You Can't Distill Fable 5.1. Here Are All Three Locks.

0:00 Anthropic shipped a new frontier model on Tuesday and said one sentence about how it defends itself. It has strengthened mechanisms, the post says, to make distillation attacks harder.

0:10 That's the entire public disclosure. Its migration guide is a lot less shy. Read that properly and you find three separate locks shipped together. Lock one, the raw reasoning never comes back

0:20 to you. No setting returns it on any account at any price. Lock two, a reasoning block from this model can't be read by any older model. It only travels forward. Lock three. Alter one word

0:32 anywhere behind that block and the block itself stops being valid. And none of the three is decoration because each one closes an attack somebody has already run against Claude. One of those attacks

0:43 reached 16 million conversations from three labs you've heard of. So here's what I want to settle with you. What gets taken in a distillation attack? And can a lock like this stop it? Because

0:54 when you read the papers, these three locks defend one thing extremely well and another thing hardly at all. So begin with the thing being protected. It isn't the answer. Give one of these

1:04 models a hard problem and it writes out it's working first in its own words. It restates the question, tries a route, checks it, throws that out, tries another. Anthropic calls the result a

1:15 thinking block. On this generation, that scratch work is worth more than the answer it produces. And through the interface, you get that block back with an empty text field and one very long

1:24 signature string, which is the full reasoning encrypted. Anthropic keeps no copy of it on a server. It hands the sealed version to you and your own client post it back on every later turn.

1:35 So, the reasoning does leave the building. You're holding it right now. You just can't open it. They'll sell you the plain text. By the way, anthropic documentation tells you to contact sales

1:45 if you need full thinking output. and secrecy with a price list attached is a business decision, not a principle. So why would anyone want the scratchwork? Let's step back for the plain mechanics.

1:55 That teacher and student summary you've heard hides where the money actually sits. Distilling started life as a compression trick. You have a big expensive model. You want a small cheap

2:05 one that behaves like it. So you train the small one to imitate the big one. And the cheapest version of that needs nothing but text. You query the teacher a few hundred thousand times, keep the

2:15 transcripts, then fine-tune an open model on them. That's the whole attack. Deepseek published exactly that recipe in early 2025. Weights and all. 800,000 curated reasoning traces poured into

2:27 off-the-shelf open checkpoints. Its 32 billion parameter student came out ahead of the small reasoning model Open AI was selling at the time. Ahead on maths and on code by about nine points on the

2:38 hardest math set. With the teacher's weights in hand, you can do better than copying text. And a twin team distills its own big models into small ones by matching probability distributions token

2:48 by token. So the student learns what the teacher nearly said as well as what it did say. But the work that should worry anthropic is the version with no weights at all. A Microsoft team trained a

2:58 second network to tell student text from teacher text, then made the student fight it over and over until the difference stopped being detectable. That 14 billion parameter student ended

3:08 up comparable to a frontier teacher on a public chat benchmark from text alone. So ask yourself before the next part if that already works, what is a reasoning lock actually protecting? Now Enthropic

3:20 went public in February with names attached. Deepseek, Moonshot, and Miniax running 24,000 fraudulent accounts and over 16 million exchanges with Claude. One of the three drove about 4-fifths of

3:32 that traffic on its own. And the method it describes is almost comic in how direct it was. The prompts ask Claude to imagine the internal reasoning behind a finished answer and write it out step by

3:42 step. That's chain of thought training data generated to order by the teacher itself. Then 3 weeks before this launch, researchers in Germany published something worse. Those encrypted blocks

3:52 turned out to be interchangeable across sessions, across users, and across models from the same provider. Here's how that worked. You take a signed block from a strong model and pass it to a

4:02 weaker sibling. Then you ask that one to transcribe what it's holding. Out comes the plain text. It worked against Anthropic, against Open AI, and against Google. And when the team ran 300,000 of

4:12 those blocks scraped from public code repositories, they also recovered live credentials and personal data that developers had no idea they'd published. So that's the pressure Anthropic was

4:22 under. Look at the three locks again because each one lands on a specific attack. Lock two kills the cross model replay. Every block now records which model made it and reading runs one way

4:33 only, but wrote a conversation off the new model mid-flight and the interface silently drops that reasoning before the target model sees it and those drop tokens aren't built. So there's no cost

4:44 signal either. You lose the reasoning with no error and no warning unless you go and ask to be told. Lock three kills the editing trick. That signature covers the system prompt, the tool definitions,

4:54 and every message before the block. So rewriting any of them invalidates it. Put a reminder into an earlier turn. Delete it on the next request and you get a flat rejection saying the block is

5:04 bound to a different conversation. And there are two more defenses. The headline doesn't count. If you ask the model to narrate its reasoning inside the answer, it can refuse outright under

5:14 a category named reasoning extraction. Every word it writes also carries a statistical watermark now. So distilled text can be traced back. So does the wall hold? Only partly. take the

5:25 watermark first because its hole is shaped exactly like this audience. When a token has to be exact for a program to run, Enthropic leaves that token alone. So code carries far less watermark than

5:35 pros does. The bigger gap is one the research had already answered. Nothing in this release protects the final answers and that adversarial student never read a single reasoning trace.

5:45 There are holes in the fence post too. The conversation check binds new accounts only, created from the 31st of August, and the restricted sibling model skips it completely. Which brings us to

5:55 the part of this story that isn't technical at all. Under oath in April, Elon Musk was asked a direct question. Had his artificial intelligence company distilled open AI models to build Grock,

6:06 he called it a general practice, then answered partly. SpaceX, which owns that company now, bought Cursor in August for $60 billion. Two weeks later, OpenAI invoked a change of control clause and

6:17 started switching cursor off with a shut off date in November, and it wrote the reason down plainly. It couldn't be confident SpaceX would stay inside the terms of service given its experience

6:27 with Mus companies breaking contracts. Anthropic faced the same customer under the same new owner. It did the opposite and promised more compute. There's a reason for that, and it's on the

6:37 invoice. Since May, Anthropic has rented an entire Muskown data center for one and a quarter billion dollars a month. You don't evict your own landlord. So, Anthropic stopped arguing about terms of

6:49 service and started enforcing them in the protocol instead. That's the shift worth naming here, and it's why the other labs will copy it. Here's my call. The locks win for almost everyone

6:59 watching, and they're the right kind of engineering. A signature field beats a lawsuit because it works where a lawsuit can't reach on accounts in countries your lawyers will never see. Be clear

7:09 about the size of that wind though. Anthropic protected the reasoning, not the capability. A student trained on plain answers still reached its teacher and nothing shipped this week touches

7:19 that. And the people who actually pay are developers running their own agent loops. For them, appendon context is a requirement now rather than a preference. Everybody else gets cash

7:29 reads at a quarter of the old price and a model that narrates less. So here's the question I'd leave open. If reasoning is the asset worth encrypting and a lab will break its own customers

7:39 to protect it, how long until you can't move a conversation between providers at