Detecting and preventing distillation attacks

Summary

Anthropic reports identifying industrial-scale distillation campaigns by DeepSeek, Moonshot, and MiniMax that generated more than 16 million Claude exchanges through approximately 24,000 fraudulent accounts. The campaigns used proxy services and coordinated account networks to extract agentic reasoning, tool use, coding, computer-use, and other capabilities, including chain-of-thought data and reinforcement-learning tasks. Anthropic attributed the operations with high confidence using IP correlation, request metadata, infrastructure indicators, and partner corroboration, while describing hydra cluster architectures that replace banned accounts and obscure patterns. The response combines classifiers, behavioral fingerprinting, coordinated-activity detection, intelligence sharing, stronger account verification, and product, API, and model-level countermeasures. The report argues illicitly distilled models may strip safeguards and undermine export controls, and says coordinated action across AI labs, cloud providers, and policymakers is required.

Takeaways

1. 1

   DeepSeek generated over 150,000 exchanges, Moonshot AI over 3.4 million, and MiniMax over 13 million; the campaigns targeted capabilities including reasoning, tool use, coding, computer-use agents, and orchestration.

2. 2

   Proxy services used hydra cluster architectures with large networks of fraudulent accounts, distributing traffic across Anthropic’s API and third-party cloud platforms; one network managed more than 20,000 accounts simultaneously.

3. 3

   Anthropic detected chain-of-thought elicitation and coordinated activity as distillation signals, and is developing safeguards intended to reduce illicit distillation effectiveness without degrading legitimate customer use.