Anthropic's investor figures put a number on model distillation: 5–7% of revenue
Anthropic has reportedly told investors that distillation, where rival labs train on a stronger model's outputs, accounted for 5–7% of its revenue before a Q3 cutback. For security teams, that makes model extraction a measured commercial risk.
Key Takeaways
- The FT reports that Anthropic told investors distillation accounted for 5–7% of its revenue and was cut back 'materially' in Q3.
- The figures come from people with knowledge of the matter and a secondhand summary; Anthropic has not published them in this form.
- Distillation shows that model extraction is a large-scale commercial activity, not only a research curiosity.
- Teams exposing LLM APIs should treat high-volume, systematic querying as a threat model of its own.
Simon Willison summarised an FT report on a day Anthropic spent briefing investors ahead of a possible IPO. Most of the coverage is about revenue. The part that matters for security readers is a single line about distillation.
What was reported
Willison's summary of the FT article gives these figures, all attributed to people with knowledge of the matter:
- Q1 revenue was 'about $4.8bn', Q2 was $11.5bn and Q3 was $16.8bn.
- In Q3 Anthropic earned $1.70 of revenue for every $1 spent on computing power.
- Adjusted operating margin, excluding stock-based compensation, was 11%.
The FT also reports that Anthropic has clamped down on distillation, the practice of rival labs training models on the outputs of a more advanced model. Anthropic reportedly told investors that distillation 'accounted for 5 per cent to 7 per cent of revenue' and that it was cut back 'materially' in Q3.
Why the distillation figure matters
Willison points out the implication. If distillation was 5% of Q2 revenue, before the cutback, then unnamed other labs spent more than half a billion dollars that quarter distilling Anthropic's models. That is his arithmetic on a reported range, not a confirmed figure. Neither Anthropic nor the FT has named the labs involved.
Security literature has long treated model extraction as a threat: an adversary queries a model at scale and uses the responses to approximate its behaviour. This reporting suggests it is also a routine, paid, high-volume use of a commercial API. The same traffic that funds the provider is the traffic that transfers capability to a competitor.
What to take from this
We would treat the numbers with caution. They are a secondhand summary of an FT article that relies on anonymous sources, and we have not seen Anthropic's own materials. The claim that distillation fell 'materially' in Q3 is also unquantified, so it says nothing about how effective any particular control was.
Even so, the direction of travel is clear for anyone who exposes an LLM through an API or a product:
- Model your own exposure. If your product wraps a fine-tuned model or a proprietary prompt pipeline, systematic bulk querying is a way to copy it. Include extraction in your threat model next to prompt injection.
- Look at usage patterns, not only content. Distillation traffic is defined by volume, coverage and structure. Per-account and per-key analytics, rate limits and anomaly detection are the usual levers.
- Read the contract. Terms of service are the main control against training on outputs. They only work when someone can attribute and enforce.
- Test it. AI red-teaming should cover extraction and abuse-at-scale scenarios, not only jailbreaks.
One other detail from the summary: Anthropic no longer appears to use 'annualized run-rate revenue' in its investor communications, which it previously did. That is a financial-reporting observation, not a security one, but it is a reminder that these numbers are being reshaped for an audience.
Frequently Asked Questions
What is model distillation?
Distillation is training one model on the outputs of a more capable model. As reported by the FT, rival labs have done this with Anthropic's models, and Anthropic told investors it accounted for 5–7% of revenue before a cutback in Q3.
Is distillation the same as model extraction?
They overlap. Both rely on querying a model and using its responses to reproduce its behaviour. Distillation usually means using those outputs as training data for another model. The security concern is the same: capability is transferred through a legitimate-looking API.
How reliable are these figures?
They are secondhand. They come from an FT article citing anonymous sources, as summarised by Simon Willison, and have not been published by Anthropic in this form. Treat them as reported, not verified.