---
type: "post"
id: "over-the-last-few-months-we-ve-made-218d38"
slug: "over-the-last-few-months-we-ve-made-218d38"
title: "Over the last few months, we’ve made significant progress in reducing the effectiveness of distillation attacks against Claude."
description: "Anthropic’s post describes a shift from simple defenses against passive copying to layered controls against organized extraction."
retrieval_nugget: "Anthropic’s post describes a shift from simple defenses against passive copying to layered controls against organized extraction."
published_at: "2026-10-13"
updated_at: "2026-10-13"
record_date: "2026-10-13"
date_kind: "published_at"
topics: ["anthropic","claude"]
source_urls: ["https://www.anthropic.com/research/distillation-defenses"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:over-the-last-few-months-we-ve-made-218d38"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:4b6f64eef3e89b5dfdc19e0f99c1266920d2fe05c9d9d581a70293be06f1d74b","reviewed_at":"2026-10-13T02:02:47.747Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":2,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"In model distillation defense, controlling access to reasoning traces and the account pathways around them is becoming as important as filtering individual prompts.","observed_facts":[{"text":"Anthropic says early evidence suggests its new methods reduced data harvested by distillers by around 90–99%.","source_urls":["https://www.anthropic.com/research/distillation-defenses"]},{"text":"Anthropic reports that a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, compared with 71.8% using summarized transcripts.","source_urls":["https://www.anthropic.com/research/distillation-defenses"]},{"text":"The post describes preserved thinking and restrictions on reasoning access across models and organizations.","source_urls":["https://www.anthropic.com/research/distillation-defenses"]}],"mechanism":"Anthropic describes controls on moving protected reasoning across conversations, models, and accounts; detection of attempts to extract hidden reasoning; and measures targeting proxy networks of fraudulent accounts.","why_now":"Anthropic says attackers adapted after transcript summarization, using varied extraction prompts and large networks of fraudulent accounts.","implications":["Defenses can operate across transcript handling, account identity, and cross-model access rather than relying only on prompt-level safeguards.","The controls carry operational costs: Anthropic says it turned away paid traffic and some legitimate users had to update integrations."],"evidence_boundary":"The 90–99% reduction and attack account are Anthropic’s claims; the post does not provide independent validation of that estimate.","watch_conditions":["Whether other model providers disclose comparable controls and independently evaluated reductions in extraction.","Whether integration changes create measurable friction for legitimate API users."],"related_records":[],"new_branch_reason":"No prior New Runtime record on this specific defense change was supplied, so this begins a distinct analytical record without inferring a related record."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/over-the-last-few-months-we-ve-made-218d38/","markdown":"https://newruntime.com/posts/over-the-last-few-months-we-ve-made-218d38.md","json":"https://newruntime.com/posts/over-the-last-few-months-we-ve-made-218d38.json"}
---

# Over the last few months, we’ve made significant progress in reducing the effectiveness of distillation attacks against Claude.

## Retrieval answer

Anthropic’s post describes a shift from simple defenses against passive copying to layered controls against organized extraction.

Anthropic’s post describes a shift from simple defenses against passive copying to layered controls against organized extraction.

Thesis: In model distillation defense, controlling access to reasoning traces and the account pathways around them is becoming as important as filtering individual prompts. Anthropic says early evidence suggests new methods reduced data harvested by distillers by around 90–99%; that is Anthropic’s estimate, not an independent measurement.

Mechanism: Anthropic describes controls on moving protected reasoning across conversations, models, and accounts; detection of attempts to extract hidden reasoning; and measures targeting proxy networks of fraudulent accounts. The company says preserved thinking prevents newer API accounts from editing prior context for certain models, and controls limit reasoning access across models and organizations. Its earlier benchmark example found a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, versus 71.8% with summarized transcripts. These are distinct reported measures: one illustrates transcript utility, the other estimates harvested-data reduction.

Why now: Anthropic says attackers adapted after transcript summarization, using varied extraction prompts and large networks of fraudulent accounts. It reports that this response required turning away paid traffic and asking some legitimate customers to update integrations.

First implication: Defenses can operate across transcript handling, account identity, and cross-model access rather than relying only on prompt-level safeguards. The controls carry operational costs: Anthropic says it turned away paid traffic and some legitimate users had to update integrations.

Evidence boundary: The 90–99% reduction and attack account are Anthropic’s claims; the post does not provide independent validation of that estimate.

What to watch: Whether other model providers disclose comparable controls and independently evaluated reductions in extraction. Also watch whether integration changes create measurable friction for legitimate API users. Anthropic’s account makes the trade-off explicit, but it does not quantify that user impact.

New branch reason: No prior New Runtime record on this specific defense change was supplied, so this begins a distinct analytical record without inferring a related record.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- topic hub: [Claude](https://newruntime.com/topics/claude.md): Explore the claude topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)