Anthropic estimates that people trying to train smaller AI models from Claude's outputs extracted 90% to 99% fewer tokens from its hidden reasoning through its platform after it introduced a classifier to detect their requests. The comparison is with the company's estimate before the classifier.
In model distillation, a smaller model learns from a stronger model’s answers. Anthropic’s October 12 post focuses on unauthorized campaigns that collect Claude responses at scale, especially reasoning traces that show how the model arrived at an answer. The company says those traces give a distiller more useful training data than final answers alone.
The first control limits where a reasoning trace can be reused. Anthropic says preserved thinking on Claude Fable 5.1 and Opus 5.5 checks the model and the earlier conversation context, so a trace cannot simply be moved into a changed prompt or a model with weaker safeguards. The API documentation says the checked context includes the system prompt, tools and earlier messages. Some Sonnet 5.5 and Haiku 5.5 traces are also tied to the organization that created them. These checks can require developers to adjust integrations that rewrite conversation history.
A two-stage classifier looks for requests that try to expose hidden reasoning. Anthropic says internal and external red teams tested it, and reports a false-positive rate below 0.1%, meaning fewer than 0.1% of benign requests are incorrectly flagged. The company also applies stricter usage limits and bans accounts linked to persistent extraction attempts. Since September 24, it has charged for blocked requests in specific categories, including distillation.
Anthropic estimates how many reasoning tokens distillers extracted through its own platform. After the classifier was introduced, it says that count was consistently 10 to 100 times lower than before; once all safeguards were in place, some days’ totals were too small to measure. A 10-to-100-fold reduction corresponds to 90% to 99% less than the earlier baseline. This is the company’s internal platform measure, not an independent test or an estimate of extraction through other providers.
An August preprint described one attack method: moving encrypted reasoning blocks across sessions, users or models to get a model with weaker safeguards to reveal the text. That paper predates Anthropic’s new controls and does not test whether they resist adaptive attackers. Anthropic says it has not yet seen a highly sophisticated, persistent attempt to bypass the current safeguards. It expects the defenses to need continued updates, and acknowledges that they can block some benign requests and impose integration and billing costs.
Sources
- Anthropic’s October 12 defense report.
- “Stealing Reasoning Traces from Proprietary LLM APIs,” an arXiv preprint submitted August 10, 2026.
- Anthropic API documentation for preserved thinking.
- Illustrative photo, not Anthropic infrastructure: Derrick Coetzee’s NERSC server racks, CC0 1.0 via Wikimedia Commons.