Anthropic details distillation defenses that affect API integrations and blocked-request billing
Anthropic says its defenses against large-scale extraction of Claude’s reasoning have changed some API integration requirements, while mistaken blocks can still result in charges. Official documentation distinguishes handling old thinking blocks from billing for safety-blocked requests.
On October 12, Anthropic detailed defenses already in place against extracting Claude’s internal reasoning at scale to train other models. The company acknowledged that some legitimate developers have had to change their integrations, and that a small share of benign requests can be mistakenly blocked and charged. The report’s publication date is not the start date of these measures.
Preserved thinking requires integrations that send earlier thinking blocks back to keep the preceding system prompt, tool definitions and message history unchanged. The official documentation lists prefix checks for Claude Fable 5.1, Opus 5.5, Sonnet 5.5 and Haiku 5.5. Enforcement is on by default for accounts created from August 31, 2026, at 00:00 UTC; older accounts opt in through a request setting. The same new-account cutoff applies on cloud platforms.
Integrations need a compatibility check if they rewrite system prompts, shorten old tool results or compact history on the client while retaining earlier thinking blocks. The documentation recommends keeping system instructions and the tools list fixed during a session and appending to message history. No integration change is needed when Claude Code, claude.ai, Claude Managed Agents or the Claude Agent SDK builds requests, or when a custom integration already follows that append-only pattern.
For ordinary requests subject to default enforcement, changing the prefix produces a 400 error. Choosing drop_block instead discards invalid and subsequent thinking blocks so the request can proceed. Dropped blocks themselves are not billed, but regenerating reasoning can increase output tokens and response time. The Message Batches API has a different default: without an explicit error setting, it drops invalid blocks rather than failing the batch item.
Model compatibility imposes separate limits on which thinking blocks can be read: incompatible blocks are dropped rather than causing a prefix-mismatch error. The documentation also restricts thinking blocks from Sonnet 5.5 and Haiku 5.5 to the originating account or a linked account. Routing across models or accounts cannot assume that earlier reasoning remains available.
A separate billing change concerns the safety classifier, rather than discarded thinking blocks. Anthropic says that since September 24 it has resumed charging for requests blocked before Claude responds in specific areas, including distillation, where it reports a false-positive rate below 0.1%. This is not a blanket charge for every refusal; the company acknowledges that benign requests can still be blocked and charged.
Anthropic estimates that after introducing the classifier, extracted reasoning tokens on its own platform fell to roughly one-hundredth to one-tenth of their previous level. This is the company’s platform observation, not a universal security guarantee. It says the durability of those gains is unknown and that it has yet to see a highly sophisticated, persistent attempt to circumvent the defenses.
Sources
- Strengthening our defenses against distillation attacks — Anthropic
- Preserved thinking — Anthropic