BuildAlso reported elsewhere2 publishers2 min readPublished
Anthropic says limits on Claude's reasoning access cut distillers' token extraction 10 to 100 times
Anthropic says new safeguards on access to Claude's reasoning have cut the reasoning tokens distillers extract by 10 to 100 times. It also puts its false positive rate below 0.1%. Both figures are the company's own, as reported by Economic Times.
The Engineer · Build desk
Key figures: Anthropic says its system's false positive rate is less than 0.1%, which, if it counts requests, means fewer than 1,000 legitimate requests flagged per million. Anthropic also says data harvested in distillation attacks fell by about 90% to 99%.
| Figure | Value | Note | Claim |
|---|---|---|---|
| False positive rate, less than, per Anthropic | 0.1% | 14 | |
| Legitimate requests flagged per million, fewer than | 1,000 requests | if the rate counts requests | 15 |
| Data harvested in distillation attacks, cut by about | 90% | up to 99%, per Anthropic | 1 |
What happened
- Anthropic said it made proxy networks harder to use for repeated probing of Claude's protected reasoning, blocking extraction attempts and hindering large-scale distillation.
- Anthropic banned tens of thousands of accounts linked to distillation campaigns.
- Anthropic cited Chinese startup Z.ai, also known as Zhipu, as a company that tried to distill Claude's capabilities while building GLM-5.3; Z.ai did not immediately respond to a request for comment.
- Runtimewire reported that Anthropic summarized the work in an October 12th post on X and a research post, describing layered defenses built after it reported large-scale extraction campaigns by rival labs.
Why it matters
- cost Runtimewire warns the stronger defenses may also shape how legitimate developers use the API, so any misfire lands on paying customers.
- precedent Runtimewire sees the contest moving from account bans toward controls on reasoning traces and outputs. In our view, other providers should expect to be asked whether they gate trace access the same way.
- decision Operators who send repeated requests through shared proxy networks now sit close to the pattern Anthropic says it blocks, so that routing is worth revisiting.
The two headline figures are one figure. A drop of 10 to 100 times is a drop of 90% to 99% [9], the range Economic Times gives for harvested data [1]. The span covers a full order of magnitude [2].
The baseline is Anthropic's own count of extraction before the change [2]. That count covers what Anthropic can observe. A fall in detected tokens equals a fall in extracted tokens only if detection coverage held steady and distillers did not move to traffic the system does not see. Runtimewire describes the exposure being defended: frontier-model APIs can serve as an indirect training pipeline for competitors [7].
Anthropic said the system has "a false positive rate of less than 0.1%" [14]. The reports do not say whether the rate counts requests, sessions or accounts. If it counts requests, the ceiling is 1,000 legitimate requests flagged per million [15].
Anthropic said the system is "roughly as robust as those that prevent Claude from helping build bioweapons" [13]. That is the company's own yardstick. It is also the strongest sign in either source that Anthropic treats reasoning traces as a protected asset.
Anthropic, OpenAI and Google all argue that distillation lets rivals reproduce advanced capabilities faster and at lower cost [4]. Of the three, only Anthropic is reported here as having restricted access to reasoning [2].
What to watch
- Whether Z.ai or Zhipu responds to Anthropic's naming of it in connection with GLM-5.3.
- Whether Anthropic's research post specifies what the under 0.1% false positive rate is counted over and how the 10 to 100 times figure was measured.
- Whether OpenAI or Google publish comparable results from restricting access to their models' reasoning.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+20
- Incentives70
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Anthropic said new measures designed to prevent rivals from copying Claude's capabilities have reduced data harvested in distillation attacks by about 90% to 99%.
ReportedSupportedSource: Anthropic, as reported by Economic Times2 sources— create a free account to open themView cited source - [2]
Anthropic said safeguards restricting access to Claude's reasoning have sharply reduced extraction attempts, with "the number of reasoning tokens extracted by distillers" now "10 to 100 times lower than it was before".
ReportedSupportedSource: Anthropic, as reported by Economic Times2 sources— create a free account to open themView cited source - [3]
Anthropic said it had made it harder to use proxy networks to repeatedly probe Claude's protected reasoning, blocking extraction attempts and hindering large-scale distillation efforts.
- [4]
Model distillation has become a key concern for leading AI companies amid US-China competition, with Anthropic, OpenAI and Google arguing the practice lets rivals reproduce advanced capabilities more quickly and at lower cost.
- [5]
Anthropic summarized its work in an October 12th post on X and a research post on its defenses, describing a layered set of defenses after reporting large-scale extraction campaigns involving rival AI labs.
- [6]
Anthropic's response shows the fight moving beyond account bans toward controls on reasoning traces and model outputs.
- [7]
Frontier-model APIs can serve as an indirect training pipeline for competitors.
- [8]
Stronger defenses carry a risk of also shaping how legitimate developers can use the API.
- [9]
A reduction to one tenth is a 90% drop and a reduction to one hundredth is a 99% drop, so 10 to 100 times lower equals 90% to 99% lower.
- [10]
Anthropic banned tens of thousands of accounts linked to distillation campaigns.
- [11]
Anthropic cited Chinese AI startup Z.ai, also known as Zhipu, as an example of a company that attempted to distill capabilities from Claude while developing its GLM-5.3 model, and warned such practices pose safety and national security risks.
- [12]
Z.ai did not immediately respond to a request for comment.
- [13]
Anthropic said its safety system is "roughly as robust as those that prevent Claude from helping build bioweapons".
- [14]
Anthropic said the system has "a false positive rate of less than 0.1%".
- [15]
If the false positive rate counts requests, a rate below 0.1% means fewer than 1,000 legitimate requests flagged per million.
Sources
2 independent publishers whose own reporting we read for this story.
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.