Anthropic Strengthens Defenses Against AI Distillation Attacks, Cutting Inference Data Extraction by Up to 99%
Anthropic, a U.S. AI development company, announced on October 12 (U.S. time) that it has significantly strengthened defenses against "distillation attacks" that illicitly harvest inference records from its AI model Claude. With the introduction of a new multi-layered defense system, the company says extractable inference data has been reduced to between one-tenth and one-hundredth of previous levels—a reduction of approximately 90–99%.
Distillation attacks refer to the practice of extracting a model's capabilities from large volumes of responses and replicating them in another model at low cost. Particularly valuable are the inference records that Claude writes out before generating answers. Anthropic has now deployed defensive measures focused specifically on protecting these inference records.
The defense rests on three pillars. The first is controlling inference output channels. For Claude Fable 5.1 and Claude Opus 5.5, the company introduced a "preserved thinking" feature for new API accounts created after August 31, 2026, which prevents editing of prior context. For Claude Sonnet 5.5, the system has been changed so that inference records can only be viewed by the requesting organization.
The second is a two-stage classifier that blocks extraction attempts. The false positive rate is kept below 0.1%, and the company says it can capture all distillation methods identified to date. The system is currently applied to its most capable generally available models, with plans to expand to similar models going forward.
The third is handling repeated attempts. Accounts that continue extraction face stricter usage limits, with persistent offenders subject to freezing. Billing for requests blocked by the classifier before a response was generated resumed on September 24, limited to areas where the false positive rate is below 0.1%.
As a result, the number of inference tokens extracted after the classifier's introduction has fallen to between one-tenth and one-hundredth of pre-introduction levels. Tens of thousands of accounts involved in distillation have also been frozen. On the other hand, the introduction of preserved thinking has forced some developers to update their API integrations.
In an official blog post, the company pointed out that Chinese AI firm Z.AI (2513.HK) distilled cyber capabilities from U.S. models during the development of its GLM-5.3 model. Anthropic also referenced national security risks, noting that capabilities obtained through distillation are being used in foreign military and surveillance systems.
On a related front, OpenAI announced on September 30 that it had detected and blocked a distillation campaign attempting to illicitly extract "protected reasoning" from its models. As U.S.-China AI competition intensifies, model distillation has become a major concern for leading AI companies. Anthropic, OpenAI, Google (GOOGL.O), and others argue that this technique allows competitors to replicate advanced capabilities quickly and at low cost.
Anthropic also called on third-party cloud infrastructure and inference service providers to detect and remove fraudulent accounts early. The company explained that it is making repeated access to inference through proxy networks more difficult, thereby impeding large-scale distillation activities.
What's Behind the Defense Strengthening
Anthropic's intense focus on protecting inference records stems from the results of learning experiments the company conducted. After quantitatively evaluating the value of inference data, it appears the company found that replicating capabilities through distillation is easier than previously assumed. Attackers are also becoming more sophisticated, building networks of fake accounts and employing diverse extraction techniques.
Market Scrutiny Ahead of IPO
The announcement comes as Anthropic prepares for a large-scale initial public offering (IPO). Investors have floated the possibility that the company's valuation at listing could reach $2 trillion (approximately ¥316 trillion). That would surpass SpaceX's $1.77 trillion (approximately ¥280 trillion) and rank among the largest IPOs in history.
However, independent financial research firm New Constructs on October 6 criticized the valuation as "the most absurd IPO of 2026," estimating Anthropic's fair value at approximately $150 billion (approximately ¥23.7 trillion)—roughly 93% below the target valuation.
Questions surround the sustainability of the company's revenue structure, particularly its annual recurring revenue (ARR). ARR surged from approximately $9 billion (approximately ¥1.4 trillion) at the end of 2025 to $47 billion (approximately ¥7.4 trillion) in May 2026, and to $65 billion (approximately ¥10.3 trillion) in July. However, ARR is not an audited financial metric, and figures can vary significantly depending on how they are calculated.
Anthropic CFO Krishna Rao said in a May podcast that the company's net revenue retention (NRR) rate reached 500%. A customer cohort that generated $30 billion (approximately ¥4.7 trillion) in ARR in the first quarter of 2026 had contributed only $2 billion (approximately ¥320 billion) a year earlier.
Meanwhile, concerns remain about the sustainability of growth. According to TickerTrends statistics, company-wide ARR stood at approximately $76.8 billion (approximately ¥12.2 trillion) as of September 24, 2026, but September's month-over-month growth was just 1.8%, far below the 30–50% monthly growth seen in the first half of 2026.
For fiscal 2025, revenue was $4.6 billion (approximately ¥730 billion), while net operating losses widened to $8 billion (approximately ¥1.3 trillion). Net losses including revaluation of convertible financial instruments reached $42 billion (approximately ¥6.6 trillion). Furthermore, the company carries approximately $518 billion (approximately ¥82 trillion) in cloud, compute, and infrastructure contract obligations, of which approximately 80%—$414 billion (approximately ¥65.5 trillion)—is non-cancellable.
Given this financial picture, some in the market are questioning the sustainability of Anthropic's business model. Strengthening defenses against distillation attacks serves not only to protect the company's intellectual property but also to defend corporate value ahead of the IPO.
Anthropic describes its safety systems as "nearly as robust as the mechanisms that prevent Claude from assisting in the production of biological weapons." The company's approach to balancing AI safety with commercial success is reflected in this latest defense enhancement.