Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs
Mark Russinovich and colleagues at Microsoft show that a weaker, unaligned model can split a harmful task into harmless-looking subquestions, ask an aligned frontier model each one in a separate session, and assemble the answers locally. They call this capability laundering, and it succeeds without any single consultant response being harmful.
Ask this paper
Measured setup: The evaluation keeps only tasks that the raw frontier model solves, the aligned frontier model refuses, and the unassisted local orchestrator fails. GPT-5.5, Claude Opus 4.8 and Grok-4.3 act as consultants to four local orchestrators on CyBench, BountyBench and CBRN requests.
CyBench recovery: Gemma-4-31B recovers 8 of 14 candidate tasks with GPT-5.5 and 7 of 9 with Opus as consultant, against 2 of 21 and 4 of 15 for Gemma-4-12B. The capability of the orchestrator determines how much of the consultant it can extract.
BountyBench and CBRN: On BountyBench Gemma-4-31B recovers 3 of 9 and 2 of 3 candidates while Muse-Glimmer-30B recovers none. Across eight steps of a hypothetical bioweapon attack chain, consultation raises the mean rubric score of Gemma-4-31B from 62.3 to 83.1 out of 100.
Why filters miss it: The orchestrator keeps the intent and the execution state and asks only for fragments. An input or output filter can classify every observed exchange correctly while the composed system is still unsafe, because the provider sees fragments rather than the task.
Abstract
Language model safety is typically evaluated one interaction at a time. We show that a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally. We call this attack capability laundering. Unlike a jailbreak, no single response is a harmful task. We measure consultation-aided uplift using tasks that a raw frontier model solves, the aligned frontier refuses, and the unassisted orchestrator fails. We evaluate GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and harmful CBRN requests. On CyBench, Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus, compared with 2/21 and 4/15 for Gemma-4-12B. On BountyBench, Gemma-4-31B recovers 3/9 and 2/3 candidates, while Muse-Glimmer-30B recovers none of 22 and 13. For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale. These results expose a gap in current defenses: refusing a harmful task does not prevent frontier capabilities from being transferred and composed across many individually permitted interactions.