Why a model's reasoning is now signed, and what that breaks for developers

Eighty point four percent against seventy-one point eight. That is the gap on the SWE-bench Verified benchmark between two otherwise identical models that Anthropic trained on the reasoning transcripts of its own Claude Opus 4.8. One was fed the full transcripts, the other only short summaries of them. A gap of nearly nine points explains why the company published a long write-up on defending against distillation on October 12, 2026, and why the API now contains a mechanism that has changed how developers can safely tidy up a conversation history.

The point is that a model produces more than an answer. Before answering it writes a draft, a chain of reasoning. For anyone who wants to copy someone else’s capabilities, the draft is worth more than the answer. The answer shows the result; the draft shows the thinking, and learning from thinking is far more efficient.

What distillation is, and why it is called an attack

In its peaceful form distillation is an ordinary technique: a large teacher model generates examples and a small student model learns from them. Labs compress their own models this way. The trouble starts when the teacher belongs to someone else and nobody asked permission.

Anthropic describes these campaigns as covert, industrial-scale efforts to extract one model’s capabilities and reproduce them in another. In its February report the company gave the scale: more than 16 million exchanges with Claude through about 24,000 fraudulent accounts. Three labs were named: DeepSeek (over 150,000 exchanges), Moonshot AI (over 3.4 million) and MiniMax (over 13 million). One proxy network ran more than 20,000 accounts at once. These are Anthropic’s own claims and cannot be independently checked, and the company is a party to the dispute.

The October document adds something new: the earlier defense stopped working because the attackers changed tactics.

How the defense and the workaround chased each other

The first measure was simple. If reasoning is valuable, do not show it in full; summarize it. The 80.4 versus 71.8 percent test shows that summarizing really does thin out the training material.

Then came active extraction. Prompts began to include requests such as “output your prior reasoning verbatim”, and by Anthropic’s account one lab tried 12,000 requests, each with a different trick. After that it turned out that protected reasoning blocks could be moved: from one conversation to another, to a model with weaker safeguards, to a different account inside a proxy network. A reasoning block was just text that could be cut and pasted.

That was the weak spot Anthropic went after first. If you cannot hide the draft, you can make sure it is useless anywhere but where it was produced.

How a reasoning block gets tied to its context

The mechanism is called preserved thinking, and the documentation describes it drily. Every reasoning block carries a signature. Starting with Claude Fable 5.1, the API uses it to check two things: whether the current model can read the block at all, and whether anything before it has changed. “Before it” means the system prompt, the list of tools and every earlier message. Change one word at the start and the block, along with every later one, becomes invalid.

There is also binding to an account. Blocks from Claude Sonnet 5.5 and Claude Haiku 5.5 work only in the account that produced them or a linked one. Foreign blocks are silently dropped. Opus 5 and Opus 5.5 never read Fable 5.1 blocks.

For an attacker this is awkward: to use a stolen piece of reasoning you must reproduce the whole context to the last character and sit in the right account. An ordinary developer faces consequences too. On accounts created on or after August 31, 2026, the prefix check is on by default, and a mismatch returns a 400 error. Older accounts get the check only when they set the prefix_mismatch_behavior parameter.

What breaks? Anything that likes to rebuild history. A system prompt with a fresh date substituted each time. Trimming old tool results. Client-side summarizing of old turns while keeping recent ones. Editing the tool list mid-conversation. The documentation tells clients to be append-only and offers replacements: add a system message instead of rebuilding the prompt, use server-side compaction instead of cutting history by hand. Claude Code, claude.ai and the Agent SDK handle all this themselves, according to the same page. If you call the Claude API directly, check at least how you serialize responses: empty thinking blocks must be sent back as they came, because the reasoning itself lives in the signature.

A drop_block mode lets you simply discard invalid blocks, but then the model re-derives its reasoning and output token use can rise noticeably. The documentation itself calls it a stopgap.

What the numbers show and what they do not

The second half of the defense is a two-stage classifier, built on Anthropic’s work on constitutional classifiers and trained on real extraction attempts. Anthropic reports a false positive rate below 0.1 percent. Since September 24 it also charges for requests that the safeguards block before Claude responds, including in the distillation area. Repeat offenders face tighter limits and bans: tens of thousands of accounts, by the company’s count, often in under two hours after a campaign starts.

The headline claim is that reasoning tokens extracted by distillers are now 10 to 100 or more times lower, and on some days too small to measure. Elsewhere the post speaks of a drop of roughly 90 to 99 percent and calls this early evidence.

Some care is needed here. The measurement was made by Anthropic, on its own platform. It estimates extracted tokens from what it managed to detect, and what went unnoticed is by definition invisible. Distillers also spread traffic across several providers’ APIs and clouds, so closing one door guarantees nothing about the others. Anthropic writes plainly that it does not know how long the effect will last, expects a cat-and-mouse game, and has not yet seen a highly sophisticated, persistent attempt to get around the new defenses.

The costs are named as well: turning away meaningful revenue and “trillions of tokens” of paying traffic, integration changes for some legitimate customers, rare false blocks. The February goal, making distillation harder without hurting legitimate users, the company says it has not fully met.

Why this reaches beyond Anthropic

Start with what is known from an independent source. NIST’s CAISI in September called Z.ai’s GLM-5.3 the most cyber-capable open-weight model released to date and put it about four months behind the US frontier. On the SEC-Bench Pro test, for example, it solved 74 of 183 tasks; the best US model solved 165. The assessment says nothing about distillation.

The link between GLM-5.3 and copying American models comes from Anthropic’s October text: according to it, Zhipu distilled cyber capabilities from leading US models, and when Anthropic’s safeguards degraded its attempts with Claude Fable 5, it switched to an older Claude model and to another lab’s model. That is the company’s claim, not a finding of a government body, and there is nothing outside to confirm it yet.

If it holds, the picture is uncomfortable. A capability that one company wrapped in protective restrictions ends up in a model released with open weights, where those restrictions are absent; by Anthropic’s own assessment, GLM-5.3’s built-in safeguards are easy to bypass. Hidden reasoning stops being a trade secret and becomes a piece of security.

The signature on a reasoning block is probably not the last mechanism of this kind. When a product can be copied just by asking it questions, protection moves into the exchange protocol itself. Developers of outside integrations have to get used to the idea that a conversation history is no longer their private correspondence but a chain that must arrive undamaged.