There's a quieter arms race happening underneath the usual AI headlines, and it isn't about who built the smartest model - it's about who's copying whose smartest model, and how. "Distillation" is the practice of training a cheaper model on a frontier model's outputs to inherit much of its capability at a fraction of the cost, and the single most valuable thing to steal isn't a model's final answer - it's the hidden reasoning it did to get there. On October 12, 2026, Anthropic published results from a months-long effort to stop exactly that, and the numbers are specific enough to actually evaluate: data harvested by distillers reportedly down 90 to 99%, reasoning-token extraction down by a factor of 10 to 100 or more.
This matters beyond Anthropic's own balance sheet. If frontier labs can meaningfully choke off cheap distillation of their best models, it slows down exactly the kind of fast, cheap catch-up that's defined a lot of this year's open-model story. Here's what Anthropic actually built, what the numbers really mean, and why "hidden reasoning" turned out to be the thing worth protecting.
Quick summary: Anthropic says its new anti-distillation defenses - centered on a feature called "preserved thinking" - have cut the amount of usable data distillers can harvest from Claude by roughly 90 to 99%, and cut reasoning-token extraction specifically by a factor of 10 to 100-plus. Preserved thinking, introduced with Claude Fable 5.1 and Opus 5.5, blocks new API accounts (created on or after August 31, 2026) from editing the context around a thinking block in a multi-turn conversation - the API now checks that a returned thinking block came back with the exact same system prompt, tools, and messages that produced it, closing off a common extraction technique. A broader two-stage detection classifier covers Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, with a false-positive rate under 0.1%. Anthropic says it now bans tens of thousands of accounts tied to distillation campaigns, often within two hours of a distillation campaign beginning, and has been charging for blocked requests in high-confidence cases like this since September 24, 2026.
Why reasoning tokens are the actual prize
The intuitive version of "copying" an AI model is scraping its final answers and training a new model to imitate them. That works, but it's an inefficient way to copy capability - a final answer compresses away most of the useful signal about how the model got there. Reasoning models like Claude's thinking-enabled variants produce an extended internal reasoning trace before the final answer, and Anthropic's own numbers show just how much more that trace is worth to a would-be copier: a model distilled from Claude's full reasoning transcripts scored 80.4% on SWE-bench Verified, a real coding benchmark, versus only 71.8% when distilled from summarized reasoning alone. That roughly nine-point gap, on a single benchmark, is the entire business case for why distillers specifically target raw chain-of-thought rather than just final outputs.
How "preserved thinking" actually closes the loophole
The extraction technique preserved thinking is built to block is subtler than simple scraping. In a normal multi-turn conversation, a thinking block produced in one turn can, in some API usage patterns, be resent or lightly modified as context for a later turn - and a determined distiller can exploit that flexibility to coax out more of a model's raw reasoning than a single response would normally expose, sometimes by relaying requests through proxy accounts to disguise the pattern. Preserved thinking shuts that down for any API account created from August 31, 2026 onward: the API now verifies that a thinking block sent back as context matches, exactly, the system prompt, tools, and message history that produced it in the first place. Tamper with any of that, and the thinking block is rejected rather than reused.
Layered on top of preserved thinking is a two-stage classifier - one stage flags suspicious usage patterns, a second confirms them - running across Claude Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1, with a false-positive rate Anthropic puts below 0.1%. That low false-positive rate is the detail that makes the whole system practical: a distillation filter that frequently misfires on legitimate heavy users would be worse than useless, so the low error rate is arguably as important as the headline 90-99% harvest reduction.
| Defense Layer | What It Does | Coverage |
|---|---|---|
| Preserved thinking | Rejects a returned thinking block if its surrounding context (system prompt, tools, messages) was altered since it was produced | Claude Fable 5.1, Opus 5.5 (new API accounts from Aug 31, 2026) |
| Two-stage classifier | Flags, then confirms, suspicious extraction usage patterns (false-positive rate under 0.1%) | Sonnet 5.5, Opus 5 & 5.5, Fable 5 & 5.1 |
| Account enforcement | Bans accounts tied to detected distillation campaigns, often within 2 hours | All Claude API accounts |
If you build on the Claude API and have ever had a request blocked or rate-limited unexpectedly, this is worth knowing: Anthropic has been charging for requests blocked under high-confidence safeguards like this one since September 24, 2026, rather than simply rejecting them for free - a detail easy to miss in billing if you weren't watching for it.
The enforcement side: banning accounts fast
Detection without fast enforcement just tells you the barn door is open. Anthropic says it's now banning tens of thousands of accounts associated with distillation activity, often within two hours of a campaign beginning - fast enough, in theory, to cap how much reasoning data any single compromised or malicious account can extract before being cut off, rather than letting a slow investigation process run for days while extraction continues.
What this actually changes for the rest of the industry
Distillation has been one of the quiet forces behind this year's dramatic price drops across the industry - when a well-resourced lab can train a cheaper model that imitates a chunk of a frontier model's behavior, the frontier lab's pricing power erodes faster than its own R&D cycle would otherwise allow. If Anthropic's 90-99% harvest reduction holds up as other labs test their own exposure, it's a signal that the era of near-costless distillation off the biggest labs' reasoning models may be narrowing - though it's worth noting plainly that these are Anthropic's own self-reported figures about defenses protecting Anthropic's own models, not an independent audit, and other labs haven't published comparable numbers for their own systems.
- Developers building on the Claude API who rely on multi-turn conversations with thinking blocks - functionally, nothing changes for legitimate use, since preserved thinking only blocks modified, inconsistent context.
- Competing labs and open-model developers who have used distillation from frontier reasoning models as a fast, cheap way to catch up - this specifically targets that pathway, not competitors building from scratch.
- Anyone tracking why AI prices have fallen so fast this year - distillation-resistant reasoning is one of the few forces that could slow that trend for the labs able to defend it.
01What is AI model distillation?
It's training a smaller, cheaper model to imitate a larger frontier model's outputs - including, where possible, its internal reasoning steps - so the smaller model inherits much of the larger one's capability without the cost of training it from scratch. It's a legitimate technique labs use on their own models, but it becomes a security problem when outsiders use it to copy a rival's model without permission.
02What exactly is "preserved thinking"?
A safeguard Anthropic introduced with Claude Fable 5.1 and Opus 5.5 that stops new API accounts (created on or after August 31, 2026) from altering the context around a model's internal thinking block in a multi-turn conversation. The API now checks that a thinking block is returned with the exact system prompt, tools, and messages that produced it - blocking a common way outsiders tried to extract extra reasoning data.
03Does this actually cut AI copying by 99%?
That's Anthropic's own reported figure for the reduction in data distillers can harvest, with reasoning-token extraction specifically down by a factor of 10 to 100-plus. It's a self-reported number from the company whose models the defense protects, not an independently audited one, though the underlying mechanism (verifying thinking-block context hasn't been altered) is publicly documented and technically specific enough to evaluate.
04Will this affect normal developers using the Claude API?
Not for standard usage. Preserved thinking only rejects a thinking block when the surrounding context has been changed from what originally produced it - a pattern normal multi-turn conversations don't trigger. Anthropic also reports a false-positive rate under 0.1% for its broader detection classifier.
The real takeaway here isn't just about Anthropic's security engineering - it's that the biggest labs are now treating a model's reasoning process itself as the asset worth defending, not just the final answer. If you want to actually see how Claude's reasoning compares with GPT-6, Gemini, or Grok on a problem you care about, LumiChats lets you run the same prompt across 40+ models from one subscription, so you can judge the real difference in how they think, not just what they say.
