Anthropic Shields Claude from Attacks, Cuts Data Theft by 99%
Anthropic introduces advanced security to stop distillation attacks, preventing unauthorized entities from stealing Claude's reasoning capabilities.
In a major move to protect its intellectual property, AI research powerhouse Anthropic has launched advanced security measures to combat distillation attacks targeting its Claude models. The company reported that these new defenses have already led to an estimated 90 to 99 per cent drop in data harvested by unauthorized entities.
Distillation attacks are described by Anthropic as covert, industrial-scale operations designed to siphon the proprietary reasoning capabilities of high-end frontier models. These stolen capabilities are then used to train competitor models without the permission of the original developers, allowing companies to mimic advanced AI functions at a fraction of the usual cost and time.
The Hidden Danger of Model Distillation
The risks associated with these attacks extend far beyond simple corporate espionage. Anthropic warns that distilled models often circulate without the necessary safety guardrails, posing significant biosecurity, cybersecurity, and national security risks. When a smaller, less-regulated model mimics a sophisticated one, it can be exploited for malicious purposes by bad actors.
The company highlighted several alarming instances of such activity:
- Cyber Capabilities: The report cited Chinese laboratory Zhipu, which allegedly extracted cyber capabilities from leading American models to develop GLM-5.3. This model was assessed by US experts as the most cyber-capable open-weights model to date, capable of constructing end-to-end exploits.
- Military Inquiries: Anthropic noted instances where queries to Moonshot’s Kimi models were actually routed to Claude. One such inquiry was reportedly linked to China’s People’s Liberation Army, seeking analysis regarding closed-circuit television surveillance.
Protecting the "Thinking Process"
To combat these threats, Anthropic has focused its technical defenses on shielding Claude’s internal reasoning transcripts. While most users only see the final text output, "distillers" are most interested in the thinking process—the internal reasoning Claude writes out before providing a response.
The company's new defensive framework operates across three primary fronts:
- Data Movement Control: Monitoring and controlling how reasoning data moves across different accounts to prevent large-scale harvesting.
- Two-Stage Classifier: Deploying a specialized classifier designed to block extraction attempts. This system boasts a false-positive rate of less than 0.1 per cent, a level of precision comparable to defenses used against bioweapons.
- Abuser Restriction: Implementing strict penalties for persistent abusers, including account bans, usage caps, and requiring billing for blocked queries.
Sacrificing Revenue for Security
Implementing these rigorous safeguards has not come without a cost. Anthropic acknowledged that by turning away malicious networks, the company has intentionally forfeited significant revenue and trillions of tokens in traffic. Despite the commercial trade-offs, the company maintains that protecting the integrity of its models is paramount.
Anthropic concluded by emphasizing that the fight against unauthorized extraction cannot be won alone; it requires widespread collaboration across the entire industry, including model creators and cloud inference platforms.