocks extraction attempts with a two-stage classifier, applies stricter usage limits and bans accounts linked to persistent campaigns. [1]

For new API accounts created on or after 31 August 2026, Anthropic’s preserved-thinking control prevents editing of prior context on specified frontier models. Claude Sonnet 5.5 reasoning transcripts are also limited to the organisation that requested them. The classifier runs on Anthropic’s most capable generally available models, and the company reports a false-positive rate below 0.1 per cent. [1]

Treat the results as evidence, not certainty

This is a material update from September’s public warnings about distillation: Anthropic is now describing concrete provider-side controls and measured outcomes rather than allegations about model origin. Anthropic reports that extracted reasoning tokens fell by a factor of 10 to 100 after the classifier was introduced, and that tens of thousands of associated accounts were banned, often within two hours of a campaign beginning. Reuters independently reported the announcement and the company’s figures, but these remain provider-reported measurements from Anthropic’s own platform. [1][2]

Anthropic also says it has not yet observed a highly sophisticated, persistent attempt against the full system and expects attackers to adapt. Legitimate developers may need to update integrations, benign requests can be blocked and some blocked requests are now charged. A strong control therefore needs monitoring, appeal and customer-support paths as well as aggressive detection. [1]

Use a four-control model API defence

Organisations exposing proprietary models or high-value AI services should build four connected controls. NIST frames model extraction as an adversarial machine-learning risk, while OWASP recommends controls such as rate limiting, logging, anomaly detection and access restriction for unbounded consumption and model theft. [3][4]

• Identity: bind accounts, keys, payment methods and organisations to verified tenants. Detect linked identities and proxy infrastructure without treating geography alone as proof of abuse.
• Exposure: return only the information required for the product. Protect hidden reasoning, system instructions, logits, traces and cross-tenant context, and test whether features can be combined to reveal them.
• Pattern: baseline normal query volume, semantic diversity, retry behaviour and account relationships. Correlate signals across sessions so a distributed campaign does not appear as thousands of harmless users.
• Response: use staged friction, tighter quotas, step-up verification, blocking and offboarding. Preserve evidence, provide a review route for legitimate customers and measure how quickly new extraction methods are patched.

What leaders should do now

Name the model assets worth protecting and map every channel that can expose them, including direct APIs, partner clouds, resellers and internal tools. Run controlled extraction tests across accounts, regions and model versions. Track suspected data exposure, detection latency, false positives, support impact and revenue accepted from abusive traffic.

Do not copy Anthropic’s thresholds blindly. Calibrate controls to your service, contracts and customers, then rehearse an incident where a sophisticated actor distributes requests across providers. ELYMENT AI helps teams turn AI security signals into governed workflows with clear owners, evidence and escalation paths.

Sources

• Anthropic: Strengthening our defenses against distillation attacks (2026-10-12) - First-party description of Anthropic’s preserved-thinking controls, classifier, account actions, measured results and limitations.
• Reuters: Anthropic says new safeguards sharply reduce AI distillation attacks (2026-10-13) - Independent reporting on Anthropic’s announcement, reported reduction and account enforcement.
• NIST AI 100-2 E2025: Adversarial Machine Learning (2025-03-01) - Authoritative taxonomy covering adversarial machine-learning attacks and mitigations, including model extraction.
• OWASP LLM10: Unbounded Consumption (2025-01-01) - Security guidance covering model extraction, rate limiting, logging, anomaly detection and access controls.

Continue learning

• Verify model provenance and supplier exposure
• Build behavioural controls across AI misuse signals
• Close the AI discovery gap before deployment

Frequently asked questions