Anthropic said new anti-distillation measures deployed in Claude Fable 5.1 and Claude Opus 5.5 have reduced the volume of data extracted by illicit distillers by roughly 90 to 99 percent, according to a blog post published on October 121.
Distillation attacks are covert, industrial-scale campaigns that extract a frontier model's capabilities and replicate them in a second model without the original developer's authorization. Anthropic said the attacks are "often conducted using networks of fraudulent accounts" and allow companies to "mimic frontier capabilities for a fraction of the development time and cost".
Anthropic identified two concerns driving its response. First, distilled models can approach the capability frontier but ship without proportionally robust safeguards, creating risk in domains such as biology and cybersecurity. Second, as Anthropic wrote in September, the method "has been used extensively to help overseas AI laboratories keep pace with US companies".
The company named Zhipu specifically, stating that the Chinese lab distilled the cyber capabilities of leading U.S. models during development of GLM-5.3. Zhipu attempted to distill Claude Fable 5 but, after finding that Anthropic's cyber safeguards degraded its attacks, switched to an older Claude model and another lab's model.
Anthropic characterized the results as "early evidence," noting that the new methods have reduced the amount of data harvested by distillers by "around 90 to 99 percent". The company cited preserved thinking, a feature present in Claude Fable 5.1 and Claude Opus 5.5, as one of the techniques contributing to the defense.
ANALYSIS The disclosure arrives during a week in which frontier labs endorsed mandatory regulation before British lawmakers and scientists called for an international body to police AI containment failures[1]. Anthropic's public naming of Zhipu and its quantified defense claims add a concrete, technical dimension to the broader push for enforceable safeguards around frontier model security.