Abandoning the multi-trillion-token business, Company A has banned tens of thousands of accounts in succession, slashing its distillation data volume by 99%.

Just now, Anthropic suddenly posted to "show off" their recent anti-distillation achievements.

On its own platform, the inference data that can be extracted via distillation has been reduced by about 90%—99%, with the remaining volume only 1/10—1/100 of the original scale.

Tens of thousands of related accounts have been deactivated. Some accounts were banned less than two hours after they started the distillation attempts.

To achieve this result, Anthropic has deployed three "powerful weapons" in total:

1. Inference results can still be used, but cannot be arbitrarily transferred

After the introduction of preserved thinking, once new API accounts modify the previous context, the original inference results can no longer be reused normally. Different models are respectively restricted from accessing less protected older models for follow-up reading and cross-organizational access. It is no longer that convenient to take a draft and continue to extract information in another place.

2. If you want to extract complete inference results, you have to pass the classifier first

Anthropic applied the protection idea of Constitutional Classifiers to anti-distillation: through a two-stage classification system, it identifies and blocks requests that attempt to extract Claude's complete inference results. The robustness of this solution is almost equivalent to the protection that prevents Claude from assisting in the manufacture of biological weapons.

3. Repeated extraction attempts will cost you both your account and budget

Repeated extraction attempts will be rate-limited, and associated accounts that keep trying will be banned. If you try to continue taking chances by switching accounts, you will also bear the loss of account bans. Requests for distillation that are blocked by the protection system before Claude generates a response will also be charged.

It can be said that in order to drive away this batch of "students", Anthropic has even rejected trillions of tokens of paid traffic.

Not even the scratch paper is allowed to be copied

For distillation, simply copying the final answers is far from enough.

What is more critical is to get Claude's chain of thought before it answers the question, to see how it breaks down the problem, how it tries to solve it, and how it finds that it has made a mistake.

When models are trained with complete inference results and summaries respectively, the SWE-bench Verified scores show a significant gap

Anthropic itself has conducted a controlled experiment, using the conversation records of Opus 4.8 to train a pre-trained Claude model.

In the SWE-bench Verified programming test, the model trained with complete inference results scored 80.4%, while the one trained only with summaries scored only 71.8%, a difference of 8.6 percentage points.

Therefore, Anthropic put away the complete drafts early, and only shows inference summaries to the outside world.

Claude continues to work on the problems carefully as usual, but people who want to copy its work can only get a redacted version.

To this end, attackers began to induce Claude to restate the hidden inference results.

According to official disclosures, some laboratories have tried 12,000 requests, each using a different deception method. As long as one effective writing pattern is found, it can be copied in batches.

Independent research demonstrates the path to extract the inference results of stronger models using weaker models, and the experiment predates this defense update

Anthropic previously recorded that a proxy network simultaneously managed more than 20,000 fraudulent accounts, with a larger account network behind it.

It looks like users are queuing up to ask questions, but in fact, training data is being produced in batches.

The large, well-protected models are tight-lipped, so attackers go after smaller, less protected models

However, hiding the drafts does not make things completely worry-free. When Claude works on long tasks, it has to read the previous content by itself.

In order to let it continue thinking from the previous round, the protected inference results will be saved and then returned to the model.

What users see is a string of encrypted content, but Claude that is responsible for continuing the generation must be able to understand it.

Strong models are tight-lipped, so attackers pass the inference results left by them to other less protected models from the same provider, and induce the latter to repeat them.

Different models have added restrictions on context, model compatibility and organizational access respectively

An independent study published in August demonstrated this type of path. The encryption algorithm was not cracked, but the secrets still leaked out, because the model that had read the content could be tricked into restating it.

Anthropic had to take control of "who is allowed to continue reading" as well.

Fable 5.1 and Opus 5.5 introduce preserved thinking, which validates the previous context for API accounts created on and after August 31.

If the previous context has been tampered with, the original protected inference results can no longer be reused normally, and weaker models naturally cannot access the results.

For Sonnet 5.5, the inference results are further bound to the organization, and can only be reused by the organization that originally initiated the request.

These checks block the relay extraction attempts at different stages. Hoarding a large number of accounts does not mean having a group of collaborators that can copy the work in relay.

Failed attempts to steal knowledge still incur charges

Moreover, repeatedly extracting inference results within the same account is becoming more and more expensive.

Anthropic uses a two-stage classifier to screen requests, and feeds real extraction records to internal and external red teams for repeated testing.

When attackers find a new writing pattern to bypass the detection, the defense team will add it to the next round of protection.

According to Anthropic's evaluation, the robustness of this system is roughly equivalent to the protection that prevents Claude from assisting in the manufacture of biological weapons, with a false positive rate of less than 0.1%.

No one expected that this level of defense would be deployed just to protect the problem-solving drafts!

Official estimates show that the number of inference tokens extracted on the self-owned platform continues to decrease after the new protection goes online. The figure uses a logarithmic scale, and the downward triangle indicates that the value is too low to be measured

Therefore, attackers began to modify the format of requests, asking Claude to output inference results in another language, or embedding the content in special tags, trying to bypass the checks.

The official has observed these tactics and closed the corresponding gaps.

Accounts that repeatedly extract inference results will have their usage quota restricted; associated accounts that keep trying will be banned. Having a set of deceptive prompts that can trick the model is not enough, the account and budget must also be able to withstand the costs.

Starting from September 24, for the categories with very low false positive rates including biology-related attacks, distillation attacks and cutting-edge large model development, charges are resumed for blocked requests.

Even if the request is rejected by the security system before Claude generates a response, the user still needs to pay for it.

However, once the system misidentifies a legitimate user, customers who are working normally may also receive this bill.

Anthropic admits that the classifier will still mistakenly block normal requests, and these requests may now also be charged.

What the platform sees is a blocking record, but the affected developers are faced with: The task is not completed, but the money is deducted.

Even if you are not mistakenly blocked, when developers adjust system prompts, clean up old tool results or modify the tool list, the original inference blocks may also become invalid.

In an official multi-round programming test, when the thinking intensity is set to the highest level and each session loses one inference block, the number of output tokens will increase by 20.1%.

The anti-theft measures have been strengthened, but for developers, even organizing conversation records requires extra care to avoid making the model restart the work from scratch...

Theoretically, Anthropic is still willing to let Claude work for you.

However, once you try to make it teach you how to build its own substitute, this token-charging "teacher" is already ready with account ban notifications and bills.

Reference Materials:

https://www.anthropic.com/research/distillation-defenses

https://x.com/anthropicai/status/2109795898909950247

https://x.com/ClaudeDevs/status/2103170368794185758

This article is from the WeChat official account "Xinzhiyuan", Author: Moses, published with authorization from 36Kr.