Summary: Detecting and Preventing Distillation Attacks

Overview

Anthropic has identified industrial-scale, illicit distillation campaigns by three AI labs: DeepSeek, Moonshot AI, and MiniMax. These labs used over 24,000 fraudulent accounts to generate more than 16 million exchanges with Claude, violating terms of service and regional access restrictions.

Key Concepts

• Distillation: A legitimate training method where a smaller model learns from a larger model's outputs. Illicitly used, it allows competitors to rapidly acquire capabilities at a fraction of the development cost.
• Primary Risk: Distilled models often lack critical safety safeguards, enabling proliferation of dangerous capabilities (e.g., for bioweapons, cyber attacks) and allowing authoritarian governments to use frontier AI for offensive operations, disinformation, and surveillance.

Campaign Details and Attribution

All campaigns targeted Claude's most differentiated capabilities: agentic reasoning, tool use, and coding.

1. DeepSeek

• Scale: Over 150,000 exchanges.
• Targets: Reasoning, rubric-based grading (to create a reward model), and generating "censorship-safe" alternatives to politically sensitive queries.
• Technique: Used synchronized traffic and prompts to generate chain-of-thought training data at scale.
• Attribution: Traced via request metadata to specific researchers.

2. Moonshot AI (Kimi models)

• Scale: Over 3.4 million exchanges.
• Targets: Agentic reasoning/tool use, coding, computer-use agent development, and computer vision.
• Attribution: Request metadata matched public profiles of senior staff.

3. MiniMax

• Scale: Over 13 million exchanges.
• Targets: Agentic coding and tool use/orchestration.
• Attribution: Confirmed via metadata and infrastructure indicators; campaign was detected while active, providing visibility into the full distillation lifecycle. MiniMax pivoted traffic within 24 hours of a new Claude model release.

How Distillers Operate

• Access: Labs use commercial proxy services ("hydra cluster" architectures) with sprawling networks of fraudulent accounts to circumvent regional blocks (e.g., Anthropic's non-commercial access in China).
• Detection Evasion: Traffic is mixed with legitimate requests; when accounts are banned, new ones replace them.
• Attack Pattern: High-volume, repetitive prompts targeting narrow capabilities.

Anthropic's Response and Industry Call to Action

Defensive Measures

• Detection: Classifiers and behavioral fingerprinting for API traffic, including chain-of-thought elicitation.
• Intelligence Sharing: Technical indicators shared with other labs, cloud providers, and authorities.
• Access Controls: Strengthened verification for commonly exploited pathways (educational, security research, startup accounts).
• Countermeasures: Developing model/API safeguards to reduce output efficacy for illicit distillation.

Broader Need for Coordination

• Distillation attacks undermine export controls by allowing foreign labs to close competitive gaps without direct chip access.
• The scale of the threat requires rapid, coordinated action among industry, cloud providers, and policymakers.
• Anthropic is publishing evidence to enable a collective response.