# Anthropic Says Its Distillation Defenses Cut Extracted Reasoning by 90–99%

Source: TechNewsList (https://technewslist.com)
Canonical URL: https://technewslist.com/en/article/anthropic-distillation-defenses-preserved-thinking-2026-10-13-night
Section: AI (https://technewslist.com/en/ai)
Author: TechNewsList
Language: en
Published: 2026-10-13T18:51:54.678+00:00
Updated: 2026-10-13T18:51:54.898723+00:00

> The company reports sharply reduced reasoning extraction, but signed conversation history also changes how legitimate agents replay context. The published evidence is not an independent security guarantee.

## TL;DR
- Anthropic reports a 90–99% reduction in harvested reasoning after combining several defenses.
- Preserved thinking can reject agent requests that rewrite the history behind signed reasoning blocks.
- Independent research warns that defense success depends on attacker budgets and access assumptions.

## Key points
- Anthropic estimates tenfold to hundredfold less harvested reasoning on its platform after the defenses.
- Its summary-transcript experiment reports 71.8 percent SWE-bench Verified versus 80.4 percent with full transcripts.
- Preserved thinking binds signed reasoning to an unchanged system prompt, tools and prior message prefix.
- The documented prefix mismatch defaults to a 400 error; drop_block requires the named beta control.
- Bedrock documents removal of reasoning produced outside the permitted AWS account or customer group on Sonnet 5.5.
- Independent research argues that distillation-defense conclusions depend on the attacker threat model.

## What happened

Anthropic’s October 12 account of its anti-distillation work puts an estimate on a difficult problem: it says the reasoning tokens harvested from its platform fell by roughly ten to a hundred times after its defenses were enabled. Distillation here means using one model’s answers or reasoning to train another. The estimate describes activity Anthropic identified on its own service, not every possible extraction route.

![Company experiment chart comparing student performance with full and summarized reasoning transcripts.](https://rkhynbcsbnkkcwgexzwg.supabase.co/storage/v1/object/public/media/api/1791917507394-xerz48-anthropic-distillation-defenses-preserved-thinking-2026-10-13-night-inside-1-44c35aef5f.webp)
*Company experiment chart comparing student performance with full and summarized reasoning transcripts.. Credit: Anthropic.*

The company describes a layered response rather than one protective switch. It provides summarized reasoning, restricts how signed thinking can be replayed, classifies suspicious extraction requests and applies account-level enforcement. Its research report also compares student models trained on full and summarized transcripts: the summarized version scored 71.8% on SWE-bench Verified, against 80.4% for the full-transcript version. Those are company-run experiments, not independently replicated results.

## Why it matters

A model can expose more useful training information than its final answer alone. Intermediate work may reveal how it decomposes a programming task, chooses a tool or corrects a mistake. Reducing that information can make imitation less efficient without preventing ordinary customers from receiving useful outputs. The important distinction is between making extraction harder and demonstrating that a determined competitor cannot obtain an effective training set.

There is a practical cost for legitimate agent developers too. Many harnesses modify old messages, rebuild a system prompt or compress earlier turns to save context. Signed thinking changes the contract: the reasoning was produced under a particular history, and moving it into a different history may no longer be acceptable. A failure that looks like an intermittent model problem can therefore be a reproducible mismatch in the application’s own request construction.

## Technical details

Claude’s preserved-thinking documentation says the signature binds a thinking block to its model and conversation prefix. That prefix includes the system prompt, tools and earlier message content. Appending a new turn is different from rewriting an old one. Newer API accounts receive the prefix check by default under the documented rollout, while older integrations must check their own account behavior rather than assume identical enforcement.

![Log-scale company chart of estimated reasoning extraction before and after safeguards.](https://rkhynbcsbnkkcwgexzwg.supabase.co/storage/v1/object/public/media/api/1791917509608-2dkyfn-anthropic-distillation-defenses-preserved-thinking-2026-10-13-night-inside-2-c5fbcf7a1c.webp)
*Log-scale company chart of estimated reasoning extraction before and after safeguards.. Credit: Anthropic.*

The documented default for a prefix mismatch is a 400 error. A beta control can instead remove incompatible thinking blocks, allowing the request to continue. That is not equivalent to retaining the original reasoning: the model loses information that might have guided the next action. An application should record that transformation and assess its consequences, rather than quietly label a successful HTTP response as an unchanged continuation.

Amazon Bedrock documents additional distinctions for its hosted integration, including model compatibility and organization-bound thinking. Its Sonnet 5.5 behavior can remove reasoning originating outside the permitted AWS account or customer group. The provider also exposes transformation reasons when the relevant beta is supplied. These distinctions matter when a workflow moves between accounts, services or models; a signature is not a portable container for arbitrary reasoning.

## Market / industry impact

The competitive consequence is a change in the economics of collecting training examples, not a demonstrated end to distillation. Anthropic’s observed reduction and its student-model experiment address different questions: how much suspicious activity the service identified, and how useful a particular type of transcript was for training. Neither number directly establishes the quality of a rival model or measures every account that might have escaped detection.

Independent work by Lena Libon and colleagues, published before this disclosure, argues that claims about breaking a distillation defense depend on the threat model. Query budgets, available data and the attacker’s interface all affect the conclusion. That research does not audit Anthropic’s October deployment. It supplies a useful test for readers: ask what access and resources an evaluation permits before treating either success or failure as universal.

## What to watch next

Developers should first inspect the requests their own agents actually send. Keep returned thinking blocks intact, preserve signatures and identify the earliest edited turn when a replay fails. Distinguish a prefix error from a rate limit or temporary service failure; repeating an identical invalid request will not repair its history. If a supported drop behavior is used, make the lost context visible in diagnostics and regression tests.

The next persuasive evidence would combine reproducible extraction tests with measurements of legitimate-user disruption. Useful questions include whether classification errors concentrate in certain workflows, whether sophisticated attackers adapt and how much application behavior changes after thinking is removed. Anthropic acknowledges limits to its evaluation. Its figures are evidence of a deployed defense under its own observation, not a reason to stop testing either security or integration reliability.

For readers outside model development, the boundary is simpler: a summarized explanation can still be useful without being the complete internal trace. The article’s charts should be read as labeled company results, not a ranking of all AI systems. Better disclosure would let customers compare the protection achieved with the compatibility burden imposed, while keeping claims about actual competitor conduct separate from technical speculation.

## Sources

- [Anthropic research](https://www.anthropic.com/research/distillation-defenses) — October 12 company measurements, summary-training comparison, classifier scope and acknowledged limitations.
- [Claude API preserved thinking](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking) — Conversation-prefix binding, account rollout, beta controls and exact-history requirements.
- [Amazon Bedrock documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/claude-messages-thinking-block-binding.html) — Cloud-provider-specific model, prefix and organization checks, error behavior and diagnostic transformations.
- [Independent distillation-defense research](https://arxiv.org/abs/2606.25059) — Threat-model analysis showing that query budgets and attacker interfaces change the meaning of defense success; not verification of the October metrics.

Mentions: Anthropic

## Sources
- [Anthropic research](https://www.anthropic.com/research/distillation-defenses)
- [Claude API preserved thinking](https://platform.claude.com/docs/en/build-with-claude/preserved-thinking)
- [Amazon Bedrock documentation](https://docs.aws.amazon.com/bedrock/latest/userguide/claude-messages-thinking-block-binding.html)
- [Independent distillation-defense research](https://arxiv.org/abs/2606.25059)