Markdown edition

# Anthropic says new Claude defenses cut extracted reasoning by 90–99%

> Anthropic reports 90–99% less Claude reasoning extracted by suspected distillers on its platform. The defenses also change API integration and blocked-request billing.

By BIG CHANGE Editorial

Published: 2026-10-13T08:42:18.603Z
Updated: 2026-10-13T08:42:18.603Z
Canonical: https://bigchange.ai/blog/anthropic-claude-distillation-defenses-reasoning

![Conceptual charcoal illustration of an unbranded desktop monitor seen from the side with a dark privacy filter attached over its blank screen.](https://bigchange.ai/api/media/file/anthropic-preserved-reasoning-hero-v1.png)
AI-generated conceptual illustration by BIG CHANGE. No Anthropic device, software interface, attack or test result is depicted.

Anthropic says changes to Claude have sharply reduced the amount of its protected reasoning that suspected model distillers can extract. In an [October 12 account of its defenses](https://www.anthropic.com/research/distillation-defenses), the company estimates that reasoning tokens obtained by distillers on its own platform fell by a factor of 10 to 100 after it introduced a new classifier. The measurement comes from Anthropic's own traffic and attack identification; the company has not published an independent evaluation of the overall reduction.

## The big change

- **What changed:** Anthropic now combines controls on where a Claude reasoning block can be reused, a classifier that blocks attempts to expose hidden reasoning, and limits on accounts that keep trying. Its internal estimate shows much less reasoning reaching identified distillers through its platform.
- **Why it matters:** Full reasoning transcripts can be useful training material for copying a model's behavior. Restricting that source raises the work required for unauthorized extraction, while API developers must keep some conversation histories intact and may pay for certain blocked requests.
- **What to watch:** The durability of the reduction depends on attackers' next methods and on traffic beyond Anthropic's direct platform. Anthropic says it has not yet seen a highly sophisticated, persistent attempt against the new defenses and expects to keep changing them.

## Three controls target different extraction routes

Model distillation can train a smaller system on answers from a more capable one. Anthropic's concern here is unauthorized collection of Claude's full, hidden reasoning, which it says is more useful to a would-be copier than answer text alone. Anthropic previously summarized reasoning before showing it to users. In one company-run coding test, a model trained on full Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified, against 71.8% when trained on summarized transcripts. That experiment supports the value of the fuller traces in that setup; it does not measure how much a particular outside model improved.

The first new control constrains the movement of reasoning blocks. Anthropic says attackers tried moving blocks between conversations, models, and accounts to get Claude to reveal protected text. With Claude Fable 5.1 and Opus 5.5, “preserved thinking” ties a block to the preceding conversation context for new API accounts. Anthropic also restricts which models can read blocks from other models and ties Sonnet 5.5 reasoning to the organization that produced it.

The [current Claude API documentation](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking) makes the integration consequence concrete: an API request that returns an earlier thinking block must preserve the relevant system prompt, tools, and preceding messages. For accounts created on or after August 31, 2026, the prefix check is enforced by default. Applications that rewrite earlier context or rebuild a saved conversation may have to change how they replay it. The documentation says ordinary append-only histories need no change.

Anthropic's second control is a two-stage classifier trained and tested against attempts to extract hidden reasoning. It says the classifier runs on its most capable generally available models, including Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. The company reports a false-positive rate below 0.1% for these safeguards. It says it has patched techniques such as requesting earlier reasoning in another language or in output tags. The post does not provide an independent test of that rate or establish that every future extraction method is blocked.

The third control works at the account level. Anthropic says repeated extraction attempts can trigger tighter usage limits or bans. Since September 24, it has also resumed charging for requests blocked before Claude responds in specified low-false-positive categories, including distillation. Legitimate users can therefore encounter both a mistaken block and a charge; Anthropic acknowledges that preserved thinking has also required some developers to update integrations.

## What the reported reduction measures

Anthropic estimates the number of Claude reasoning tokens extracted by distillers **on its own platform**. After the classifier was introduced, it says that count was consistently 10 to 100 times lower than before, and that the classifier catches the techniques described in its September report on its strongest generally available models. The estimate depends on Anthropic's ability to identify distillation traffic and cannot by itself measure extraction through other providers or an attack method it has not recognized.

The company says it has banned tens of thousands of accounts associated with distillation, often within two hours of a campaign starting. It also says distillers route traffic through third-party cloud platforms and other inference providers. Those claims make the platform boundary material: a drop in extracted tokens observed by Anthropic is evidence of a change in the traffic it can measure, not a count of all unauthorized training data collected from Claude everywhere.

Anthropic says it has not yet observed a highly sophisticated and persistent effort to work around the current defenses. That caveat matters more than a permanent-sounding success claim. The company has documented a substantial internal reduction and an operational approach to defending model reasoning; continued results will depend on how attackers adapt and whether other access routes detect the same behavior.

## Sources & further reading

- [Anthropic, “Strengthening our defenses against distillation attacks”](https://www.anthropic.com/research/distillation-defenses), October 12, 2026. The primary company account describes the controls, internal extraction estimate, false-positive claim, and user tradeoffs. Its platform measurement has not been independently replicated for this article.
- [Claude Platform, “Preserved thinking”](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking), accessed October 13, 2026. Current API documentation specifies block and prefix rules, affected account dates, and the integration patterns that may require changes. We reviewed the documentation; BIG CHANGE did not run API requests.
- [Anthropic, September 2026 threat intelligence report](https://www.anthropic.com/threat-intelligence-report-september-2026), September 2026. The earlier company report provides background on the extraction methods Anthropic says it was responding to; it is the company's own account of those campaigns.

## Sources

- [Anthropic, Strengthening our defenses against distillation attacks](https://www.anthropic.com/research/distillation-defenses) — Primary company account of controls, internal measurements and acknowledged tradeoffs; estimates are attributed, not independently verified.
- [Claude Platform, Preserved thinking](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking) — Current first-party API documentation for block binding, prefix checks and integration changes; no BIG CHANGE API request was performed.
- [Anthropic, September 2026 threat intelligence report](https://www.anthropic.com/threat-intelligence-report-september-2026) — Earlier first-party account of methods; background, not independent corroboration of October results.