Anthropic Slashes AI Distillation Attacks by 99% Amid US-China Competition

Anthropic Cuts Data Harvesting by Up to 99%

Anthropic announced on October 12 that new security measures have reduced data harvesting from its Claude models by approximately 90% to 99%1

1

3

3

. The California-headquartered AI company reported that the number of reasoning tokens extracted by distillers is now 10 to 100 times lower than before3

3

. These safeguards against distillation attacks target unauthorized attempts to copy Claude's advanced capabilities through repeated model queries.

Understanding AI Distillation Attacks

AI distillation attacks involve covert, industrial-scale campaigns to extract capabilities from one model and replicate them in another without authorization2

2

. Anthropic describes distillation as a technique where a less capable AI model is trained on the outputs of a stronger one, aiming to replicate larger model capabilities at lower cost1

1

. Attackers send large numbers of carefully designed questions to an AI model and collect responses to use as training material for competing systems. OpenAI reported identifying a coordinated campaign in July with 16,000 requests using a particular extraction pattern across more than 4,000 users on July 24 and 251

1

.

Chinese AI Labs Under Scrutiny

Anthropic banned tens of thousands of accounts linked to distillation campaigns and specifically cited Chinese AI startup Zhipu as attempting to extract capabilities from Claude while developing its GLM-5.3 model3

3

5

5

. The company noted that Zhipu extracted cyber capabilities from leading American models to develop GLM-5.3, which the US Center for Advancing Innovation and Standards for Super Intelligence assessed as the most cyber-capable open-weights model to date, capable of building end-to-end exploits2

2

. Anthropic separately alleged in February that DeepSeek, Moonshot AI and MiniMax had generated more than 16 million exchanges with Claude through approximately 24,000 fraudulent accounts1

1

. OpenAI attributed a core cluster of activity to individuals associated with Moonshot AI, the developer of Kimi1

1

.

Protecting Reasoning Data from Unauthorized Extraction

Anthropic focuses its technical defenses primarily on shielding Claude's internal reasoning transcripts, which distillers prize above final text outputs2

2

. OpenAI defines protected reasoning as a model's internal record of working through a task, warning that extracting this information can reveal information withheld from the final answer and help others reproduce a model's capabilities1

1

. The company observed operators attempting to extract protected reasoning in novel ways, including copying encrypted reasoning from one conversation and asking a model in another conversation to decrypt and transcribe the hidden reasoning content1

1

.

National Security Risks Drive AI Security Measures

The concern over AI distillation attacks stems from biosecurity, cybersecurity, and national security risks2

2

. Anthropic warned that distillation attacks allow companies to mimic frontier capabilities for a fraction of the development time and cost2

2

. OpenAI emphasized that extracted reasoning could train another model without preserving the safeguards applied to the original model's user-facing outputs1

1

. The company noted that queries to Moonshot's Kimi models were routed to Claude, including an inquiry linked to China's People's Liberation Army seeking analysis of closed-circuit television surveillance2

2

.

Technical Framework for Protecting AI Model Integrity

Anthropic's defensive framework operates across three key fronts: controlling the movement of reasoning data across accounts, deploying a specialized two-stage classifier to block extraction attempts, and restricting persistent abusers through account bans, usage caps, and billing for blocked queries2

2

. The classifier operates with a reported false positive rate below 0.1%, matching the rigor applied to bioweapon defenses2

2

. Anthropic stated its safety system is roughly as robust as those that prevent Claude from helping build bioweapons3

3

. The company has made it harder to use proxy networks to repeatedly probe Claude's protected reasoning, blocking extraction attempts and hindering large-scale distillation efforts4

4

.

US-China AI Competition Intensifies

Model distillation has emerged as a key concern for leading AI companies due to intensifying US-China competition, with firms including Anthropic, OpenAI and Google arguing the practice enables rivals to reproduce advanced capabilities more quickly and at lower cost3

3

5

5

. Implementing these safeguards carries commercial and technical trade-offs, with Anthropic acknowledging that it has turned away significant revenue and trillions of tokens in traffic from malicious networks2

2

. The company emphasized that mitigating unauthorized data extraction requires industry-wide collaboration among model creators and cloud inference platforms alike2

2

. Watch for continued evolution in defensive measures as attackers adapt their methods and for potential regulatory frameworks addressing intellectual property protection in AI development.