You cannot hide a trace from one reader

In the distillation campaigns Anthropic set out in February, the most valuable thing taken from Claude was never the answer. One technique it attributes to DeepSeek is described plainly: prompts that "asked Claude to imagine and articulate the internal reasoning behind a completed response and write it out step by step." The response already existed. What the operation was buying, across more than 150,000 exchanges, was the route to it. Moonshot's later phase, by the same account, turned to "attempting to extract and reconstruct Claude's reasoning traces." Across three labs the total came to more than 16 million exchanges through roughly 24,000 fraudulent accounts.

On 1 September, with Fable 5.1, Anthropic closed the door. It is "no longer possible for new API accounts to manually edit Claude's prior context in a multi-turn conversation while preserving the transcript of Claude's prior thinking," a change the company says "closes off a common, publicly documented distillation technique." On 22 September, Opus 5.5 shipped with the same restriction, applying to accounts created on or after 31 August. Existing accounts are untouched for now, but Anthropic says the rule will reach everyone with future model releases.

The defence is well aimed and the evidence behind it is unusually concrete. It is also, by construction, not only a defence against distillers. A reasoning trace is worth stealing and worth auditing for the same reason: it shows the procedure rather than the answer. Any measure that reduces what a trace is worth to a competitor reduces what it is worth to anyone else reading it, because both are reading the same signal.

Why the path costs more than the destination

Start with why a trace is the expensive part. If you train a small model on a large model's final answers, you are doing sequence-level distillation: the student sees inputs paired with outputs and learns to reproduce the mapping. It works, and it is how most cheap models get their manners. But the student has to rediscover for itself every intermediate step that produced the output, with nothing to tell it which steps were load-bearing. On a hard reasoning problem the answer is a handful of tokens at the end of a computation the student cannot see.

A chain-of-thought trace hands over that computation as text. Every intermediate line becomes a supervised target. Instead of one lesson per example, the student gets a few hundred, each one a demonstration of what to attend to next. The gain is not that the trace contains secret knowledge; it is that the trace converts an unsupervised search problem into an imitation problem. That is also why traces are the natural input to reinforcement learning at scale: tens of thousands of graded reasoning episodes are precisely what you need to fit a reward model, and Anthropic reports seeing exactly that, with prompts designed to make Claude "function as a reward model" for someone else's training run.

So a frontier lab's traces are its most concentrated export. A single exchange with a reasoning model yields something closer to a tutorial than a sample.

Now the countermeasure. Anthropic's API has long returned extended thinking as a structured block carrying an opaque field its own SDK describes as "a value used to verify that this thinking block was generated by Claude when it is passed back to the API," with the instruction to pass blocks back "exactly as received, with this field intact." The signature does not encrypt the thinking; the text sits beside it in plain view. What it does is bind that text to the request that produced it. Preserved thinking is the policy built on that binding: you may still edit the conversation, and you may still carry the prior thinking forward, but you can no longer do both. Break the history and the reasoning goes with it.

That is precisely the right shape for the attack described. The DeepSeek technique needs a forged past. You write a completed answer into the assistant's turn, then ask the model to supply the reasoning that would have led there, which is how you manufacture chain-of-thought data for content you chose rather than content the model happened to produce. Take away the ability to edit the past while keeping the thinking, and the distiller is reduced to sampling forward from states the model itself reached. The yield per account collapses. Against an adversary paying for 24,000 accounts, that is a real cost.

The transcript changed owner

Underneath the security story, something quieter happened to the interface. For the whole history of chat APIs the request has been a document the client writes. You composed the transcript, including the assistant's turns, and the server had no opinion about whether those turns were ever said. That was not an oversight. It is what made prefilling work, what made few-shot examples with invented assistant replies work, and what let anyone construct a counterfactual history and ask the model to continue from it.

A signed thinking block ends that for one part of the document. The transcript is now partly a record the server attests rather than a text the client authors, and the client's job on the next turn is to return a receipt. The same construct has appeared at Google, where the generative AI SDKs carry a thoughtSignature on each content part, documented as "an opaque signature for the thought so it can be reused in subsequent requests" and encoded as base64. Google's stated purpose there is continuity rather than defence, and I could not open its documentation from this environment to check how strictly the field is enforced, so I make no claim about that. The point is the shape: two labs now return reasoning with a token that only the server can mint.

The consequence for anyone outside a lab is that a specific experiment has become harder to run. The most informative thing you can do to a black-box model is put words in its mouth and watch what it does next. Anthropic's own interpretability work is a good example of the genre. In April 2025 its researchers inserted hints into the context and checked whether models admitted using them; Claude 3.7 Sonnet acknowledged the hint 25% of the time and DeepSeek R1 39%, and in reward-hacking setups the models took the hint in over 99% of cases while mentioning it in their chain of thought less than 2% of the time. That result is the reason nobody should read a reasoning trace as a confession. It was obtained by manipulating what the model believed about its own context.

The case for closing it, at its strongest

The counterargument is serious and it starts with the numbers. Anthropic attributes campaigns to three named labs with, it says, high confidence from IP correlation, request metadata and infrastructure indicators, and it caught MiniMax mid-campaign, watching it redirect nearly half its traffic within 24 hours of a new Claude release. Its stated safety concern is not competitive: a distilled model inherits capability without inheriting the refusals and classifiers that were trained around it. And structured access already exists as the answer to the audit problem. Opus 5.5 was tested before release by outside evaluators including METR and Frontier Design. Nobody has ever argued that forging a model's speech is a right, and prefilling assistant turns has always been among the most dependable jailbreak vectors, so removing it buys safety as well as margin.

All of that is true, and it still leaves the asymmetry. The restriction binds by account age, so the three labs that already ran 16 million exchanges keep what they took, while a graduate student who signed up in September cannot run the faithfulness experiment that Anthropic published in 2025. Inside the lab, nothing is lost: the Fable 5.1 release describes alignment testing that included analysis of the model's internal thinking with natural language autoencoders, an instrument far better than context editing and available to exactly one party. Structured access is a real answer, but it changes the population of people who can check a claim from anyone with an API key to whoever the lab invites, and the claim most in need of checking is the lab's own account of how its model reasons.

There is a second thing worth noticing. Anthropic's detection stack, by its own description, includes "detection of chain-of-thought elicitation used to construct reasoning training data." Elicitation of reasoning is now a monitored behaviour. The distinction between a researcher probing a model and an adversary harvesting it is not visible in the traffic; it lives in intent, which is exactly the thing an API cannot see. That is why the enforcement lands where it does.

What to take from this

Stop treating an API transcript as a document you own. Learn what a thinking signature is, and notice that part of your next request is now provenance rather than content. If you are studying distillation, the useful distinction is not open versus closed weights but which signal a defence removes: output filtering costs a distiller quality, rate limits cost throughput, and trace binding costs the intermediate supervision that made the copy cheap in the first place.

And when you next read a confident statement about what a model was thinking, ask who was in a position to run the counterfactual. Open-weight models remain fully inspectable, which is an argument for their scientific value that has nothing to do with their benchmark scores. For frontier models the honest answer is increasingly that the lab ran it, and published what it found.

The field spent two years arguing that visible reasoning was its best hope for oversight. The first serious commercial pressure on that visibility did not come from a safety debate at all. It came from people copying the homework.