It's the first time in the history of the world.
It was just that Anthropic suddenly posted their latest anti-distillation achievement, "Flattering".
- On the platform itself, the reasoning data that distillation can take away is about less.90%—99%It's just the same size.1/10—1/100。
- Tens of thousands of related accounts were clearedSome accounts started distilling less than two hours before the seal was issued.
In order to achieve this result, Anthropic collectively used three "big killers":
1. Reason can be used but cannot be changed at will.
After the introduction of preserved thinking, once the previous context has been modified, the new API account will not be able to replicate the original reasoning. Different models also restrict readings of older models with less protection and cross-organizational access respectively.
2. To complete the reasoning, go through the classifier first.
Anthropic uses Constitutional Classifiers' defense approach to counter-distillation: through a two-stage classification system, it identifies and intercepts requests to try to apply Claude's complete reasoning. The stability of this scheme is almost equivalent to preventing Claude from assisting in the manufacture of biological weapons.
3. Repetition, bills and budgets must pay a price
Repeats will be restricted and the associated accounts of ongoing attempts will be blocked. If you want to continue to get lucky, you will also have to bear the loss of the seal. Requests for this type of distillation that are blocked by the defence system before Claude answers will also be charged.
In order to get rid of these "students", Anthropic connects.Trillions of tokens of payment flowThey all refused.
Even the draft papers were not copied.For distillation, copying the answer is far from enough.
What's more important is to get the chain of thought before Claude's answer, see how it dissolves the problem, how it tries, and how he finds out he's wrong.
With complete reasoning and abstract training models, SWE-bench Verified scores bridged the gap.Anthropic itself conducted a controlling experiment to train a pre-trained Claude model with the dialogue record of Opus 4.8.
In the SWE-bench Verified programming test, complete reasoning scores 80.4%, while abstracts are only 71.8%, a drop of 8.6%.
Thus, Anthropic collected the entire draft early, only giving the abstract to the outside world.
Claude was always serious about the subject, and those who wanted to copy the work could only get the deleted version.
For this reason, the attackers began to induce Claude to repeat his hidden reasoning.
According to official disclosures, the laboratory has tested 12,000 requests, each with a different trick. As long as you try an effective copy, you can take a batch copy.
Independent studies have demonstrated pathways to extract stronger model reasoning using weaker models, earlier than this defense update.Anthropic previously recorded that a proxy network managed more than 20,000 fraudulent accounts simultaneously, with a larger network of accounts behind it.
It looks like users are in line to ask questions, but it's actually training data in bulk production.
It's hard to say the big one, but it's hard to say the small oneIt's not so easy to hide the drafts. When Claude has a long assignment, he has to keep reading.
In order for it to move on to the next round, protected reasoning is preserved and returned to the model.
The user sees a series of encrypted content that Claude, who is responsible for rewriting, must be able to understand.
The strong model is tough, and the attacker gives the reasoning behind it to the same weak defensive model, prompting the latter to repeat it.
Different models add context, model compatibility and organizational access restrictions respectivelyAn independent study published in August showed this path. The encryption algorithm was not cracked, but secrets were still leaked because models could be read and retold.
Anthropic should also take care of "who can read next".
Fable 5.1 and Opus 5.5 introduced preserved thinking to test API accounts created on or after August 31.
The previous one was passive, and the original protected reasoning could not be repeated as usual.
In Sonnet 5.5, reasoning also recognizes the organization and can only be used by the organization that initially made the request.
These checks put the plug-in cards on different links. Getting a bunch of bills is not the same as getting a bunch of classmates who can take the plug-in assignments.
Teacher attempted to steal, school fees deductedNot only that, but it's also getting more and more expensive to keep repeated phrases on the same account.
Anthropic uses two-stage classifier screening requests to give the actual extraction records to internal and external red teams for repeat testing.
When an attacker finds a new writing code, the defense adds it to the next round of defense.
According to anthropic's assessment, the stability of the system is roughly equivalent to the defense of preventing Claude from assisting in the manufacture of biological weapons, with an error rate of less than 0.1%.
I can't believe we used this level of defense to defend the draft!
The official estimate is that the logic tokens extracted from the platform will continue to decrease after the new defense is turned on.So the attacker began to rearrange the request to have Claude change a language-switching reasoning, or plug the content into a special tag to try to bypass the check.
Officials have observed these practices and have filled in the gaps.
Repeatedly logical accounts will be constrained; continuous attempts to link accounts will be closed. Only a set of words that can deceive the model is not enough, and accounts and budgets must be saved.
Starting on September 24, Biological, Distilling Attacks and Frontline Models developed these low-misreporting categories to restore charges for interception requests.
The request was denied by the security system and paid before Claude could answer.
However, once the system recognises the wrong person and the genuine customer, it may also receive the bill.
Anthropic acknowledges that classifiers will still misinterpret normal requests, which may now be charged.
What the platform saw was an interception record, which the developers faced when they crashed:I don't know what I'm going to do.
Even if it is not blocked incorrectly, developers can adjust the system instructions, clear out the results of old tools or modify the list of tools, and the original logic block may fail.
In an official multi-round programming test, the thought intensity was at its highest, with one piece of reasoning being thrown away in each session.Output tokens will increase by 20.1%.。
The anti-theft measures have been stepped up, but for developers, it's important to keep in mind that even collecting conversational records will not allow the model to be restarted...
In theory, Anthropic is still willing to let Claude work for you.
But once you want it to teach you an alternative, the teacher, who charges you a token, is ready to send you a sealing notice and a bill.
RoboInd editorial channelResearch, robotics companies and market intelligence for cross-border sourcing.Explore the channel ↗
Share this
End of editorialExplore more from Global Robotics News ↗