News · 2026-10-13

Anthropic reports a sharp fall in extracted reasoning after new defenses

Anthropic says new defenses reduced the reasoning tokens extracted by unauthorized model-training operations on its own platform by around 90–99%. Its October 12 disclosure describes tighter reasoning access, prompt screening and account enforcement, with consequences for ordinary developers. The reduction is Anthropic’s platform estimate, rather than an independently reproduced security result or a measure of all capability transfer between models.

Key facts

• Anthropic reports a roughly 10- to 100-fold or greater fall in estimated daily reasoning-token extraction after full implementation.
• The defenses were described on October 12, 2026.
• Anthropic names Zhipu, known outside China as Z.ai, in its prior attribution concerning GLM-5.3.
• The primary source is Anthropic’s defenses announcement, with earlier campaign details in its September threat report.

The valuable material is a model’s working, not merely its final answer. A mathematics student can learn from seeing a result, but often learns more from the intermediate steps. Anthropic argues that hidden reasoning transcripts provide particularly rich supervision for a competitor training another model. The company uses “distillation attacks” for covert, large-scale querying and subsequent training without authorization. Legitimate distillation is a broader technique; the security issue here is unauthorized extraction through deceptive access.

Its first defense closes paths across reasoning boundaries. For Fable 5.1 and Opus 5.5, accounts created on or after August 31 cannot edit prior Claude context through preserved thinking. Anthropic also blocks those models’ reasoning from being read by earlier, less protected models. Sonnet 5.5 reasoning is restricted to the organization whose request generated it. These are specific access controls on specific models and account conditions, rather than a blanket restriction on every older or newer account.

The second layer screens attempts to disclose protected reasoning. Anthropic says a two-stage classifier was trained using actual extraction transcripts, challenged by internal and external red teams and patched after discovered weaknesses. The company describes preventing observed workarounds such as translating earlier reasoning or reproducing it inside tags. These mechanisms resemble a records office checking both who is allowed to view a file and whether an apparently innocent request is actually asking to copy its contents.

The third layer changes the economics of persistent probing. Repeated extraction attempts face tighter limits and possible bans. Since September 24, Anthropic has charged for requests blocked before a response in safeguard areas where it reports a false-positive rate below 0.1%. The company acknowledges that legitimate developers may need to update integrations and may occasionally receive an erroneous block. Its description of “minimal impacts” is the company’s characterization, not a published customer-impact study.

The size of the reported improvement needs its denominator. Anthropic’s chart describes daily estimated extracted reasoning tokens on a logarithmic scale. The post does not publish the date window, absolute token counts, baseline definition, classification method or a breakdown of the separate defenses’ effects. It also says a highly sophisticated, persistent circumvention effort has not yet appeared. The evidence supports a reported reduction in observed extraction, while leaving uncertainty about recall, unseen attackers and effectiveness outside Anthropic’s services. A low false-positive rate alone cannot answer those questions.

Attribution requires equal care. Anthropic explicitly names Zhipu/Z.ai and says GLM-5.3 development drew on cyber capabilities distilled from leading United States models. Its September threat-intelligence report describes fraudulent accounts and capability-focused collection. These are Anthropic’s allegations and telemetry. NIST’s separate assessment establishes that GLM-5.3 was notably cyber-capable in its tests, while saying nothing about where its training material came from. Capability evidence is not evidence of provenance.

A technical objection in the LocalLLaMA discussion argues that output copying is not true distillation without teacher token probabilities. That distinguishes one particular training method, but draws the boundary too narrowly. A student can also train on teacher-written answers. The Semi-OPD paper describes another route: a teacher scores fixed student-generated responses. It requires a suitable scoring interface, not a stolen hidden transcript. The available record supplies no checked download sizes or running-memory requirements for its referenced research checkpoints.

Blocking reasoning extraction can therefore remove a valuable ingredient without preventing all imitation. Final answers, synthetic tasks, authorized teachers and other providers remain possible inputs. The earlier extraction announcement provides the campaign background, while the lesson on model extraction explains the broader threat. The practical result is a stronger boundary around one high-value channel, accompanied by enforcement costs and an efficacy claim that still needs independent testing. It is neither proof that all open models depend on Claude nor proof that capability transfer has become impossible.

Primary source, verified: read the paper →

Ground Truth. (2026, October 13). Anthropic reports a sharp fall in extracted reasoning after new defenses. Ground Truth. https://groundtruth.day/news/anthropic-distillation-defenses-reasoning-extraction.html

@misc{groundtruth:anthropic-distillation-defenses-reasoning-extraction,
  title  = {Anthropic reports a sharp fall in extracted reasoning after new defenses},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {oct},
  url    = {https://groundtruth.day/news/anthropic-distillation-defenses-reasoning-extraction.html}
}

Topics: cybersecurity · ai-security · model-extraction · distillation · red-teaming · anthropic