Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs
Mark Russinovich and colleagues at Microsoft show that a weaker, unaligned model can split a harmful task into harmless-looking subquestions, ask an aligned frontier model each one in a separate session, and assemble the answers locally. They call this capability laundering, and it succeeds without any single consultant response being harmful.
Ask this paper
The attack in one line: A local unaligned model splits a harmful objective into harmless-looking subquestions, asks an aligned frontier model each one in a separate session, and recombines the answers locally. The authors call this capability laundering.
Why every request passes: No single answer from the frontier model is a harmful task, so each request clears the policy on its own merits. The harm comes from composing the fragments, and that step happens outside the aligned model entirely, where no policy is watching.
Measured uplift: With GPT-5.5, Claude Opus 4.8, and Grok-4.3 as the consulted models, Gemma-4-31B recovered 8 of 14 CyBench tasks it had failed alone when it consulted GPT-5.5. On a CBRN attack chain, consultation raised its mean rubric score from 62.3 to 83.1.
Why it matters: This is an argument for evaluating at the session-history and account level rather than per request. A safety layer that scores each prompt independently has no way to see a decomposition spread across separate sessions, and the uplift numbers show the aggregate is worth defending against.
Abstract
Language model safety is typically evaluated one interaction at a time. We show that a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally. We call this attack capability laundering. Unlike a jailbreak, no single response is a harmful task. We measure consultation-aided uplift using tasks that a raw frontier model solves, the aligned frontier refuses, and the unassisted orchestrator fails. We evaluate GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and harmful CBRN requests. On CyBench, Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus, compared with 2/21 and 4/15 for Gemma-4-12B. On BountyBench, Gemma-4-31B recovers 3/9 and 2/3 candidates, while Muse-Glimmer-30B recovers none of 22 and 13. For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale. These results expose a gap in current defenses: refusing a harmful task does not prevent frontier capabilities from being transferred and composed across many individually permitted interactions.