Anthropic Reports 90–99% Reduction in Reasoning Extraction Amid Distillation Threats

Anthropic says new defenses against unauthorized distillation of Claude have reduced reasoning data extracted through its own platform by approximately 90–99%. Attackers use fraudulent accounts, proxy networks, and extraction prompts to harvest reasoning transcripts for training competing models. The defenses restrict reasoning transfers between conversations, models, and organizations; detect and block extraction attempts; and apply account restrictions and charges for blocked requests. Anthropic identified Zhipu and Moonshot as participants in distillation activity and warned that distilled capabilities could lack safeguards or support foreign military applications. The company acknowledged integration changes, occasional false positives, and uncertainty about effectiveness against persistent, sophisticated attackers.

Separate research, Stealing Reasoning Traces from Proprietary LLM APIs, reports that encrypted reasoning blocks could be transferred across sessions, users, and models within a provider’s ecosystem, allowing weaker, less safeguarded models to reveal another model’s reasoning verbatim. Researchers demonstrated anti-distillation bypasses involving Anthropic, OpenAI, and Google, and reported recovering 367 personally identifiable information artifacts and 182 credentials from 315,320 reasoning blocks scraped from public repositories. They also described hazardous-information disclosure despite safe final responses and prompt-injection payloads concealed inside encrypted blocks. Following responsible disclosure, the researchers proposed cryptographic and system-level mitigations, but the abstract did not identify deployed fixes. Anthropic’s reported gains do not establish that every research finding has been resolved; organizations should treat reasoning blocks as sensitive data and validate provider isolation controls before transferring or retaining them.