Technology & Research · 2026-10-13 · Team LATENT

Anthropic’s distillation defenses and the limits on reusing model reasoning

Anthropic combines restrictions on reasoning reuse, classifiers, and account controls. We examine what the reported 90–99% reduction measures, the full-trace versus summary experiment, and the implications for legitimate agent developers.

A developer can ask a capable AI to solve many problems, then use its responses to train another AI. This form of training is called distillation. The second model can learn some capabilities from outputs without obtaining the original model’s weights.

On October 12, 2026, Anthropic reported defenses against unauthorized collection of Claude’s reasoning at scale. A central design choice limits which conversations, models, and organizations can reuse that reasoning. The restrictions also require some legitimate agent developers to change how they manage conversation history.

Key takeaways

The defenses primarily target collection of full reasoning traces for training another model. Anthropic combines restrictions on reasoning reuse, extraction classifiers, usage limits, and account bans.
The reported 90–99% reduction concerns estimated reasoning tokens extracted on Anthropic’s own platform. In a separate training experiment, full traces and summarized traces produced SWE-bench Verified scores of 80.4% and 71.8%.
Long-term effectiveness and effects on collection through other providers remain unresolved. Developers reusing earlier thinking on affected models face constraints on history editing. Dropping reasoning can increase output tokens and latency.

What passes from teacher to student

Conceptual flow: learning from outputs without transferring the teacher’s weights

1 Teacher model

A user sends a problem → Claude reasons and generates a response.

2 Collected outputs

Problem + answer, plus full reasoning if obtainable → a training dataset. The defenses focus particularly on full-trace collection.

3 Student model

Training on the collected data → learning to solve tasks more like the teacher. The teacher’s monitoring and account controls do not automatically transfer.

Figure 1. Output collection and student training are separate stages. The 90–99% figure concerns Anthropic’s estimate of reasoning tokens in the collection stage.

How outputs become training data

Distillation uses a teacher model’s behavior as a training signal. Hinton and colleagues’ 2015 paper explored transferring knowledge from an ensemble into a single, easier-to-deploy model. Classical distillation can use predicted probabilities. This report mainly concerns learning from answers and reasoning text obtained through an API.

For a coding task, the finished patch alone can serve as training data. A trace that also records investigation, attempted approaches, and steps toward the fix adds detail. Here, reasoning means text the model generates before answering. It should not be treated as a complete account of every internal computation.

Distillation is also a method for making models smaller and easier to use. Anthropic’s concern here is large-scale collection to copy capabilities without the provider’s authorization. It reports activity using fraudulent accounts and argues that transferred capabilities may lack comparable safeguards. That usage does not make all distillation inherently illicit.

Original knowledge-distillation paper

Anthropic’s October 12 report

Why summaries left extraction routes open

Returning a summary reduces the information available to someone collecting ordinary responses. But reasoning retained to continue a conversation and the summary shown to a user are different data. Hiding the full text does not by itself remove the mechanism for reusing reasoning on a later request.

The linked August paper, “Stealing Reasoning Traces from Proprietary LLM APIs,” studied that reuse. Researchers exploited compatibility that allowed encrypted reasoning blocks to pass into other conversations or less protected models. They did not recover encryption keys; they induced a provider-side model able to read the reasoning to emit it as text.

The tests cover APIs available in early July 2026. The authors report that the same attacks stopped working after responsible disclosure. They also could not fully verify every extracted token against unavailable plaintext originals. The paper is therefore not evidence that the same attacks work against current APIs.

Reasoning-extraction paper, especially Sections 2, 5.1, and 5.2

What the three defenses restrict

The first defense restricts where reasoning can be reused. Preserved thinking checks the signature of a returned thinking block. Checks cover model compatibility and the conversation context in which it was generated; some models also restrict reuse to the originating account or linked accounts. Reading a visible answer and reusing protected reasoning are distinct operations.

Three conditions for reusing reasoning

Conceptual diagram. Exact applicability and behavior depend on the model and API.

Conversation condition

Preserve the original system prompt, tools, and preceding messages. Editing the prefix can invalidate later thinking blocks.

Model condition

Switching models does not guarantee access to every earlier trace. The API drops blocks that the receiving model cannot read.

Organization condition

Reasoning from models such as Sonnet 5.5 is reusable by the originating or linked accounts. Blocks sent by other accounts are dropped.

Figure 2. The restrictions govern reuse of protected reasoning; they do not prohibit every ordinary transfer of visible answers between models.

For supported models, prefix checking is enabled by default for new API accounts. The documentation specifies accounts created on or after August 31, 2026, at 00:00 UTC. Editing earlier instructions while retaining their reasoning differs from appending new instructions at the end.

Official preserved-thinking documentation

The second defense combines extraction detection with ongoing fixes. Anthropic says it uses a two-stage classifier and internal and external red-teaming, in which testers attempt to bypass the protection. It reports updates against observed methods such as translation and reproducing reasoning inside tags.

The background work, Constitutional Classifiers++, screens traffic cheaply and sends suspicious exchanges to a more expensive check. Evaluating the prompt together with the response provides context for otherwise ambiguous outputs. The January paper studies harmful-response jailbreaks. It does not establish that the October defense uses an identical implementation in every detail.

The third defense increases the burden of repeated attempts. Anthropic applies usage restrictions and bans to persistent extraction activity. It also reports resuming charges on September 24 for requests blocked before a response in selected areas, including distillation, where it reports false positives below 0.1%.

The October 12 report lists Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1 as using the two-stage classifier. Coverage for similarly attractive future models is a plan. The report does not establish identical deployment across every older model or external serving route.

The two-stage design in Constitutional Classifiers++

Reported defenses and deployment scope

Three measurements with different meanings

Extraction volume, student scores, and false positives

Three Anthropic-reported measurements with different targets and comparisons

Reasoning extraction

90–99% lower. A before-and-after comparison of estimated reasoning tokens obtained by distillers on Anthropic’s platform.

Student score by training data

80.4% → 71.8%. SWE-bench Verified results after training on Opus 4.8 transcripts with full versus summarized reasoning.

False positives for benign use

Below 0.1%. Anthropic’s reported rate of benign requests mistakenly identified or blocked by the safeguards.

Figure 3. These are not interchangeable defense-success rates. The student-score gap is 8.6 percentage points, from an experiment separate from the 90–99% estimate.

Anthropic reports estimated extraction falling to roughly one-tenth to one-hundredth of its earlier level after the classifier was introduced. The observation covers its own platform, not total collection through other clouds or models. Days with too little extraction to measure do not establish that extraction was exactly zero.

In the training comparison, a pretrained Claude model was trained on Opus 4.8 transcripts. Full reasoning yielded 80.4%, versus 71.8% with summarized reasoning. SWE-bench Verified evaluates software issue resolution, but the report does not provide enough detail to reconstruct training-data volume, training compute, or variation across runs. The same gap cannot be assumed for all distillation.

The sub-0.1% false-positive rate describes impact on benign requests, not the proportion of attacks missed. The public report does not disclose the estimation procedure or evaluation samples in enough detail for an independent recalculation. The figures should remain attributed to Anthropic and limited to their stated scope.

The January paper’s 40-fold compute reduction and 0.05% flag rate are separate evaluations. The reduction is relative to an exchange classifier that checks conversations in one stage. Attack robustness was evaluated on chemical, biological, radiological, and nuclear (CBRN) weapons-related tasks. The 0.05% figure instead measures flags across production traffic in shadow deployment, without actually blocking it. Neither measures the cost or false-positive rate of the full distillation defense.

Original extraction and SWE-bench Verified comparisons

Evaluation conditions in Section 6 of the background paper

Changes for legitimate agent developers

Consider an agent that rewrites its system prompt on every turn to insert a timestamp or current task state. Retaining thinking blocks while changing their original prefix can fail the context check. The documentation recommends preserving returned history and appending new information. Supported mid-conversation instruction and tool-change features provide additional options.

For applicable prefix mismatches, the Messages API can return a 400 error by default. The supported drop_block setting can discard affected reasoning and continue. Model or organization mismatches and damaged signatures have different handling, and Batch API defaults also differ. Treating every failure as the same retry case is therefore unsuitable.

Dropping reasoning can force the model to reconstruct earlier work. In Anthropic’s multi-turn coding evaluation at max effort, dropping blocks once per session increased output tokens by 20.1%. Dropping them on every turn after the first increased output tokens by 67.1%. These are harness-specific examples, not a measure of every customer’s price increase from the defenses.

Relevant integration checks include history serialization, model switching, and tool-definition changes. A serializer may also discard an empty thinking block that still contains a signature. Changes should be evaluated on the developer’s own tasks using completion rate, output tokens, and latency. We have not performed those API experiments here.

History preservation, error handling, and output-token comparisons

Limits, adaptation, and long-term effectiveness

Anthropic reports banning tens of thousands of associated accounts, often within two hours of a campaign starting. It also says the durability of the gains is unknown and it has not yet seen a highly sophisticated, persistent attempt to bypass the new system. Catching the methods reported in September does not establish robustness against unknown attacks.

Collectors may shift to older models or other providers. In the GLM-5.3 example cited in the report, Anthropic says collection moved from Claude Fable 5 to an older Claude model and another provider after encountering cyber safeguards. That account is Anthropic’s attribution. Lower extraction on one platform does not show that capability transfer has stopped across the industry.

Reducing capability imitation and reducing dangerous behavior also require separate evaluations. Extraction volume and coding scores do not quantify reductions in biological or cyber harm. Providers have safety concerns and commercial interests; users care about API stability and visibility into reasoning. The reported metrics do not by themselves settle those trade-offs.

The report describes making full-trace collection harder through API rules, ongoing detection, and account controls. Extending protection to future attractive models and coordinating across providers remain forward-looking efforts. Durability, displacement to other routes, and costs to legitimate users are the evidence needed to distinguish deployed results from future expectations.

LATENT’s article on GLM-5.3 and changing cyber risks examines capability diffusion and safeguards in open-weight models. Its assessments of attack capability measure something different from the training-data collection volume discussed here.

September threat-intelligence report

Primary sources and verification scope

Public sources were checked on October 13, 2026. Numerical results are reports from the provider or paper authors, not measurements from model training or attacks performed by LATENT. The diagrams are editorial illustrations of the relationships.