Anthropic Reduces Data Theft from Claude by 10–100 Times
The company has strengthened protection against distillation—a method competitors use to copy AI model capabilities without developer permission.
Anthropic has reported a reduction in the volume of data that competitors can extract from the AI model Claude for training their own systems. New protective mechanisms have decreased the amount of data collected by distillers by 90–99%. The company has also blocked tens of thousands of accounts linked to attacks.
Distillation allows companies to replicate advanced AI model capabilities at minimal cost. For example, the Chinese startup Zhipu used this method during the development of the GLM-5.3 model, attempting to extract data from Claude. After Anthropic’s protective mechanisms thwarted the attacks, Zhipu switched to an older version of Claude and a model from another developer. The CAISSI Center later evaluated GLM-5.3 as the most cyber-capable open-weight model at the time of its release.
Anthropic emphasizes that distillation poses risks to national security. Extracted data is integrated into military, intelligence, and surveillance systems of other countries. In one case, queries to the Chinese model Kimi were secretly redirected to Claude. One such query came from a user allegedly linked to the People’s Liberation Army of China, who was analyzing surveillance footage of a specific individual.
Previously, Anthropic tested simple protective methods, such as reducing the output of Claude’s internal reasoning before displaying it to the user. This lowered the effectiveness of distillation: a model trained on reduced data scored 71.8% on the SWE-bench Verified benchmark, compared to 80.4% when trained on full data.
Attackers adapted by shifting to active data extraction methods. They used networks of hundreds of thousands of fake accounts and requests demanding verbatim output of reasoning. Anthropic strengthened its defenses, but this required trade-offs: the company sacrificed significant revenue and trillions of tokens of paid traffic, and some changes affected legitimate users.
