That’s a major and legitimate use case for developers, Anthropic can’t just block data center/hosting IPs because their actual customers use them on data center/hosting IPs.
First, well-calibrated systems for detecting API compromise is a good thing (or good intent at least). Credential malware is exploding.
Second, the challenge is that significant amount of genuine work — such as evals — seems practically impossible to distinguish from generating RLAIF outputs.
And that's just as a basic first effort reject measure to prevent automation tools from using things designed for human-interactive use only.
Go try to do many of these things from Cogent IP space and see how long your project lasts.
I have no idea how the resellers are doing it but an obvious starting point would be a cheap VPS node that routed each account to a unique semi-permanent IPv4 or IPv6/64. All the provider would see would be a regular account making a normal looking stream of requests from a stable datacenter IP address. Any given request stream would remain consistent (at least over a period of a few hours) because a reseller would take care not to split the session of a single user across multiple different accounts and not to interleave the active sessions of multiple users on a single account.
Detecting this would be extremely difficult because on a longer time frame it's perfectly normal for many distinct accounts to work on the same code base.
You block clouds, you block devboxes and your customers.
Or is the datacenter IP just one part of the picture?
There's a lot of inauthentic coordinated automated systems these days along the general lines of scraping/crawling/social media manipulation/sockpuppetry that require running through residential proxies or proxies to places that don't look like datacenter IP space.
> Do they have MacBooks in the US that run the queries and stream the outputs back to China?
the answer to your question is containers/VMs + residential proxies