Copy Claude's 'Thoughts' and Lose Your Account? Inside Anthropic's 99% Distillation Defense

Anthropic says its new safeguards reduce the amount of useful Claude reasoning data harvested by model-distillation attacks by 90% to 99%. Could an ordinary developer lose access simply for making many API calls? Not merely for volume, according to the company’s description—but automated detection, blocked accounts, and false positives now form a more visible part of the platform boundary.

The strongest numbers are Anthropic’s own measurements. The company reports a false-positive rate below 0.1%, but independent reproduction is not yet available. Developers should treat the defense as meaningful security progress and as a new operational risk to monitor.

What attackers are trying to steal

Model distillation is a legitimate technique when a developer has permission to use the teacher model’s outputs for training. It becomes model extraction or theft when an attacker sends industrial-scale queries to reconstruct capabilities without authorization.

Reasoning traces are especially valuable because they contain intermediate steps, corrections, decompositions, and decision patterns. A final answer provides one label. A detailed trace can teach a smaller model how to approach an entire class of problems.

Anthropic cites an internal experiment in which a model trained with fuller reasoning data reached 80.4% on SWE-bench Verified, compared with 71.8% when trained on summarized reasoning. The exact result depends on the experiment, but it illustrates why providers increasingly treat reasoning records as proprietary training data.

How Anthropic says the defense works

The system combines several layers rather than relying on a single rate limit:

1. Preserved thinking: users receive useful reasoning summaries without the complete internal trace.
2. Access separation: reasoning access is restricted across models and organizations.
3. Two-stage classification: traffic patterns and sampled content are evaluated for extraction behavior.
4. Linked-account enforcement: repeated campaigns cannot reset easily by creating another account.
5. Operational blocking: suspected extraction requests and accounts can be denied.

Anthropic says these controls reduced harvested reasoning tokens by one to two orders of magnitude and led to the blocking of tens of thousands of accounts.

Does heavy API use put legitimate users at risk?

High volume alone is not the same as extraction. Normal products can generate millions of repetitive classification, coding, or evaluation requests. The risk rises when traffic resembles systematic capability harvesting: broad prompt suites, repeated reasoning elicitation, coordinated accounts, proxy rotation, and training-oriented collection patterns.

Still, any classifier can make mistakes. Anthropic acknowledges integration costs, false positives, and the difficulty of evaluating adaptive attackers. A reported rate below 0.1% may be small statistically while still affecting real customers at scale.

Teams that depend on Claude should retain request IDs, document their permitted use case, avoid undocumented account sharing, and maintain an escalation path for unexpected blocks. They should also understand whether denied requests are billed and how retries affect cost; policy and billing details can change independently of the research result.

Security versus developer transparency

Reasoning restrictions create a genuine tradeoff. Hiding detailed traces makes theft harder, but it can also reduce debugging, reproducibility, and auditability. A summary may explain the broad approach while omitting the exact step that caused an error.

Providers can reduce this tension with structured tool logs, citations, deterministic test modes, appeal processes, and organization-level audit records. Customers do not necessarily need raw chain-of-thought, but they do need enough evidence to understand consequential failures.

Is 99% the end of model extraction?

No. The number describes the reduction observed under Anthropic’s evaluated attacks and defenses. Adaptive adversaries can change prompts, distribute traffic, target final answers instead of reasoning, or move to compromised customer accounts.

Defense also changes the economics rather than making theft mathematically impossible. If extracting the same signal requires 10 to 100 times more accounts, queries, and money, many campaigns become less attractive even when some data still escapes.

Verdict

Anthropic’s result shows that reasoning data has become a protected asset, not merely an explanatory by-product. The new controls appear capable of sharply raising the cost of large-scale extraction.

Legitimate developers are not being told that heavy usage automatically means account termination. But they are operating inside a stricter behavioral security system. That makes clear policies, observable enforcement, billing transparency, and a reliable appeal process as important as the headline 90–99% reduction.