Anthropic Accuses Alibaba of Distilling Claude with 25,000 Fake Accounts and 28.8 Million Queries

Anthropic publicly accused Alibaba of using approximately 25,000 fake accounts to extract knowledge from Claude models through 28.8 million queries.

Core Facts of the Incident

Before July 2026, Anthropic disclosed this accusation, which included creating a large number of fake accounts and making massive API calls. Google's verification results showed the status as confirmed, with two valid sources supporting the claim.

Actual Shortcomings of Protection Mechanisms

Although rate limits exist, the distributed operation of 25,000 accounts can still bypass existing thresholds. The total of 28.8 million queries indicates that current detection systems failed to identify distributed low-frequency calls in a timely manner. In practice, stable API calls did not fully prevent knowledge extraction.

Comparison with Similar Models

The GPT series employs stricter quota allocation and account behavior analysis, with lower daily query limits per account. Gemini focuses on real-time anomaly detection, responding faster to repeated patterns within short periods. Claude maintains a higher degree of openness for user convenience, but this choice directly increases the exposure surface for distillation.

Suggestions for Developers

• Set up local query logs when calling Claude API, and regularly check for abnormal patterns.
• Prioritize using official batch interfaces over manual loop calls to reduce the risk of being flagged.
• Perform secondary verification on key knowledge points to avoid relying solely on a single model's output.

Suggestions for Enterprises

When deploying their own models, enterprises should add watermarks or fingerprint marks to training data to facilitate post-event traceability of leakage paths. When purchasing external model services, it is necessary to explicitly include anti-distillation clauses in contracts and require the provider to provide protection audit reports. In terms of cost, under the same level of protection investment, choosing models with stricter quotas can reduce long-term IP risk.