Anthropic Cuts Claude Data Leakage for Distillation by 10–100x

Anthropic says its updated anti-distillation defenses have produced a measurable result. By the company's estimate, the amount of data competitors can pull from Claude to train their own models has dropped by 10–100x. The new mechanisms also helped find and block tens of thousands of accounts linked to such extraction attempts.

The numbers are impressive, but they are Anthropic's own claim. The announcement does not describe how the figures were calculated or give baseline volumes. The "10–100x" spread is telling, too: either the company has no precise figure, or it does not want to state one.

What is distillation and why is it contentious?

Distillation is a way to train a smaller or newer model on the outputs of a stronger one. A developer sends the "teacher" a huge number of queries, collects the responses, and uses them as a training set. The method is legal and widely used inside companies, which rely on it to build compact versions of their own models. The conflict arises when the "teacher" is someone else's closed model and the terms of service expressly forbid this.

Anthropic has such a ban: Claude may not be used to build competing products, including training other models. The company has previously restricted access for certain competitors and for entities from jurisdictions it considers risky. Distillation remains a sore point for the whole industry: other labs have also voiced similar suspicions about their competitors.

What is known about the new measures?

Anthropic does not disclose the specific mechanisms, which makes sense. A detailed description of the detectors would help the people who are evading them. The statement indicates only that the defense works on two levels: it limits the usefulness of extracted data, and it flags suspicious usage patterns that lead to account blocks.

Key figures from the statement:

• reduction in the volume of extractable data: 10–100x;
• blocked accounts: tens of thousands;
• target of the defense: mass automated queries to Claude, whose responses are used to assemble training sets;
• independent verification: none; the assessment comes from the company itself.

The scale of the blocks suggests that the extraction was not a handful of one-off experiments but ran through networks of accounts. A single account with strict limits cannot collect much, so such schemes spread the load across many profiles. If Anthropic has learned to link those accounts together, that matters more than the figure of tens of thousands.

Where are the weak points?

First, the defense is reactive by definition. Those extracting data adapt to the detectors: they change request frequency, prompt style, and access sources. The claimed 10–100x drop describes the current moment, not a permanent state.

Second, false positives are possible. Any behavioral filter risks catching legitimate customers, for example teams that generate synthetic data for their own tasks within the terms of service. Anthropic does not say how many good-faith accounts were affected, or whether any were.

Third, the effect is hard to verify from the outside. An outside observer can see neither the real volume of attempts nor how much data still leaked through.

What should teams working with the API do?

If you build a product on Claude, check in advance whether your use case falls under the ban on training competing models. This applies especially to generating large synthetic datasets. Spread your load through official rate limits and enterprise plans rather than a scatter of accounts: that is exactly the pattern that now looks suspicious. Keep usage logs and a support contact on hand in case of an erroneous block. Those choosing a model provider should keep in mind that closed labs will keep tightening restrictions on bulk output extraction, which means API access terms will continue to change.