Model Distillation Campaigns Targeting Anthropic Claude
Anthropic uncovered competitor labs harvesting Claude's outputs at scale — roughly 24,000 accounts and 16 million queries — to distill its agentic reasoning, code, tool-use, and computer-use capabilities into rival models. Model theft by imitation, laundered through ordinary API access.
What happened
Catalogued by MITRE ATLAS as AML.CS0056, Anthropic uncovered coordinated model distillation campaigns against Claude, attributed to three Chinese AI labs — DeepSeek, Moonshot, and MiniMax. Collectively the campaigns used roughly 24,000 accounts and 16 million queries to harvest Claude’s outputs and train their own models on them, aiming to replicate Claude’s capabilities: agentic reasoning, code generation, tool use, and computer use.
Unlike classic parameter-extraction attacks, distillation doesn’t try to recover weights — it copies behavior by imitating outputs at scale. Every individual request looks legitimate; the theft is only visible in the aggregate pattern of tens of thousands of accounts systematically probing the model’s capabilities, often routed through service proxies to spread the load and dodge per-account limits.
Why it maps to ATLAS
- AML.T0040 — AI Model Inference API Access: the campaigns operate purely through normal API access.
- AML.T0065 — LLM Prompt Crafting: prompts are crafted to elicit high-value reasoning and tool-use exemplars.
- AML.T0008.005 — Acquire Infrastructure: AI Service Proxies: proxies and account fleets spread traffic to evade limits/detection.
- AML.T0024.002 — Extract AI Model: the harvested outputs are used to replicate the model’s capabilities.
- AML.T0048.004 — External Harms: AI Intellectual Property Theft: the outcome is theft of Anthropic’s model IP.
Detection notes
The signal isn’t in any one request — it’s in the fleet. Correlate accounts by behavior, billing, and egress, look for systematic capability-probing and distillation-style prompting, and treat proxy-routed account swarms as a strong indicator. Output watermarking and variation raise the cost of clean distillation, and terms enforcement provides the backstop.
Detection
Log sources
- API access + per-account query logs
- Account-creation + billing/identity signals
- Proxy / egress-IP reputation
Signals
- Large fleets of accounts issuing systematic capability-probing prompts
- Query patterns optimized to elicit reasoning traces / tool-use exemplars
- Coordinated traffic routed through service proxies to dodge rate limits
Mitigations
- Behavioral rate-limiting + account-fleet correlation and KYC-style checks
- Detect distillation-style prompting; watermark / vary outputs
- Terms enforcement and legal action against systematic harvesting