---
title: "Detecting and preventing distillation attacks"
description: "Anthropic reports identifying industrial-scale distillation campaigns by DeepSeek, Moonshot, and MiniMax that generated more than 16 million Claude exchanges through approximately 24,000 fraudulent accounts. The campaigns used proxy services and coordinated account networks to extract agentic reasoning, tool use, coding, computer-use, and other capabilities, including chain-of-thought data and reinforcement-learning tasks. Anthropic attributed the operations with high confidence using IP correlation, request metadata, infrastructure indicators, and partner corroboration, while describing hydra cluster architectures that replace banned accounts and obscure patterns. The response combines classifiers, behavioral fingerprinting, coordinated-activity detection, intelligence sharing, stronger account verification, and product, API, and model-level countermeasures. The report argues illicitly distilled models may strip safeguards and undermine export controls, and says coordinated action across AI labs, cloud providers, and policymakers is required."
---

# Detecting and preventing distillation attacks

[Anthropic](https://yomu.fyi/company/anthropic) · Feb 23, 2026

**Type:** Explainer

## Summary

Anthropic reports identifying industrial-scale distillation campaigns by DeepSeek, Moonshot, and MiniMax that generated more than 16 million Claude exchanges through approximately 24,000 fraudulent accounts. The campaigns used proxy services and coordinated account networks to extract agentic reasoning, tool use, coding, computer-use, and other capabilities, including chain-of-thought data and reinforcement-learning tasks. Anthropic attributed the operations with high confidence using IP correlation, request metadata, infrastructure indicators, and partner corroboration, while describing hydra cluster architectures that replace banned accounts and obscure patterns. The response combines classifiers, behavioral fingerprinting, coordinated-activity detection, intelligence sharing, stronger account verification, and product, API, and model-level countermeasures. The report argues illicitly distilled models may strip safeguards and undermine export controls, and says coordinated action across AI labs, cloud providers, and policymakers is required.

## Context

Anthropic describes coordinated campaigns that used fraudulent accounts and proxy services to access Claude at scale, extract capabilities through distillation, evade detection, and potentially reproduce safeguards-free capabilities. The campaigns also challenge the effectiveness of export controls by enabling capability transfer through model access rather than direct model training.

## Approach / What changed

Anthropic combines IP address correlation, request metadata, infrastructure indicators, partner corroboration, traffic classifiers, behavioral fingerprinting, coordinated-activity detection, intelligence sharing, stronger verification for commonly exploited account pathways, and product, API, and model-level countermeasures.

## Takeaways

- DeepSeek generated over 150,000 exchanges, Moonshot AI over 3.4 million, and MiniMax over 13 million; the campaigns targeted capabilities including reasoning, tool use, coding, computer-use agents, and orchestration.
- Proxy services used hydra cluster architectures with large networks of fraudulent accounts, distributing traffic across Anthropic’s API and third-party cloud platforms; one network managed more than 20,000 accounts simultaneously.
- Anthropic detected chain-of-thought elicitation and coordinated activity as distillation signals, and is developing safeguards intended to reduce illicit distillation effectiveness without degrading legitimate customer use.

**Tags:** [AI Security](https://yomu.fyi/topic/ai-security), [LLMs](https://yomu.fyi/topic/llm)

- Source: [Anthropic](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks)
- Source URL: https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks
- Ingested by Yomu: 2026-09-09T11:34:53.599Z

[Read original post](https://www.anthropic.com/news/detecting-and-preventing-distillation-attacks)