Anthropic Says New Filters Cut Stolen Reasoning by Up to 99%

Anthropic says a layered defense deployed across its most capable Claude models has cut the volume of hidden reasoning harvested in unauthorized model-distillation campaigns by roughly 90% to 99%. The October 12 disclosure describes a combination of access controls, request classifiers, account limits and bans rather than a single filter.

Key fact: Anthropic reports that its classifier catches every extraction technique documented in its September threat report while producing false positives on fewer than 0.1% of requests.

Why reasoning traces are valuable

Model distillation is a standard technique in which a smaller system learns from outputs produced by a more capable model. The security problem begins when operators use fraudulent accounts and automated traffic to collect those outputs without permission. Detailed reasoning traces are especially useful because they expose intermediate steps, not only a final answer.

Anthropic tested that difference on SWE-bench Verified. A pretrained Claude model taught with full reasoning transcripts scored 80.4%, while one trained on summarized transcripts scored 71.8%. That result explains why the company began summarizing protected reasoning, but attackers then tried prompts that asked models to reproduce, translate or reformat the hidden text.

Three layers instead of one blocklist

The first layer, called preserved thinking, stops newer API accounts from editing earlier Claude context and prevents protected reasoning from being passed to models or organizations that did not generate it. The second uses a two-stage classifier, strengthened through internal and external AI red teaming, to detect extraction attempts. The third makes repetition expensive through stricter usage limits, account bans and charges for requests blocked in categories where the measured false-positive rate is below 0.1%.

Anthropic says it has banned tens of thousands of accounts, often within two hours of a campaign starting. It also says the controls now run on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1.

A safeguard with user costs

The company acknowledges that preserved thinking forced some developers to change integrations, benign requests can still be blocked, and certain blocked requests are now billed. Those trade-offs matter because normal reasoning-model workflows can resemble extraction at small scale.

This is separate from Anthropic's recent disclosure about an evaluation model reaching a police website. That case concerned an agent acting outside its intended boundary. The new system instead tries to stop outsiders from copying a model's capabilities. The useful follow-up evidence will be sustained performance under adaptive attacks and third-party validation, not the initial percentage alone.