News / Model Watch · Ecosystem & Policy
Anthropic Writes Anti-Distillation Into Its API — the Stated Suspect Is "Industrial Scale," and China's Answer Was Already on the Shelf
Buried in last week's Fable 5.1 launch was the most consequential API change of the year for how frontier capability spreads: new Claude API accounts can no longer edit the context around a thinking block — a lock whose only purpose is stopping distillation, which Anthropic's own launch post describes as run "on an industrial scale, using thousands of fake accounts." The New Stack's coverage states the open secret plainly: Anthropic has been vocal about suspicions that Chinese labs are distilling its models at industrial scale. Chinese coverage picked it up on Sep 5 as "cutting off the distillation escape route." Here's what actually changed, who it targets, and why the Chinese open-weight shelf makes parts of this fight look already obsolete.
The lock: new Claude API accounts (created after Aug 31, 2026 00:00 UTC) can't manually edit prior context while preserving Claude's thinking transcript; the Messages API verifies each thinking block against the exact system prompt, tools and messages that produced it, and errors on mismatch. The scope: phased — existing accounts unaffected for Fable 5.1, all users for future models. Context-compaction harnesses need rework. The package: API lock + enhanced distillation classifiers + session-transfer restrictions + a statistical watermark on all outputs; real chain-of-thought is no longer in Claude's output at all (summaries only). The China answer: DeepSeek's entire live lineup is MIT-licensed weights and GLM-5.3/Kimi K3 are downloadable — when weights are open, distillation is beside the point.
What exactly changed (from the official docs)
- The mechanism. A "thinking block" is the record of Claude's reasoning during a response. Previously, an account could hold that block fixed while rewriting everything around it — messages, tools, system prompt — across turns. That asymmetry was "a common, publicly documented distillation technique" in Anthropic's words: you could steer the frozen reasoning toward arbitrary targets and harvest capability at scale. The Messages API now validates the full tuple and rejects mismatches.
- The phasing. Enforcement hits new Claude Platform organizations, Bedrock accounts, Vertex AI projects and Azure Foundry projects created on or after Aug 31, 2026. Existing accounts are exempt for Fable 5.1 — deliberately, so compaction-style harnesses can migrate — and preserved-thinking enforcement extends to all users with future model releases.
- The stated motive. Anthropic's launch post: distillation is "often employed on an industrial scale, using thousands of fake accounts," and it's a safety risk because "distilled capabilities can subsequently be released without adequate safeguards." The New Stack adds the geopolitical subtext the company has said aloud: suspicions of Chinese labs distilling at industrial scale.
- The rest of the package. Enhanced distillation classifiers; restrictions on transferring sessions or reasoning from stronger-safeguard models to weaker ones; the statistical text watermark on everything released after Aug 2. And per an Anthropic engineer on Hacker News, true chain-of-thought no longer ships in Claude's output — users see summaries, precisely because of distillation risk.
The China angle: one channel closed, one answer already shipped
Be precise about what this stops and what it doesn't. It stops the cheap extraction channel — API-side siphoning of reasoning traces, the technique behind most "frontier capability for free" stories of the past two years. It does not stop the two paths that actually matter now. Path one: open weights make distillation irrelevant — when DeepSeek publishes its whole live lineup under MIT (V4-Flash, V4-Pro, Vision-Exp) and Zhipu ships GLM-5.3 flagship plus Flash as downloads, there is nothing to siphon; the capability transfers by git clone. Path two: self-play and synthetic loops — the reinforcement-learning-driven improvement style the Chinese labs have publicized all year doesn't route through any Western API. The uncharitable read is that Anthropic is locking a door that its competitors' openness already rendered decorative; the charitable read is that closed-model distillation was real, industrial, and worth closing regardless. Both can be true — and for API builders, the operational note is simply: check your harness against the migration guide before your next account refresh.
Primary sources
- Anthropic — Fable 5.1 & Mythos 5.1 发布页（Anti-distillation mechanisms 原文：industrial scale / thousands of fake accounts）
- Claude Support — Preserved thinking：API 校验机制、08-31 起新账户适用、分阶段执法
- The New Stack — anti-distillation 章节（含 Chinese labs 工业级蒸馏怀疑的公开表述）
- Hacker News — Anthropic 工程师确认真 CoT 已因蒸馏风险移出输出
- 中文报道：36氪（09-05）「大模型蒸馏时代结束：Fable 5.1 改写 API，彻底切断蒸馏后路」
FAQ (2026)
What's the actual API change?
New accounts (Aug 31+) can't edit prior context while preserving a thinking block; the API verifies block-vs-context consistency and errors on mismatch. Existing accounts exempt for 5.1; all users for future models.
Is it aimed at Chinese labs?
Anthropic names no lab, but has publicly voiced suspicion of industrial-scale Chinese distilling (per The New Stack), and Chinese coverage read it as exactly that. Attribution = reported suspicion, not formal finding.
Does my harness break?
Existing accounts: not yet. New accounts + future models: any context rewriting around thinking blocks (compaction, injected reminders) will error — see the migration guide.
Does it stop capability spread?
It closes the API-siphoning channel. It doesn't touch open weights (DeepSeek's MIT lineup, GLM-5.3, Kimi K3) or RL/self-play improvement loops that never touch Claude outputs.
What's in the full package?
API lock + stronger distillation classifiers + session/reasoning transfer restrictions + statistical watermarks on all post-Aug-2 outputs. True CoT is gone from outputs — summaries only.
Why it matters here?
The frontier's defensive posture is hardening (locks, watermarks, verification programs) while the Chinese shelf's posture is openness (MIT weights, published benchmarks). Builders now choose between renting a guarded capability and owning an open one.