Anthropic's own numbers: distillation defenses cost Claude model 8.6 points on SWE-bench
Anthropic says new countermeasures have reduced the amount of data that distillation attackers manage to harvest from Claude by roughly 90 to 99 percent. The figure comes from the company's research post "Strengthening our defenses against distillation attacks," published in mid-October 2026, and is therefore not independently verified — it is one of several points where the post is Anthropic's own account of its own victory. But the company quantifies the argument, backs the measures with a concrete evaluation, and also states the price it has paid itself. At the same time, it levels serious, unverified accusations against the Chinese AI labs Zhipu and Moonshot.
What is new
In the post, Anthropic describes a layered line of defense against what it calls distillation attacks. According to RuntimeWire, which covered the announcement, the company summarized the work in a post on X on October 12 as well as a research post on the defenses. The measures include account detection, securing reasoning outputs, and stricter access controls (RuntimeWire).
The core number is Anthropic's own: "Early evidence suggests these methods have reduced the amount of data distillers have harvested by roughly 90 to 99 percent," the company writes in the blog post (Anthropic). The wording is worth holding on to: it concerns data harvested, not necessarily the number of attack attempts. Firstpost's coverage summarizes it more loosely as "distillation attempts" being cut by up to 90 percent — a skew that cannot be fully reconciled with the original text, and which we therefore do not merge here (Firstpost).
What distillation attacks are, according to Anthropic
Anthropic defines the threat this way in the post: "Distillation attacks are covert, industrial-scale campaigns to extract the capabilities of one model and replicate them in another, without authorization from the original model's developers. They are often carried out using networks of fraudulent accounts" (Anthropic).
The mechanism in practice is that a competing actor uses a frontier model through the API at high volume, often spread across many fake accounts to avoid detection, and trains its own model on the outputs — especially the long chains of reasoning that today's frontier models expose. This lets one obtain much of a frontier model's capability for a fraction of the research cost.
Firstpost writes that Anthropic identified nearly 200 million exchanges across five alleged distillation campaigns last month, with activity involving DeepSeek and Moonshot, and that the volume of reasoning tokens received by suspected distillers is now 10 to 100 times lower (Firstpost). These figures come from secondary coverage of Anthropic's announcement and differ from the blog post's framing; they cannot be reconciled against each other on the available basis, and are reproduced here as Anthropic figures relayed via Firstpost.
How the defense works — and what we cannot see
The three known pillars are:
- Account detection: identifying networks of fraudulent accounts used for large-scale extraction. The details of how this is done in practice are not available in the accessible text.
- Reasoning summarization: rather than delivering complete reasoning traces to users, summarized versions are provided — making them far less suitable as training data.
- Tighter access controls: changes that in some cases have required legitimate users to update their integrations, according to Anthropic (Anthropic).
An important caveat: Anthropic's blog post cuts off mid-sentence about how attackers adapt ("But distillers are persistent and inventive. After this change, attackers…"), so the full mechanistic description of the measures cannot be detailed from what is available. That should be kept in mind when weighing what is actually documented about how the defense works.
The number meant to prove the point
The most concrete quantification concerns reasoning summarization. Anthropic trained a pretrained Claude model on transcripts from Claude Opus 4.8 and measured it on SWE-bench Verified. With complete transcripts as training data, the distilled model scored 80.4 percent; with only summarized transcripts, it scored 71.8 percent (Anthropic).
The reading is that summarization removes the detailed reasoning distillers need, thereby reducing the quality of stolen training data by a measurable margin — over eight percentage points on an industry-standard benchmark. The evaluation is, however, company-run and not independently reproduced.
The accusations against Zhipu and Moonshot
The post also contains named accusations, and they require clear attribution — they are Anthropic's claims, not established facts, and the responses of the companies concerned are not available in the available material.
Against Zhipu, Anthropic claims the company distilled cyber capability from leading American models during the development of GLM-5.3, and that it attempted to distill Claude Fable 5: "After finding that our cyber safeguards degraded the attacks, it switched to an older Claude model and another lab's model," Anthropic writes (Anthropic). Anthropic goes on to write — and it is worth clarifying that this is Anthropic quoting — that the American Center for the Advancement of Innovation and Standards for Superintelligence (CAISSI) has assessed GLM-5.3 as the most cyber-capable open-weights model to date. CAISSI's assessment is not available as documentation in the available material.
Against Moonshot, Anthropic points to a previously reported case in which requests to the Kimi models were allegedly covertly forwarded to Claude. Among them was said to be one request from a user "who we believe was affiliated with China's People's Liberation Army" who wanted to analyze CCTV surveillance footage of a specific individual (Anthropic). Note that the identification here is explicitly presented as Anthropic's belief, not an established attribution. DeepSeek is mentioned only in Firstpost's rendering of Anthropic's campaign overview, without details in the available material.
The price Anthropic itself pays
The most credible part of the post may be that Anthropic admits the costs. "We have turned away meaningful revenue and trillions of tokens worth of paying traffic from distillers," the company writes, adding that some changes have required legitimate users to update their integrations (Anthropic). It is an honest balance: every barrier to exploitability one erects also hits legitimate users — and cuts revenue the company would otherwise have had.
What remains open
Several questions remain open:
- No independent verification. The 90–99 percent figure and the SWE-bench evaluation are Anthropic's own, with methodological details not publicly available in the available material.
- The measurement method is unclear. It is unclear whether the reduction measures fewer attack attempts, less data actually harvested, or both. The original text supports the latter reading ("data harvested").
- The other side's word is missing. Zhipu, Moonshot, and DeepSeek have not commented in what is available. If the accusations are correct, the consequences are large; if they are partly wrong, one lab has named competitors in a geopolitically charged context without independent documentation.
- The numbers diverge. Firstpost's 200 million exchanges and 10–100x reduced reasoning tokens cannot be anchored in the blog post itself, and the available basis provides no way to clarify the difference.
- Adaptation. Anthropic's own cut-off sentence suggests attackers are already adapting. Distillation defenses, if the framing holds, are a continuing arms race — not a final result.
What can safely be established is this: Anthropic has deployed defenses it genuinely pays for itself, quantifies them with its own evaluation basis, and puts a number on the effect — 90–99 percent less harvested data. How solid that number is, we so far know only on Anthropic's word.