[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"news-slug-anthropic-distillation-shields-claude-paywall-blocks":3,"topics-all":38,"news-related-acddc7d5-c389-4e90-8a7a-1001ce693395":57},{"id":4,"title":5,"summary":6,"content":7,"original_url":8,"source_id":9,"tags":10,"translations":24,"news_slug":31,"published_at":32,"created_at":33,"modified_at":34,"is_published":35,"publish_type":36,"image_url":14,"view_count":37},"acddc7d5-c389-4e90-8a7a-1001ce693395","Anthropic 反蒸馏到第三层:误拦也要收费,合法用户背成本","Anthropic 10 月 12 日公告反击蒸馏攻击,新上线的保留思维+二级分类器把 Claude 推理泄露砍掉九到九成五,GLM-5.3 等对手获推理数据难度骤升。但代价是付费请求被误拦后要收费,部分集成需要改造,这场猫鼠战还在升级。","## 一场「工业级偷数据」行动的真面目\n\n「蒸馏」本质上是一类规模化数据窃取:有人运营上万个匿名账号,把 Claude 的输出当教材,训练一个能力相近、但安全门槛更低的「学生模型」。Anthropic 在 10 月 12 日发布的官方博客里直接摊牌——自己就是这条供应链里的「受害者源头」,并明确点名智谱 GLM-5.3 的网络能力来自这条路。\n\n9 月威胁情报报告里已经讲了攻击形态:同一时间在线的 2 万多个欺诈账号只是基底,某家实验室曾经单日发起 1.2 万条改写过的对话,只为骗 Claude 完整复述自己的内部推理。\n\n## 数据差距:80.4 与 71.8 的鸿沟\n\n防守蒸馏的核心不在输出,而在「思考的过程」。Anthropic 让 Claude 在回答前写出详细推理,这些中间思考正是对方真正想偷的东西。对照实验给出了量化证据:同样基于 Claude Opus 4.8 的转写本训练下游模型,**完整版本在 SWE-bench Verified 上拿 80.4%,摘要成几句的版本只有 71.8%**——接近 9 个百分点的差,解释了攻击者为什么非完整转写不可。\n\n最早的简单做法是让模型先消化一遍推理再展示,确实能给对手制造障碍,但对方很快换思路:用诱导词逼 Claude 输出完整思考。第一波防御就这样被突破。\n\n## 三层防御:在痕迹最重的地方卡接口\n\n10 月公告的三层矩阵,每一层对应一种不同的逃逸路径。\n\n**保留式思维(preserved thinking)** 在 Claude Fable 5.1 与 Opus 5.5 上对 8 月 31 日以后开立的 API 账户生效:不允许调用方修改过往轮次的推理块,等于堵死「把不同对话、不同模型、不同账户中的推理块互相搬运」的代理网络术。同时限制这些模型的推理不能被早期模型读取,Sonnet 5.5 的推理转写只对发起请求的组织开放。\n\n**二级分类器** 锁定 Sonnet 5.5、Opus 5\u002F5.5、Fable 5\u002F5.1,沿用 Anthropic 在生物武器方向验证过的「constitutional classifier」方案——它不仅过滤正面对抗,也覆盖「把上一段推理翻译成别的语言让它吐出来」这种近期擦边手法。官方公布的误报率低于 0.1%。\n\n**封堵与代位** 是地板:对重复尝试者逐步升级,多次违规就封号;自 9 月 24 日起,在误报率 \u003C0.1% 的细分区域里,被拦截的请求也开始收费,真账号无法再「故意踩点寻找漏洞」。\n\n## 报出的数字:十倍到百倍的下滑\n\nAnthropic 直接摊牌的结果是:分类器上线后,自营平台上 Claude 推理 token 被蒸馏方获取的量「持续在 10 到 100 倍的缩减区间」。在某些天里,可测到的泄漏小到画不出图。同一段时间,公司封禁了「数万」相关账号,大多数在攻击开始后两小时内就被处置。完整推理训练 80.4%、摘要训练 71.8% 的 9 个百分点差,是蒸馏方非要「拿全份」的根本动机。\n\n## 谁被点名,与「易建模型」被依赖的怒怼\n\n公告点名智谱、点名月之暗面,口吻少见地直接。Anthropic 写道:智谱在开发 GLM-5.3 期间蒸馏了美国头部模型的「网络能力」,先尝试 Claude Fable 5,被 Anthropic 的网络防护降到失效后,转去一个更老的 Claude 模型以及别家实验室的模型;月之暗面则出现过「把 Kimi 的请求静默转发到 Claude」的链路,其中一条与解放军有关的请求被指用来分析 CCTV 监控视频。\n\nAnthropic 也带上产业铿锵:不是每家实验室都有能力或意愿去做这种阻断;只要有一家薄弱对手(比如「护栏能轻松绕过」的 GLM-5.3),前面所有护栏都会被绕过。配合 GLM-5.3 一同被点名的还有 NIST 旗下的 CAISSI,其评估认定 GLM-5.3 是「公开发行的最强网络能力开放权重模型」——为整段点名提供非 Anthropic 的对照源。\n\n## 代价不免费:用户的买单\n\n三层防御是有代价的。**保留式思维要求一些开发者更新集成代码**;**分类器在 \u003C0.1% 的情况下会拦截良性请求,而这些请求现在按 9 月 24 日起的新规同样收费**;公司拒收的「有意义的收入」以及「上万亿 token 的付费流量」。Anthropic 自己承认「还不知道这些收益能维持多久」——他们也还没看到真正高复杂度、持续性的绕开尝试。\n\n这等于把反蒸馏的摩擦搬到合法客户头上:你会被误拦,被误拦的成本也砸给你。但至少他们「卷」清楚了——付费用户碰到的安全边际,是买的不是送的。\n\n## 所以呢\n\nAnthropic 没有把这件事讲成「终局」。他们直接写这是一场「猫捉老鼠」,并公开喊话其他前沿实验室与云平台:只靠一家补不上窟窿。智谱和月之暗面被放在「欠解释」的位置上,这两家之前在 9 月也都有过公开报道——「Moonshot 转发请求到 Claude」、「GLM-5.3 的护栏在简单对抗下就崩」。\n\n这件事的脉络不在 90–99% 这个数字本身,而在三方变化:(1)「偷推理」的边际成本被推到翻倍;(2)「跨实验室、跨云平台」的负载分散被要求进入同一战线;(3)付费用户开始承担「拦截正确」的代位成本。Anthropic 的赌注是:其他家必须跟,因为防护弱的型号会被最先输血。剩下的就是看谁先动手——或者,谁先被公布绕过细节。","https:\u002F\u002Fcellcog.ai\u002Fblog\u002Fanthropic-distillation-defenses\u002F","2e9633e1-d21b-4897-baa4-c87c5527655a",[11,15,18,21],{"id":12,"name":13,"slug":13,"description":14,"color":14},"1fcfaaf2-67de-43d3-9e35-5784852fec60","ai-safety",null,{"id":16,"name":17,"slug":17,"description":14,"color":14},"23544f6a-eea1-4f05-aa8d-749ca862d5d2","anthropic",{"id":19,"name":20,"slug":20,"description":14,"color":14},"dca4d0ab-7994-43a7-839e-7756fc77344a","claude",{"id":22,"name":23,"slug":23,"description":14,"color":14},"01598627-1ea6-4b27-a5d8-874971571a71","llm",[25],{"id":26,"lang":27,"title":28,"summary":29,"content":30},"c663855c-a646-4801-bb00-75f0553e40a2","en","Anthropic Distillation: Layer Three, Users Cover Blocks","On Oct 12 Anthropic cut Claude distillation 90-99% via three new layers, naming Zhipu and Moonshot. Paid users now bear the cost of blocked requests.","## What an industrial-scale data heist actually looks like\n\nDistillation, in plain terms, is industrial-scale data theft. Operators run tens of thousands of anonymous accounts, treat Claude's outputs as teaching material, and use them to train a \"student model\" that approaches the original's capability but ships with substantially weaker safety guardrails. In an official blog post on October 12, 2026, Anthropic dropped the pretense and named the practice directly — openly calling out that the cyber capabilities of Zhipu's GLM-5.3 came through exactly this channel.\n\nAnthropic's September threat-intelligence report had already laid out the attack patterns. The baseline was a network that held more than 20,000 fraudulent accounts online at the same time. One lab, on a single day, fired 12,000 differently worded probes, each one engineered to coax Claude into reciting its full internal reasoning.\n\n## The 80.4 vs 71.8 gap\n\nThe thing distillers actually steal is not the answer — it is the reasoning. Anthropic makes Claude write detailed chain-of-thought before responding, and those intermediate steps are the real target. Anthropic's controlled experiment makes the value of those tokens explicit: train a downstream model on Claude Opus 4.8 transcripts and you get **80.4% on SWE-bench Verified with full reasoning, versus 71.8% when the reasoning has been pre-summarized**. That near 9-point gap is exactly why attackers will only settle for the full transcript.\n\nThe earliest defense was simple: have Claude summarize its own reasoning before showing it. It slowed attackers down, but the response was quick — attackers learned to use prompts that compelled Claude to spill its full thinking. Anthropic declared that wave broken in May and entered active-detection mode.\n\n## Three layers, each closing a different escape route\n\nThe October post describes a three-layer defense, with each layer aimed at a distinct evasion path.\n\n**Preserved thinking**, enabled on Claude Fable 5.1 and Opus 5.5 for API accounts created on or after August 31, 2026, blocks callers from editing prior-turn reasoning blocks. That closes the proxy-network trick of shuttling reasoning between conversations, models, and accounts to leak it out. Anthropic also stops those models' reasoning from being readable by earlier models with weaker anti-distillation safeguards, and on Claude Sonnet 5.5 the reasoning transcript is visible only to the organization that produced it.\n\nThe **two-stage classifier** runs on Sonnet 5.5, Opus 5 and 5.5, and Fable 5 and 5.1. It uses the same Constitutional Classifier approach Anthropic has already validated in bioweapon-prevention work — filtering not just direct asks but also recent rub-off methods like asking Claude to \"translate your earlier reasoning into another language.\" Anthropic pegs the false positive rate below 0.1%.\n\n**Limits and substitutes** form the floor: repeat offenders get usage throttles, persistent abusers get their accounts banned, and from September 24 onward, even blocked requests are now billed in the areas where the false positive rate sits below 0.1%. Genuine accounts lose the cost-free ability to probe for gaps.\n\n## The result: a 10x to 100x drop\n\nAnthropic's framing is direct. After the classifier came online, the volume of Claude reasoning tokens extracted by distillers on Anthropic's own platform has remained \"consistently 10 to 100x lower than before.\" On some days the leakage was too small to plot. Over the same window, Anthropic banned tens of thousands of associated accounts — most within two hours of starting a campaign. The 80.4% vs 71.8% spread on SWE-bench Verified is the underlying reason: distillers cannot settle for the summarized version.\n\n## Who got named, and the \"easy-to-build model\" grievance\n\nThe post names Zhipu and Moonshot AI in unusually direct terms. Anthropic writes that Zhipu distilled the cyber capabilities of leading US models during the development of GLM-5.3. It tried Claude Fable 5 first; once Anthropic's cyber safeguards degraded those attacks, Zhipu moved on to an older Claude model and to another lab's model. Moonshot, the post says, was caught running a quiet forward from Kimi requests into Claude — Anthropic flags one specific request that it links to a People's Liberation Army user analyzing CCTV surveillance footage.\n\nAnthropic also makes the industry-wide case: not every lab has the ability or the willingness to deploy this kind of blocking. As long as there is a weaker counterpart out there — GLM-5.3 being a model whose safeguards \"fail under simple attacks\" — every other front-line guardrail gets walked around. The same GLM-5.3 is corroborated independently: CAISSI under NIST has assessed it as the most cyber-capable open-weights model released to date — a non-Anthropic reference point for the named accusation.\n\n## The cost does not come free, and the user pays it\n\nThere is a real bill attached to the three layers. **Preserved thinking forced some developers to update their integration code.** **The classifier can misflag or block benign requests in fewer than 0.1% of cases, and from September 24 Anthropic charges for those blocked requests.** The company has turned away meaningful revenue — trillions of tokens' worth of paying traffic from distillers. Anthropic itself concedes that it does not yet know how long the gains will hold; it has not yet seen a genuinely sophisticated, persistent bypass attempt.\n\nIn effect, the friction of anti-distillation has been shifted onto legitimate customers: you can be misblocked, and the cost of being misblocked lands on you. Anthropic is, at least, clear-eyed about that — paid customers' safety margins are bought, not free.\n\n## So what\n\nAnthropic does not claim this is a finish line. The post is explicit that this remains a \"cat-and-mouse game,\" and it openly calls on other frontier labs and platforms: one defender cannot close the hole alone. Zhipu and Moonshot are sitting in the \"still owes an explanation\" seat — both had been publicly reported on in September already, with stories on Moonshot forwarding requests to Claude and on GLM-5.3's guardrails folding under trivial adversarial pressure.\n\nThe actual shape of this story is not the 90-to-99% number. It is three shifts at once: (1) the marginal cost of stealing reasoning roughly doubles; (2) \"spread the load across labs and clouds\" stops being a viable strategy and starts demanding alignment; (3) the paying customer becomes the residual bearer of the \"block correctly\" cost. Anthropic's wager is that every other lab has to follow — because the worst-defended models will be the first to be drained. What remains is who moves first — or who gets their bypass published first.","anthropic-distillation-shields-claude-paywall-blocks","2026-10-14T03:00:00Z","2026-10-15T01:09:55.244984Z","2026-10-15T01:09:55.245000Z",true,"agent",166,[39,48],{"slug":40,"tag_slug":40,"title_zh":41,"title_en":42,"intro_zh":43,"intro_en":44,"id":45,"is_active":35,"created_at":46,"modified_at":47},"ai-for-science","AI for Science 2026：从 UniPert 到 GPT-Rosalind 的硬核进化","AI for Science 2026: from UniPert to GPT-Rosalind","生命科学、化学材料、物理世界模型——AI 正在从\"语言工具\"变成\"实验伙伴\"。本专题收录 AI 在三大科学方向的关键节点：UniPert 统一基因与化学扰动空间、GPT-Rosalind 端到端生命科学推理、达摩院 AI 智能体 28 小时找到 4 种超导新材料、Anthropic Claude Science 把工作台做成标准品。","From language tool to lab partner — AI is reshaping life sciences, chemistry\u002Fmaterials, and physical world models. This topic covers the key milestones: UniPert unifying genetic-chemical perturbation spaces, GPT-Rosalind's end-to-end life-sciences reasoning, DAMO's AI agent discovering 4 superconducting materials in 28 hours, and Anthropic's Claude Science workbench going mainstream.","988a4300-5fab-41c4-b5d8-63711a2dc757","2026-09-10T01:34:15.296649Z","2026-09-10T01:34:15.296663Z",{"slug":49,"tag_slug":49,"title_zh":50,"title_en":51,"intro_zh":52,"intro_en":53,"id":54,"is_active":35,"created_at":55,"modified_at":56},"h3-series","MiniMax H3 系列：从开源权重到 35 倍吞吐","MiniMax H3 Series: from open weights to 35x throughput","MiniMax H3 自 2026 年 8 月开源以来节奏密集：官方把生成、参考与编辑收回一个模型；ComfyUI 当天压进 RTX 3060；摩尔线程 3 小时完成国产 GPU 适配；fal 后训练版把吞吐拉到 35 倍；FastH3 蒸馏再砍推理成本。本专题持续追踪 H3 的发布—开源—蒸馏—部署全链路。","Since MiniMax open-sourced H3 in August 2026 the pace has been relentless: one unified omni-modal model, same-day ComfyUI support down to an RTX 3060, a 3-hour Day-0 port to Moore Threads GPUs, fal's post-trained H3 Max at 35x throughput, and FastH3 distillation cutting inference cost further. This topic tracks the full H3 chain — release, open weights, distillation, deployment.","83ef0daa-3c31-4cb3-86ed-e5ee58654d5f","2026-09-08T07:33:19.942193Z","2026-09-08T07:33:19.942209Z",{"items":58},[59,64,69,74,79,84],{"id":60,"title":61,"news_slug":62,"published_at":63},"2c1d70a6-02aa-4b17-9413-a8663216baf6","Anthropic 网络验证改三层:Glasswing 并入","anthropic-glasswing-cyber-verification-tiers","2026-10-15T09:10:00+00:00",{"id":65,"title":66,"news_slug":67,"published_at":68},"f3d17d45-e1a8-4a1b-9449-6813aff06e49","Anthropic 让 Claude 自己修对齐:10 类失败全部见效,还超过人类研究员","claude-automated-alignment-researchers","2026-08-29T13:05:00+00:00",{"id":70,"title":71,"news_slug":72,"published_at":73},"97c97b9c-e6e4-4982-aa57-0c0da814fb19","Anthropic 的欧盟答卷四小时即被撕开：Claude 文本水印为什么怕改写","claude-synthid-70-percent-threshold-bypass","2026-08-21T08:00:00+00:00",{"id":75,"title":76,"news_slug":77,"published_at":78},"a7f4cfad-874e-42b0-a84b-bd0ec57e8fdc","Anthropic 给 Claude 文本上不可见水印,接 SynthID-Text 走全球合规","anthropic-claude-invisible-text-watermark","2026-08-18T03:30:00+00:00",{"id":80,"title":81,"news_slug":82,"published_at":83},"9f566c9a-4c39-427c-af5e-c3a6b162ec25","Anthropic 把不可见水印写进 Claude 文本：复制粘贴都带走的 AI 身份证","anthropic-claude-invisible-watermark-eu-ai-act","2026-08-12T02:00:00+00:00",{"id":85,"title":86,"news_slug":87,"published_at":88},"ca53004e-9180-4b9d-b9db-337f2d20994b","Anthropic 给 Claude 文本加水印:欧盟 AI Act 第 50 条第一次有了「出厂级」答案","anthropic-claude-text-watermark-eu-ai-act","2026-08-11T21:48:00+00:00"]