What Anthropic says its distillation controls changed
Anthropic says controls cut data harvested by distillers by about 90 to 99 percent. Reasoning tokens extracted on its platform fell by a factor of 10 to 100.
The short version
The company says harvested data fell by about 90 to 99 percent, and that reasoning tokens extracted on its own platform fell by a factor of 10 to 100. It also says it banned tens of thousands of accounts.
What happened
Anthropic published a research post on distillation defenses. Secondary accounts date that post to October 12, 2026. The company says early evidence shows the methods reduced data harvested by distillers by around 90 to 99 percent. It says reasoning tokens extracted on its own platform fell by a factor of 10 to 100 after a classifier, and that on some days the amount was too small to measure. It says it banned tens of thousands of accounts associated with distillation, often in less than two hours. The post names controls it calls preserved thinking and a classifier. This page names those controls and the figures. It does not describe the procedure the company says it was interrupting. The paper filing the post isFutureweb.
What the company measured
The percentages and the factor of 10 to 100 are Anthropic's measurements on Anthropic's platform. They are not a second lab's rerun, and the post presents them as early evidence. A reader can hold the range without treating 99 percent as a guarantee on every day. The days the company says were too small to measure are part of the same account, not a separate success metric this page invented. The desk for a lab's own model controls isArtificial Intelligence.
What the other accounts add
The Decoder's account of the post carries the up-to-99-percent figure in its headline and describes the fight as industrial-scale distillation. AI Affairs' October 13 account covers the same defenses. Neither account is the measurement. The measurement is the company's. A Chapter 11 petition filed the same week by a different company is a different document,what Character Technologies filed on October 12.
Why it matters on this desk
The dependency is a vendor's report of how much of its own reasoning output it says it stopped losing to distillation. Distillation, at the level this page will use, means training another model on a service's responses. The how of hiding or extracting those responses is not part of the filing. What on-device inference keeps, when the model is not a remote service at all, iswhat on-device inference keeps.
What this page will not import
The post explains techniques. This page does not repeat them, does not list prompts, and does not describe how a block of reasoning is relocated. Naming a classifier and a feature the company calls preserved thinking is the control list a reader needs. A reproduction of the misuse is not. An advisory identifier for a different product is a security fact, filed aswhat a CVE identifier is.
Where the accounts overlap
The company post, The Decoder, and the October 13 AI Affairs account overlap on the existence of the defenses, the 90 to 99 percent range, and the claim that bans were large and often fast. They do not overlap on an outside audit, because none of them is one. They do not overlap on a dollar loss, because the post's figures are about tokens and harvested data, not an invoice. A day when the extracted volume was too small to measure is the company's description, not an outside audit. Less than two hours is the company's figure for how quickly many of those bans landed. Anthropic's post is the company's account. The Decoder and AI Affairs are the other accounts this page uses.
What to watch next
A methods note that an outside group can rerun, or a correction that withdraws the 90 to 99 percent range, would change the record. Another writeup of the same post would not. A different Anthropic warning about small models copying themselves onto devices is a separate story and is not folded into these figures. The standing limit on what a model file is allowed to claim iswhat a training cutoff does not mean.
What would change the record
A withdrawal of the factor-of-10-to-100 claim, or a statement that the classifier was rolled back, would change it. A ban count that the company later says was about a different abuse would change the account of who was removed. A blog that adds exploit steps this page refused to copy would not become the record. Anthropic's post is the company's account. The Decoder and AI Affairs are the other accounts this page uses. This page does not describe how a reasoning trace is moved or how a classifier is built. The post is about controls on Anthropic's service. It is not a claim about every other lab. The company says the drop was measured on its own platform.
What stays the company's range
What stays specific is Anthropic's statement that distillation defenses reduced harvested data by around 90 to 99 percent, that reasoning tokens extracted on its platform fell by 10 to 100 times, and that it banned tens of thousands of associated accounts, often in less than two hours. The date the secondary accounts give the post is October 12, 2026. The procedure is not part of this brief. The company says the drop was measured on its own platform. Tens of thousands of accounts is the company's figure for bans tied to distillation. A separate warning about small models is a different Anthropic item and is not this brief. A day when the extracted volume was too small to measure is the company's description, not an outside audit.
Sources
The reports this brief is filing. Futureweb did not republish them.
Questions
What range does Anthropic give for data its distillation controls stopped?
Around 90 to 99 percent less data harvested by distillers, which the company calls early evidence from its own platform.
By what factor does Anthropic say extracted reasoning tokens fell?
By a factor of 10 to 100 after the classifier, and on some days the company says the amount was too small to measure.
How many accounts does Anthropic say it banned over distillation?
Tens of thousands of accounts associated with distillation, often in less than two hours.
Does this Anthropic brief describe how the distillation was done?
No. It names the controls the company calls preserved thinking and a classifier, and it reports the company's figures.
Which date do secondary accounts give Anthropic's distillation post?
October 12, 2026. AI Affairs' account of the same post is dated October 13.