Anthropic Reports Results and Side Effects of Its Distillation Defenses - Pre-Output Refusals in bio, frontier_llm, and reasoning_extraction Are Billed

In a research post dated October 12, 2026, titled “Strengthening our defenses against distillation attacks,” Anthropic described its countermeasures against distillation and what they have achieved ¹. By the company’s own estimate, once a new classifier went in, the volume of Claude reasoning tokens that distillers managed to pull from its platform dropped to somewhere between one-tenth and one-hundredth of the prior level.

For teams building on the API, the more consequential part is the list of side effects Anthropic itself gives near the end. Preserved thinking forced some developers to rework their integrations. The classifiers can misjudge harmless requests and block them, in under 0.1% of cases. And blocked requests now cost money ¹. That billing change predates the research post: it was announced in the release notes on September 24 ³.

Which refusals are billed: bio, frontier_llm, reasoning_extraction

Claude Fable 5.1, Fable 5, Opus 5.5, Opus 5, Sonnet 5.5, and Haiku 5.5 ship with safety classifiers. When one of them turns a request down, the API does not raise an error. It sends back an ordinary HTTP 200 response with stop_reason: "refusal", and stop_details.category identifies the policy area involved ².

As of the official documentation checked on October 14, 2026, whether a refusal issued before any output is charged depends on that category:

stop_details.category	What it covers (summary)	Charged when refused before output
bio	Requests that could lead to biological harm (legitimate life-sciences work can also set it off)	Yes
frontier_llm	Help with building competing AI models (harmless ML work can also set it off)	Yes
reasoning_extraction	Requests that the model’s hidden reasoning appear in the reply text	Yes
cyber	Requests that could lead to cyber harm	No
general_harms	Usage-policy areas outside the four categories above	No
null	Refusals with no named category attached	No

A charged refusal is priced at the rates of whichever model handled it, the same as a normal request. The content field comes back empty, but usage still reports token counts, and the request still uses up rate-limit capacity. Refusals that happen mid-stream bill the input tokens plus whatever output had already streamed, at standard rates; those were being charged before September 24 as well.

The rules are not limited to the Claude API. The documentation applies the same billing to every platform, naming Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry.

Fallback is the easy part to miss. If declined requests are rerun on a different model, and the triggering refusal either falls in a charged category or stopped mid-stream, you pay for that refusal and for the fallback request.

Billing stopped in June, then restored for three categories on September 24

Going back through the release notes, Anthropic had decided on June 2, 2026 that requests refused on the Claude API before Claude produced any output would not be charged ³. The September 24 entry describes the new policy as a resumption, limited to bio, frontier_llm, and reasoning_extraction, which the company says are the categories where it measures few false positives. Pre-output refusals in all other categories stay free, and fallback credit was left as it was.

The research post frames this billing as one of its anti-distillation measures. Users who keep trying to extract reasoning face tighter usage limits, and persistent offenders lose their accounts. Alongside those steps, the post says, Anthropic started charging again on September 24 for requests its safeguards block before Claude answers, in specific areas (distillation among them) where the false positive rate is below 0.1% ¹.

The documentation, by contrast, only says these are the categories with low false-positive volumes as of September 2026, without giving a 0.1% figure. It also warns that the list of charged categories is not fixed and could shift as the company keeps measuring and adjusting ². The sub-0.1% number should therefore be read as Anthropic’s own claim in the research post.

Prompts that trigger reasoning_extraction

For reasoning_extraction, the documentation spells out which prompts tend to cause it and how to fix them. In its account, this refusal usually comes from prompts asking the model to emit its thinking in the output, whether word for word or in a set format. Examples it lists include a <thinking> or scratchpad block the model fills before answering, and fields such as reasoning, thinking, or trace in JSON output or tool input. Such instructions may live not only in the system prompt but also in skills or tool descriptions, and the page asks developers to check those as well ².

Asking for a brief explanation of an answer, the supporting evidence, or a recap of actions taken remains fine. To inspect how the model reasoned, the documentation points to setting display: "summarized" and reading the thinking blocks. Because no fallback model is recommended for this category, it advises editing the prompt instead of retrying.

The newer techniques that the research post says Anthropic has shut down are of the same kind: asking Claude to restate its prior reasoning in a different language, or to wrap that reasoning in tags beside the answer ¹. A design that has the model put its reasoning in tags within the output text likely looks the same as a distillation technique even when the intent is benign, so existing integrations that do this are worth reviewing.

Three lines of defense, and the results Anthropic reports

Distillation means training a smaller model on the outputs of a more capable one, and the technique itself is widely used (see our explainer on model distillation and quantization). What Anthropic is targeting are industrial-scale campaigns that copy capabilities without permission, often run through networks of fake accounts; our coverage of the September threat report details how they operated. According to the research post, nearly all of the defensive effort goes into keeping the reasoning Claude writes before answering out of distillers’ hands ¹.

One of the early measures was summarizing that reasoning. In the company’s test, a model trained on Claude Opus 4.8 transcripts scored 80.4% on SWE-bench Verified with full reasoning and 71.8% with summaries only. Distillers then moved to coaxing the full reasoning out despite summarization, and the post lays out three lines of defense in response.

The first restricts where reasoning can travel. With Fable 5.1 and Opus 5.5, Anthropic introduced preserved thinking, which stops new API accounts from altering Claude’s earlier context ¹. As covered in our Opus 5.5 article, this applies to accounts created from August 31, 2026 onward. Anthropic also made these models’ reasoning unreadable by older models with weaker protections. With Sonnet 5.5, thinking blocks are usable solely by the originating account or one linked to it ³.

The second is a two-stage classifier. Anthropic says it used records of distillers’ extraction attempts for internal and external red-teaming and patched the gaps found. It describes the classifier as about as hard to get around as the safeguards against bioweapons assistance, with a false positive rate below 0.1% ¹. It runs on the models the company calls its most capable generally available ones: Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. The third line is the deterrence of repeated attempts already described: usage limits, account bans, and billing.

On results, Anthropic estimates that after the classifier launched, reasoning tokens taken by distillers on its platform stayed at one-tenth to one-hundredth of the earlier level, and on some days were too few to measure. It says it banned tens of thousands of distillation-linked accounts, in many cases within two hours of a campaign starting. For its top generally available models, it says the classifier now catches every technique described in the September report. All of these are the company’s own estimates rather than independent findings, and the post adds that it cannot say how long the gains will hold and that it has not yet faced a highly sophisticated, persistent effort to get around them.

What to check in cost estimates and integrations

Back in February, Anthropic set the goal of making distillation harder without degrading the experience of legitimate users. The new post concedes that goal has not been fully met, citing three things: integration changes, wrongful blocks in under 0.1% of cases, and charges for blocked requests ¹. Put differently, the company itself assumes that some of the refusals it bills will be false positives.

If you use Claude for machine-learning R&D or life-sciences work, the documentation itself warns that frontier_llm and bio refusals can fire on harmless tasks ². Since refusals now count toward both your bill and your rate limits, logging stop_details.category and usage for every response whose stop_reason is refusal lets you see how often charged-category refusals occur and catch estimate drift early. The documentation also recommends branching on stop_reason rather than on content.

When a charged-category refusal triggers a fallback that actually runs, two charges result. If you run Fable 5.1 or Opus 5.5, the models covered by preserved thinking, from a new account, confirm that your integration no longer rewrites Claude’s earlier context partway through a conversation. And because the charged categories may change, check the table in the documentation as it stands whenever you build an estimate on it.

Sources

1. Strengthening our defenses against distillation attacks - Anthropic (October 12, 2026)
2. Refusals and fallback - Claude Platform documentation (“How refusals are billed” section, checked October 14, 2026)
3. Claude Platform release notes - Anthropic (September 24, 2026 entry and others)