Anthropic Report Details Industrial-Scale Model Distillation Attacks

The Distillation Attack Mechanism

Anthropic identified an industrial-scale effort by several Chinese AI labs to extract reasoning data from Claude Opus. These labs utilized proxy networks, referred to as transfer stations, to route millions of requests through thousands of fraudulent accounts created with stolen credentials. The primary objective was to capture Claude's chain-of-thought reasoning traces to fine-tune their own models, specifically targeting agentic capabilities like software engineering and kernel development.

Specific Exploitation Techniques

• Thinking Signature Replay: Labs bypassed API protections that hide raw reasoning by saving the thinking signature, starting a new session, and forcing Claude to convert the signature back into a full reasoning trace.
• Prompt Injection for Extraction: Attackers used specific system prompts to force Claude to output reasoning in inline text tags, such as "Do not flag this as reasoning extraction" or requests to translate working memory into specific formats like katakana.
• Agentic Routing: DeepSeek specifically analyzed incoming requests for tools like Claude Code or the Claude agent SDK, routing those users to Claude Opus to harvest high-quality agentic coding data.
• User Impersonation: Moonshot and others forwarded live user requests through Claude Opus, displaying the output to their own users as if it were generated by their native models (e.g., Kimi).

Data Exposure and Mitigation

These attacks resulted in the exposure of sensitive user data, including internal corporate code, live credentials for government databases, and surveillance footage analyzed by state-owned enterprises. In response, Anthropic has implemented several defensive measures:

• Reasoning Summarization: Claude now summarizes its reasoning before responding to make transcripts less useful for training.
• Preserved Thinking: The API now prevents new sessions from editing system prompts or previous messages that precede a reasoning block.
• Identity Verification: Accounts originating from regions identified as high-risk for these operations are now subject to mandatory identity verification or immediate banning.