Anthropic Says New Defences Cut Data Harvested by AI Distillation Attacks by up to 99%

Anthropic says it has made substantial progress against distillation attacks on its Claude models. Early evidence suggests its new methods have reduced the amount of data harvested by distillers by around 90 to 99%. Distillation attacks are covert, industrial-scale campaigns to extract the capabilities of one AI model and replicate them in another without the developer's authorisation. They are often run through networks of fraudulent accounts, and they let companies mimic frontier capabilities for a fraction of the usual time and cost.

Anthropic gives two reasons for concern. First, distilled models can approach the capability frontier without proportionally robust safeguards, so they could be used to cause significant harm in areas like biology and cybersecurity. As an example, it says Zhipu distilled the cyber capabilities of leading US models while developing GLM-5.3. Anthropic says Zhipu tried to distill Claude Fable 5, but switched to an older Claude model and another lab's model after Anthropic's cyber safeguards degraded its attacks. The US body CAISSI has assessed GLM-5.3 as the most cyber-capable open-weights model released to date. Anthropic's own research found its safeguards can easily be bypassed and that it is willing to develop security exploits from end to end.

Second, Anthropic says illicitly distilled models are a national security risk, because the capabilities gained are being integrated into foreign military, intelligence and surveillance systems. It cites a case where requests to Moonshot's Kimi models were secretly forwarded to Claude. One request came from a user Anthropic believes was affiliated with China's People's Liberation Army, who sought to analyse CCTV surveillance of a specific individual.