Anthropic Says New Safeguards Cut AI Model Distillation Attempts by Up to 99%

Anthropic said it has reduced the amount of data extracted from its Claude artificial intelligence models through distillation attacks by between 90% and 99%, as the company intensifies efforts to prevent rival developers from copying advanced capabilities and escalating concerns over AI competition, intellectual property, and national security.

The California-based AI company announced on Monday that new safeguards restricting access to Claude’s reasoning capabilities had sharply reduced attempts to extract information that could help other developers reproduce the models’ performance.

According to Anthropic, the number of reasoning tokens extracted by distillers is now “10 to 100 times lower than it was before.” The company said it had also made it more difficult for attackers to use proxy networks to repeatedly query Claude, a technique that can allow large-scale extraction campaigns to operate through multiple accounts and appear less conspicuous.

The measures come as leading AI developers, including Anthropic, OpenAI and Google, increasingly scrutinize model distillation amid intensifying competition between US and Chinese technology companies. The practice can allow developers to use the outputs of a more capable model to train a smaller or competing system, potentially reducing the time, computing resources and cost required to develop advanced AI capabilities.

Anthropic said it had banned tens of thousands of accounts associated with distillation campaigns and cited Chinese AI developer Z.ai, also known as Zhipu, as an example of a company it accused of attempting to extract Claude’s capabilities while developing its GLM-5.3 model.

The company warned that such activity could create safety and national security risks, arguing that the unauthorized transfer of advanced AI capabilities could undermine safeguards developed by the original model provider.

The latest protections focus on limiting the ability of external users to probe Claude repeatedly and harvest information about how the model reasons through problems.

In a distillation process, a developer typically uses a more capable model to generate outputs that can serve as training examples for another model. The developer then uses those examples to teach its own system to reproduce some of the original model’s behavior, potentially without having to repeat the full cost of developing the underlying capabilities from scratch.

Distillation is not inherently improper. AI developers routinely use the technique to create smaller, cheaper, and faster models, including systems derived from models they own or are authorized to use. The concern arises when a company allegedly uses another provider’s models in ways that violate access restrictions or terms of service to obtain capabilities that would otherwise require substantial investment to develop.

Anthropic said its new measures restrict access to Claude’s reasoning and make large-scale extraction more difficult. Proxy networks, which route activity through different internet addresses or accounts, can be used to distribute queries and complicate efforts to identify coordinated behavior.

By detecting and blocking such attempts, Anthropic aims to reduce the volume of useful training data that unauthorized users can collect. The reported 90% to 99% reduction suggests that the company believes its latest protections have significantly raised the barriers to extracting Claude’s capabilities.

However, the figures are Anthropic’s own assessment. The announcement does not independently establish how much distillation activity has been eliminated across the industry, whether attackers have shifted to other techniques, or how effectively the measures will hold up as rival developers adapt.

Anthropic also described its safeguards as “roughly as robust as those that prevent Claude from helping build bioweapons” and said they have “a false positive rate of less than 0.1%.”

The comparison highlights the company’s attempt to apply its safety enforcement infrastructure to the protection of model capabilities. The reported false positive rate is also relevant because overly aggressive detection could block legitimate developers or researchers who use Claude within permitted limits. Anthropic’s claim, however, does not by itself establish how the rate was measured or whether it applies uniformly across all users and types of activity.

US-China AI Competition Raises The Stakes

The dispute over distillation is becoming more consequential as Chinese AI developers seek to narrow the gap with leading US models. Training frontier AI systems can require enormous investments in computing infrastructure, specialized chips, data, and research personnel. Distillation offers a potential route to reproducing selected capabilities at lower cost, although the quality and breadth of the resulting model depend on the training data, techniques, and resources available.

For established AI companies, the risk is that competitors could use their services to acquire valuable capabilities without bearing equivalent development costs. Anthropic and other leading providers have argued that large-scale extraction can compromise their commercial advantage and weaken controls intended to govern how their systems are used.

Anthropic’s reference to Z.ai adds a specific company to that debate. The firm, also known as Zhipu, is developing the GLM family of AI models. Anthropic alleged that Z.ai attempted to distil capabilities from Claude while working on GLM-5.3, presenting the activity as an example of the extraction campaigns its new protections are designed to prevent.

The allegation should be distinguished from independently established findings. Anthropic’s announcement does not, on its own, establish the full scope of the alleged activity or demonstrate that the development of GLM-5.3 depended on information obtained from Claude. The company’s claims nevertheless illustrate how model access, training methods, and the enforcement of usage restrictions have become contested issues in the AI industry.

The national security dimension extends beyond commercial competition. Anthropic believes that transferring advanced capabilities through unauthorized distillation could allow other developers to reproduce systems without implementing equivalent safety measures. If a model’s safeguards are not reproduced alongside its useful capabilities, the resulting system could behave differently from the original or permit uses that the original provider seeks to restrict.

That concern is especially relevant for models capable of supporting sophisticated coding, automated workflows, and other technically demanding tasks. At the same time, distillation does not automatically transfer every capability, internal mechanism, or safety vulnerability of the original model. The extent of any risk depends on what is extracted and how the resulting model is trained and deployed.

However, Anthropic’s latest measures underline a growing tension in the frontier AI market: the same access that allows developers to use advanced models can also create opportunities to reproduce some of their capabilities.

Companies have incentives to make their models available through APIs and other services because broader adoption can generate revenue and strengthen their position in the developer ecosystem. But those access channels also create potential exposure to automated querying, coordinated account activity, and attempts to collect large volumes of model outputs.

The challenge is to preserve legitimate access while identifying activity that violates restrictions. Stronger safeguards could make extraction more expensive and less effective, but determined actors may change their methods, distribute queries differently, or rely on alternative sources of training data.

Some analysts thus see Anthropic’s reported reduction in extracted reasoning tokens as a measure of progress against a particular set of attacks, rather than proof that model distillation has been eliminated.