Distillation attacks are industrial-scale campaigns that copy a model's internal reasoning and replicate it in other models, often through networks of fraudulent accounts, enabling frontier-like performance without authorization.

Anthropic warns that distilled models can reach frontier capabilities without equivalent safeguards, risking biology, cybersecurity, and national security contexts.

Distillation is the illicit replication of a model's capabilities by training a smaller model on another model's outputs, often facilitated by fraudulent accounts, threatening safety safeguards and national security.

Anthropic notes trade-offs include developer integration changes, occasional blocking of benign requests, and charges for blocked requests.

Additional trade-offs involve potential revenue losses and diverted traffic as the company sacrifices some revenue and trillions of tokens of paying traffic.

As of late September, there are resumed charges for blocked requests in protected categories and ongoing revenue considerations tied to distillation defenses.

Safeguards tighten access to Claude's internal reasoning, restrict manipulation of conversation histories, and limit exposure of protected reasoning, while introducing reasoning summaries to reduce repeatable information.

Early defenses use reasoning transcripts and then restrict access to transcripts, aiming to prevent newer models from reading older model reasoning.

The discussion draws on Anthropic blog posts and internal/external red-teaming, reflecting ongoing evolution of defenses in a broad security context.

Z.AI did not respond to Reuters when asked for comment.

Z.AI declined to comment when contacted.

Z.AI did not respond to requests for comment.