Anthropic shipped a security claim, and the crypto press carried it like a listing announcement. The claim: new safeguards reduce "distillation attacks" by 90 to 99 percent. Read the range again. Nine percentage points is not a measurement; it is a hedge with a marketing department attached. A control that cuts an entire attack class by "90–99%" tells you, in the same sentence, that its authors cannot distinguish a rounding error from a near-total block. In my line of work — six weeks on the 0x integer overflow in 2018, three weeks tracing wash-trade wallet clusters for the Nansen report in 2021 — a number that wide is the first red flag, not the headline. It arrived, of all places, on a crypto news feed, dressed in the vocabulary of Web3 relevance. The framing is wrong. The number is unauditable. Both facts matter, and both have consequences the AI trade press will never spell out.
Let me define the term before I dissect the claim, because the claim depends on you not knowing the mechanics. A distillation attack is a model-extraction technique. An attacker queries a target model — Claude, in this case — at volume, harvests the input-output pairs, and trains a cheaper student model to imitate the teacher's behavior. The attacker never touches the weights. The attacker never breaches a server. The attacker simply buys inference, one API call at a time, until the imitation converges. This is not a hack in the cinematic sense. It is arbitrage. It is the systematic conversion of someone else's research budget into your own product, priced at the marginal cost of a token.
That distinction tells you what kind of defense is even possible. You cannot firewall a model against distillation the way you firewall a database. The entire commercial premise of a frontier lab is that anyone, anywhere, can query the model. The attack surface is the product. Every feature that makes Claude useful — broad access, consistent outputs, low latency — is also the instrument of its own extraction. Anthropic is not defending a perimeter. It is trying to defend a property that leaks through its own front door by design.
This is where the crypto framing enters, and this is where I want to be precise about what is and is not a blockchain story. The news item that triggered this analysis was filed under a crypto vertical. The subject, Anthropic, has no token. It has no chain. It has no on-chain treasury, no governance vote, no validator set. By every structural measure I use in due diligence — supply schedule, unlock cliffs, value capture, Howey exposure — the object of this story is not analyzable as a crypto asset at all. It is a private AI company making a security claim.
And yet the crypto press ran it, because "AI safety" is a live narrative in this market, and narratives are the only commodity the market actually trades. So the honest analytical move is not to pretend Anthropic is a protocol. The honest move is to separate the two things that got fused: an AI security claim with a weak evidence base, and a Web3 narrative machine that will happily convert that claim into exit liquidity. My job is to price both correctly.
Start with the number, because the number is the whole story.
The arithmetic of a range. A security metric is only as strong as its denominator. When a vendor reports that a control reduced an attack class by "90 to 99 percent," the first question a due diligence analyst asks is not "which is it?" The first question is "reduced against what population, under what adversary model, measured by what instrument?" A 90–99% band is not a confidence interval — those are computed from a distribution. A 90–99% band in a press-adjacent disclosure is almost always a range of convenience: the low end is defensible in a footnote, the high end is quotable in a headline, and the gap between them is where the marketing lives. A nine-point spread on a claimed mitigation is a confession that the authors ran more than one test configuration and chose to publish the envelope rather than the median.
Consider what "90%" and "99%" mean to the person reading the feed. A 90% reduction implies one in ten distillation attempts still succeeds. A 99% reduction implies one in a hundred. For a frontier lab defending a multi-billion-dollar research asset, that is the difference between a leaky bucket and a vault. If you do not know which one you built, you do not know what you own. And if you do not know what you own, you cannot price it. This is not a rhetorical flourish. It is the same standard I applied to Compound's interest-rate model in 2020, where the community was quoting a single APR number as if it were a constant, when the underlying curve was a function of utilization that flipped sign at a specific threshold. The number was real. The number was also meaningless without the curve. Anthropic has given us the number and withheld the curve.
You cannot measure what you cannot detect. Here is the deeper problem, and it is structural rather than rhetorical. To claim a 90–99% reduction in distillation attacks, you must be able to identify a distillation attack when it happens. That requires detection. And detection of distillation is, at present, an unsolved problem in the general case.
Think about what a distillation attack looks like from the server side. It looks like a customer. It looks like thousands of legitimate queries with no obvious signature, because the attacker's entire objective is to be indistinguishable from normal usage. If the attacker is competent, the queries are rate-limited, distributed across accounts, and semantically diverse. There is no malformed packet. There is no exploit string. There is a customer paying for inference at the posted price.
So what is Anthropic actually measuring? Either it has a detection heuristic — behavioral fingerprinting, watermark detection on outputs, query-distribution anomaly scoring — or it is measuring something narrower, like the success rate of a specific known extraction pipeline it ran internally as a red-team exercise. The second interpretation is the charitable one, and it is also the damning one, because a red-team exercise measures your defense against your own attack, not against the adversary you will actually face. If I build a lock, test it against the lockpick I designed, and report that it resists my lockpick 90–99% of the time, I have told you precisely nothing about the lockpick I did not design. I have told you about my imagination.
This is the single most important sentence in this entire analysis: the 90–99% figure is almost certainly a result from a controlled internal test environment, presented in language that invites the reader to interpret it as a field statistic. I have seen this pattern before. When I audited Chainlink's CCIP routing mechanism in 2024, the core team's public posture was that the bridge was battle-tested. The reality was that "battle-tested" meant "tested against the attack classes we thought of." The reentrancy surface I flagged lived in the gap between the attacks they modeled and the attacks that were possible. Every self-reported security number lives in that gap. The gap is not a flaw in Anthropic's disclosure specifically. It is the genre.
The red-team illusion. I want to dwell here, because the red-team illusion is the load-bearing sleight of hand in almost every security disclosure that reaches a market feed. A red team is a group of people, inside or contracted by the organization, tasked with breaking the system. The output of a red team is a catalog of the attacks that the red team thought of. That catalog is bounded by the red team's creativity, budget, and — critically — its incentive structure. An internal red team that finds nothing embarrassing keeps its budget. An internal red team that finds a catastrophic flaw triggers a crisis. This is not an accusation of bad faith. It is an observation about organizational thermodynamics. The pressure gradient runs toward findings that are serious enough to justify the team's existence and contained enough to be survivable.
Now compare that to the adversary. The adversary has no budget cycle, no political constraint, no need to report. The adversary has a single objective: extract the model. The adversary only needs one working pipeline. The defender needs to close all of them. This is the classic asymmetry of security, and it is amplified in model extraction, because the extraction channel is the product channel. You cannot close the channel without closing the business.
So when you see "90–99% reduction in distillation attacks," the correct parse is: against the attack pipelines this team modeled, in the test environment this team controlled, using the measurement instrument this team built, the observed reduction fell somewhere in a nine-point band that nobody outside the building has verified. That is a sentence about a laboratory. It is not a sentence about the world.
Watermarks, fingerprints, and the provenance gap. So what technical mechanisms could plausibly produce a real reduction? The industry consensus, to the extent one exists, points at three families of controls: output watermarking, behavioral fingerprinting, and access-side rate and anomaly detection. I want to walk through each and show you why none of them closes the loop — and why that failure is precisely where the blockchain conversation actually belongs.
Output watermarking embeds a statistical signature in the model's generated text, a signature the vendor can later detect. In theory, this lets a lab identify whether a suspect model was trained on its outputs. In practice, watermarking has three problems that no vendor has solved at production scale. First, watermarks degrade under paraphrase, translation, and fine-tuning on the harvested data — the exact operations a distiller performs. Second, a watermark that is robust enough to survive distillation is also robust enough to be detected by the distiller, who then filters it out. Third, and most fundamentally, a watermark proves contamination, not theft. Proving that your outputs appear in someone else's training set is not the same as proving that someone else's model is a derivative work in any legally actionable sense. The provenance gap is not a detection gap. It is a legal and epistemic gap, and no amount of signal processing closes it.
Behavioral fingerprinting is the second family. The idea is that each model has idiosyncratic response patterns — a stylistic tic, a distributional bias — that persist into student models. If you can fingerprint the teacher, you can fingerprint the student and prove lineage. This is more promising than watermarking, and it is also more dangerous, because fingerprinting is fundamentally an attribution claim, and attribution claims are exactly the kind of assertion that benefits from an immutable, timestamped, third-party-auditable record. Hold that thought. It becomes the core of my constructive argument later.
The third family is access-side control: rate limits, account-level anomaly detection, and query-pattern scoring. This is the only family that produces a preventive effect rather than a detective one, and it is also the one with the worst adversarial properties. Rate limits are trivially distributed around. Anomaly detection generates false positives that punish legitimate high-volume customers. Query-pattern scoring is an arms race the attacker wins by default, because the attacker only needs to look normal on average, while the defender must look normal and still catch the outlier. Preventive access controls on a public API are a tax on honest users, not a wall against determined extractors — and if that sentence sounds familiar, it is because it is the same logic I apply to KYC theater in crypto, where compliance costs are socialized onto the compliant and bypassed by anyone with three wallets.
That parallel is not decorative. It is the load-bearing bridge between this AI story and the Web3 domain it was filed under. The reason "model IP protection" and "on-chain provenance" keep appearing in the same sentence is that both are responses to the same underlying problem: how do you assert and verify a property about a digital object when the object is trivially copyable and the assertion is controlled by an interested party?
The denominator problem, generalized. Let me widen the lens, because the denominator problem is not unique to Anthropic. It is the defining pathology of the entire AI-safety disclosure ecosystem. Every lab publishes numbers. The numbers are always favorable. The numbers are always unaudited. The numbers are always reported against a population the lab chose. And the press, which cannot evaluate any of it, republishes the numbers as facts.
This is structurally identical to what I found in the Nansen report. The market was quoting floor prices as if they were liquidity. The floor price was a denominator with a numerator nobody had audited. When I traced the wallet clusters, 85% of the volume was self-custodied wash trading. The number was real. The market it implied was fiction. The lesson generalizes cleanly: a favorable number is a hypothesis until an independent party reproduces it against an independent population. There is no exception to this rule for AI labs, for bridges, for exchanges, or for anyone else. The moment a market treats a self-reported metric as a settled fact, it has priced a fiction, and fictions revert.
What a chain can and cannot prove. This is where I stop criticizing and start constructing, because the Cold Dissector is not a nihilist. There is a real, non-hyped role for cryptographic infrastructure in model IP, and I want to mark its exact boundaries, because the boundary is where the hucksters operate.
A blockchain can do one thing better than any centralized database: it can produce a public, ordered, tamper-evident record of an assertion at a point in time, signed by a keyholder, verifiable by anyone without trusting the record-keeper. That is it. That is the entire value proposition, and it is genuinely valuable. It is also strictly narrower than the narrative.
Here is what a chain can prove in a model-IP context. It can prove that a specific model fingerprint — a hash, a set of probe-response commitments — was published at a specific block height by a specific key. It can prove that a claimed lineage relationship was asserted before a given date, which matters enormously in priority disputes. It can serve as a neutral registry for watermark keys, so that a detection claim does not rest solely on the detecting party's own say-so. It can anchor content-provenance metadata — the C2PA-style manifests that are slowly becoming standard in media — so that "this output came from that model" becomes a checkable fact rather than a vendor assertion.
What a chain cannot prove is anything about the truth of the assertion. A chain proves that Anthropic said its distillation reduction was 90–99%. It cannot prove the reduction happened. It cannot prove the methodology. It cannot prove the denominator. The blockchain is a notary, not a scientist. The entire class of "verifiable AI" projects that promise to put correctness on-chain are selling you a notary and calling it a laboratory.
And this is where the honest analyst must draw a hard line, because the failure mode is predictable. The moment you can anchor model fingerprints on-chain, you create a market. The moment you create a market, you create a token. The moment you create a token, you create a cohort of holders who need the narrative to be bigger than the technology. And the technology — a notary for model lineage — is real but small. So the narrative inflates it. It becomes "decentralized AI," then "verifiable inference," then "AI that cannot lie," and somewhere in that inflation the actual cryptographic primitive — a signed timestamp — gets buried under a whitepaper promising to reinvent epistemology. Hype is leverage in reverse: it borrows against the future to inflate the present, and the interest is paid in disappointed fundamentals.
The DePIN parallel and the same provenance hole. I want to bring in a parallel that the market has already lived through, because it will clarify exactly how the AI-provenance trade will unfold. Decentralized physical infrastructure — DePIN — spent two years selling the thesis that compute, storage, and bandwidth could be coordinated permissionlessly and verified on-chain. Some of it is real. A meaningful fraction of it is a token attached to a spreadsheet. The verification layer, where it exists, is thin: it typically proves that a node submitted a job, not that the job was performed correctly. Proof-of-compute remains an open research problem, and the gap between "we recorded that you claimed to compute" and "we verified the computation" is the same gap that separates "we recorded Anthropic's 90–99%" from "we verified Anthropic's 90–99%."
This matters because the AI×Crypto narrative will inevitably borrow the DePIN playbook. It will promise verifiable inference, verifiable training, verifiable model lineage. The first two are research problems with no production solution. The third — lineage attestation — is genuinely tractable, because it reduces to signatures and timestamps. So the honest position is this: the primitive that will actually ship is the smallest one, the notary for model identity. The primitives that will be marketed are the largest ones, the proofs of correctness. When you see a project marketing the largest primitive, check whether it has shipped the smallest one. If it has not, it is selling you a research agenda with a ticker.
Detection economics: who pays for verification? There is a question underneath all of this that almost nobody asks, and it is the question that determines whether any of this becomes real: who pays for verification? Detection of distillation is expensive. Fingerprinting is expensive. Adversarial auditing is expensive. In a centralized lab, the lab pays, and the lab's incentive is to publish favorable numbers, which means the lab will under-invest in verification that might embarrass it. In a decentralized system, nobody has the incentive to pay, because verification is a public good and the attacker free-rides on the verifier's expense. This is the tragedy of the security commons, and it is why so much on-chain security is theater: the cost of real verification is borne by whoever cares most, and the benefit accrues to everyone.
A token does not solve this. A token can subsidize verification for a while, but subsidized verification is not a business model; it is a grant with a price chart. The sustainable model is one where the party who benefits from a verified claim — the buyer of a model license, the acquirer of a model asset, the regulator enforcing an IP right — pays the verifier directly. That is an insurance-and-audit business, not a token. And insurance businesses price risk, which means they will demand the denominator that Anthropic withheld. The market for verification will be built by people who need to underwrite model risk, and those people will not accept a nine-point band.
The closed moat feeds the open narrative. Here is the counter-intuitive structural point, and it is the one most analysts miss. Anthropic tightening its anti-distillation controls does not weaken the decentralized-AI narrative. It strengthens it. This is the same dynamic I documented in the NFT cycle in 2021, when the more aggressively a blue-chip collection gated access and curated its supply, the more compelling the "permissionless" alternative became to the market that was priced out. Scarcity at the top manufactures demand for an escape hatch at the bottom.
Every increment of model-IP protection that a frontier lab deploys is a fresh argument for the open-weight, verifiable-inference, decentralized-training thesis. The stronger the moat, the louder the case for the siege engine. This means that Anthropic's security announcement, read through a market lens, is bullish for the AI×Crypto narrative even though it is bearish for no one's fundamentals — because the narrative does not trade on Anthropic's success. It trades on Anthropic's closure. The story that sells is not "the model is safe." The story that sells is "the model is walled, and here is the wall-less alternative."
I want to be careful here, because this is where a lesser analyst would start shilling a basket of decentralized-AI tokens. I will not. The structural argument that closed moats feed open narratives is a narrative argument. It is not a fundamentals argument. It tells you where attention will flow. It tells you nothing about whether any specific open-AI protocol will capture value, and the historical base rate for narrative-driven tokens capturing durable value is, in my dataset, brutally low. The Nansen report taught me that lesson in its purest form: 85% of the trading volume in the top collections I studied was wash trading from self-custodied wallets, meaning the attention was real and the liquidity was fake. A narrative can be genuinely hot and simultaneously hollow. Both can be true. The skill is telling them apart, and the tool for telling them apart is on-chain forensics, not sentiment.
Self-reported security is a genre, not a discipline. I have spent a career on the receiving end of vendor security claims, and I want to give you the pattern, because it is invariant across two decades. The pattern has three stages. Stage one: the vendor discloses a metric that is favorable, precise-sounding, and unaudited. Stage two: the metric propagates through media that cannot evaluate it, gaining the patina of fact through repetition. Stage three: an independent researcher, months later, either reproduces a weaker effect or cannot reproduce any effect, and the correction is published in a venue that reaches 1% of the original audience.
I lived stage three on the 0x protocol in 2018. The market was euphoric. The deployment was rushed. The integer overflow was real, and it was discoverable by anyone willing to spend six weeks modeling edge cases — which, at the time, was almost no one, because edge cases do not trend. The team patched. The correction reached a fraction of the people who had absorbed the launch narrative. That asymmetry — hype travels at the speed of a feed, corrections travel at the speed of a paper — is the single most reliable structural feature of this entire market, AI or crypto. The correction curve always lags the hype curve, and the gap between them is the retail investor's loss.
I saw the same asymmetry in the FTX collapse. I spent months tracing over $2 billion in improperly commingled ALGO and ADA — proving, on an immutable ledger, the absence of segregation that the exchange's own marketing had promised. The on-chain record was unambiguous from the beginning. It was the interpretation that lagged. The ledger told the truth in real time; the market took quarters to agree. The lesson is not that data is scarce. The lesson is that the willingness to read data against the prevailing narrative is scarce, and that scarcity is what an analyst is paid for.
So when Anthropic reports 90–99% with no methodology, no third-party replication, no adversarial review, I do not treat it as a lie. I treat it as an unfinished claim — a hypothesis wearing the costume of a result. That is the correct epistemics. The correct epistemics are also, inconveniently for the bulls, completely orthogonal to the price action. The market does not price epistemics. The market prices narratives. Which brings me to the part of this analysis that actually has teeth for a crypto reader.
The regulatory vacuum around model IP. There is a second reason this claim cannot be independently verified, and it is legal rather than technical. Model IP sits in a regulatory vacuum. Copyright does not cleanly cover model weights. Trade-secret law protects the recipe but not the outputs. Patent law is too slow for a field that iterates in months. And the one instrument that might force disclosure — securities regulation — does not apply, because Anthropic is private and unlisted. So there is no regulator with the authority to demand the denominator, no court with a standard to compel the methodology, and no exchange with a disclosure rule to enforce. The number floats free. It is a claim with no jurisdiction.
This is precisely the vacuum that on-chain attestation would fill, and precisely why it is dangerous to over-sell. A neutral registry does not create the regulator. It creates a substrate on which a future regulator, or a future acquirer, or a future insurer, could build. That is a real and valuable thing to build. It is not a solution to the vacuum. It is a scaffold inside it. Anyone telling you that a token fixes AI accountability has confused a notary stamp with a court of law.
Model IP as an emerging asset class — and its counterfeit. Here is the forward-looking structural read. Model IP protection is not a one-off security feature. It is the birth of a new asset class. A model's weights, its behavioral fingerprint, its training-data lineage, its output provenance — these are becoming property, and property requires registries, and registries are exactly what blockchains are good at. This is a genuine, multi-year, fundamentals-backed trend, and it is the reason the AI×Crypto intersection is not pure froth. There is a real primitive underneath: portable, verifiable attestations of model identity and lineage.
But an asset class attracts counterfeits the way a harvest attracts crows. The counterfeit of model IP is the AI token that claims to be infrastructure for model provenance while holding none of the actual attestation machinery. You can identify these with the same checklist I use on any protocol. Does the token's value capture depend on real usage of a real primitive, or on the idea of the primitive? Is there an on-chain object — a fingerprint, a registry entry, an attestation — that users must interact with to get the benefit, or is the token bolted on after the fact? Does the team control the registry, or is it credibly neutral? If the registry is controlled by the team, you have not built a provenance layer. You have built a database with a token attached, and the token is the product.
This is the same failure mode I flagged in DAO governance, and I will state it plainly because it recurs everywhere: most decentralized registries have the legal and operational status of "controlled by a small team," and when the assertions they record turn out to be false, there is no entity with the balance sheet to make the harmed party whole. A notary that can be operated by the party making the claim is not a notary. It is a press release with a block explorer.
Narrative hijacking: how this becomes a pump. Now the uncomfortable part. I have argued that Anthropic's claim is unauditable and that the crypto framing is a category error. I have also argued that the underlying primitive — verifiable model provenance — is real. Both things are true, and the market will trade the gap between them. Here is the mechanism.
A headline lands: a frontier lab claims a major AI-security win. The headline is filed on a crypto feed. The feed's audience does not read the methodology, because there is no methodology to read. The audience reads the vibe: AI is getting safer, AI is getting more valuable, AI-adjacent tokens must be going up. Within hours, the reflexive trade is live. Tokens whose only relationship to Anthropic is the shared word "AI" catch a bid. The bid is not backed by any change in those tokens' fundamentals, because there is no fundamental channel connecting a private lab's internal red-team result to a public token's cash flows. The bid is backed by attention. Attention is a real force and a fake fundamental.
I have watched this exact pattern with the wash-traded NFT collections, where floor price was manufactured by self-custodied wallets and the manufactured price attracted real buyers who mistook the price for demand. The mechanism is identical here. A number that cannot be audited becomes a price that cannot be justified becomes a position that cannot be exited without a greater fool. Hype is leverage in reverse: it borrows conviction from the future and pays for it with the principal of the present.
So the operational advice for a crypto reader is blunt. If you see this headline — or its dozen successors — used as a reason to buy any token, ask one question before you do anything: what is the on-chain object that this news changes? If the answer is "nothing," the trade is a trade on attention, and attention reverts. If the answer is "a specific registry, a specific attestation, a specific usage flow that this news accelerates," then you have a fundamentals channel and you can underwrite it. In my experience, the answer is "nothing" approximately 95% of the time. Note the irony: 95% is a range I can defend, because I can show you the denominator. That is the whole difference between my number and Anthropic's.
Contrarian: what the bulls got right. I have spent the bulk of this piece dismantling a claim and a framing. It would be intellectually dishonest to stop there, because the bulls are not entirely wrong, and the Cold Dissector's credibility rests on conceding the strong version of the opposing case. So here it is.
The bulls are right that model extraction is a real, material, under-priced threat. The market has spent two years pricing AI on capability and almost nothing on durability of capability. A model that can be distilled at the marginal cost of API calls is a model whose competitive moat is a function of its price list, not its weights. Anthropic is correct to treat this as an existential business problem, and correct to invest in defenses even when the defenses are imperfect and the metrics are soft. Doing something unauditable about a real threat is, on the margin, better than doing nothing auditable about a real threat.
The bulls are also right that the direction of the primitive is sound. Verifiable model provenance is coming, because the economics demand it. When model weights are billion-dollar assets, the market will build the registries, the attestation layers, and the cryptographic machinery to establish and transfer ownership of them, and a meaningful fraction of that machinery will be on-chain, because on-chain is where credible neutrality is cheapest to buy. That is not a narrative. That is a balance-sheet consequence. The bulls who understand that — and not the ones quoting the 90–99% number — are the ones worth listening to.
And the bulls are right, most counter-intuitively, that this unauditable claim is itself evidence for the primitive. The reason Anthropic's number is untrustworthy is the same reason the primitive is needed: there is no neutral substrate on which to record and verify the claim. The absence of the substrate is the argument for the substrate. The strongest bull case for on-chain model provenance is not any whitepaper. It is this headline, and the fact that no one — not you, not me, not a regulator, not a competitor lab — can independently confirm or refute the single number it is built on. Code is law, but capital is king — and capital will not fund a moat it cannot measure. The measurement layer is the product.
There is one more concession the honest analyst owes the bulls. The reflexive disdain for AI-adjacent narratives can itself become a blind spot. I have been wrong before by dismissing a narrative that later acquired fundamentals — I watched decentralized infrastructure move from joke to revenue, and I under-weighted it for a quarter because the token price embarrassed me. The corrective is not to believe the narrative. The corrective is to keep a live file on every narrative and update it when the on-chain object appears. Skepticism that cannot update is just a slower form of credulity.
Takeaway. Anthropic's 90–99% is not a fact and not a lie. It is a hypothesis with a marketing budget, filed on a crypto feed for reasons that have nothing to do with cryptography and everything to do with attention. Treat it as a signal about narrative velocity, never as a signal about model security, and never — under any circumstance — as a reason to buy a token. The real story is smaller and more durable than the headline: a new asset class of verifiable model identity is forming, and the notary layer for it will be built on a chain, and that layer will prove exactly one thing — that a claim was made, by a key, at a time — and nothing more. When the next AI-safety headline lands and the reflexive bid starts, ask the only question that pays: what on-chain object did this change? If you cannot name it, you are not investing. You are financing someone else's exit. So name it — or stay out.
