Between a tenth and a hundredth. That is how much reasoning data Anthropic says distillers can now extract from Claude compared with before, a cut of 90 to 99 percent, according to a post it published on 12 October.
Distillation means training a cheaper model on a stronger one’s outputs. Anthropic describes the attacks as covert, industrial-scale efforts, often run through networks of fraudulent accounts.
The defences have three parts: limits on who can read and reuse Claude’s reasoning, a two-stage classifier on its most capable models, and stricter limits, bans and charges for repeat offenders. Anthropic puts the classifier’s false positive rate below 0.1 percent.
It says it has banned accounts numbering in the tens of thousands, often within two hours of a campaign starting. Since 24 September it has also charged for requests its safeguards block before Claude replies.
The post names Zhipu, which Anthropic says tried to distil cyber capability from leading US models while building its GLM-5.3.
There are costs, and Anthropic lists them. Anthropic acknowledges turning away paying traffic and says some developers had to change their integrations.
The measure is the weak point. The 90 to 99 percent range is Anthropic’s own, and the secondary reports of the post give no method behind it.
Anthropic also concedes it has not yet met a sophisticated, persistent attempt to beat the system, and calls the problem cat and mouse, which is not the language of a solved one. Distillers, it says, have shifted to rivals with weaker protections.
