Anthropic Says New Defenses Cut Claude Distillation Data by 90 to 99 Percent, Names Alibaba's Qwen in Largest Campaign

Anthropic says it is winning, at least for now, the fight over Chinese-linked copying of its Claude models. The company disclosed on Oct. 12 that new defenses have cut the data harvested by distillation attackers by around 90 to 99 percent. That follows the joint NSA, FBI and CISA advisory and Anthropic's earlier allegations of fraudulent accounts.

The number is a company estimate. Anthropic calls it "early evidence."

What Anthropic says it found

Distillation means collecting large volumes of a stronger model's responses and using them as training data for a cheaper rival. Anthropic describes the attacks as "covert, industrial-scale campaigns," often run through networks of fraudulent accounts.

A September threat intelligence report from the company attributes nearly 200 million distillation-related exchanges to five campaigns. The largest, according to Anthropic, is linked to Alibaba's Qwen and involved more than 151 million exchanges between May and July 2026.

That dwarfs what the company disclosed in February 2026: campaigns involving more than 16 million exchanges and roughly 24,000 fraudulent accounts.

Anthropic also names other Chinese developers. It says Zhipu distilled the cyber capabilities of leading US models while building GLM-5.3. Anthropic says Zhipu tried to distill Claude Fable 5, then switched to an older Claude model and another lab's model after Anthropic's cyber safeguards degraded its attacks.

The US Center for Advancing Innovation and Standards for Super Intelligence (CAISSI) has since assessed GLM-5.3 as the most cyber-capable open-weights model released to date, according to Anthropic. The company says its own research found the model's safeguards can easily be bypassed and that it will develop security exploits end to end.

On Moonshot, Anthropic says requests to its Kimi models were secretly forwarded to Claude. One request came from a user Anthropic believes was affiliated with China's People's Liberation Army, who sought to analyze CCTV surveillance of a specific individual.

How the defenses work

The focus is reasoning transcripts, the step-by-step thinking Claude produces before an answer. Anthropic says those are especially valuable for training because they teach a smaller model how Claude reaches a result, not just what it outputs.

The company lists several layers:

• Summaries in place of full reasoning, which make harvested material less useful. In a company test, a pretrained model trained on summarized transcripts scored lower on the SWE-bench Verified coding benchmark than one trained on full transcripts.
• "Preserved thinking," which stops new API accounts from editing encrypted reasoning context and restricts how reasoning moves between conversations, models and accounts.
• A two-stage classifier that screens for extraction requests. Anthropic puts its false-positive rate below 0.1 percent. Persistent attempts trigger tighter usage limits and bans.
• Account enforcement. Anthropic says it has banned tens of thousands of distillation-linked accounts, often within two hours of a campaign starting.

Anthropic measures results by estimating how many reasoning tokens attackers extract on its own platform. After the classifier arrived, that figure was consistently 10 to 100 times lower, the company says.

The costs, by Anthropic's account

This is not free. Anthropic says it has turned away "meaningful revenue and trillions of tokens' worth of paying traffic" from distillers.

Legitimate users pay too. Some customers have had to update their integrations. The classifier can occasionally block benign requests. Since Sept. 24, Anthropic has resumed charging for requests blocked by its safeguards, including distillation-related blocks.

Anthropic also says distilled models are a national security problem. In its words, the companies that distill US models are "integrating the capabilities they gain from distillation into foreign military, intelligence, and surveillance systems." It adds that distilled models approach the frontier without proportionally robust safeguards, which raises risks in biology and cybersecurity.

Not just Anthropic

OpenAI has been working on the same problem. It released its own September 2026 report outlining techniques to disrupt similar distillation efforts.

Anthropic is asking developers across the industry and cloud platforms to cooperate on stopping illicit extraction of model capabilities. It frames distillation as a problem "every model developer" faces.

What remains open

The 90 to 99 percent figure comes from Anthropic measuring its own platform. It says nothing about what distillers can still pull from other providers. Anthropic itself says some attackers moved to models with weaker protections after being blocked.

The company says it does not know how long the gains will last. It acknowledges the defenses have not faced a highly sophisticated, persistent circumvention attempt and says it must keep iterating.

The next test is whether the five named campaigns resume in a harder-to-detect form, and whether cloud and API intermediaries tighten account verification as Anthropic is asking.