Anthropic's released an impressive blogpost on new steps they've taken to deter distillation. It is great. But it has far from solved the problem: 1) The key result is that they've significantly reduced the reasoning tokens that can be extracted with new classifier defenses. This is great - and all labs need to follow suit. But it is far from a full solve. Methods exist to still be able to gain proxies of reasoning from just the input/output that still benefit adversary's models. See "How to Steal Reasoning without Reasoning Traces" paper. Adversaries will still continue to leverage U.S. models for valuable data if they can access them. The game isn't over. 2) Anthropic says they have been restricting and banning accounts that attempt to distill. This is also great. However, there is a massive "transfer station" ecosystem of accounts based on fraudulent credentials that are easily dissolved and reconstituted. This only helps so much. 3) Policy measures from the USG remain necessary for tighter security: - KYC to access U.S. models. Require credentials that are harder to make fraudulent. - Offense against the transfer stations that enable unauthorized access. - Narrowly scoped antitrust exceptions to allow U.S. labs to coordinate on anti-distillation security: methods & signal-sharing for detection & deterrence. - Bring all relevant U.S. partners into this methods & signal-sharing coordination including e.g. OpenRouter.

This is the precise reason why antitrust waivers for security coordination like the CATS Act are so necessary. Across distillation, cyber, bio, loss of control, etc., the labs cannot coordinate live information at all right now. So these attacks will keep happening.