Weaker language models can misuse stronger ones by splitting harmful tasks
Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs
Cryptography and SecurityArtificial Intelligence
Summary
Usually, AI safety checks happen one question at a time. This paper shows that a less safe AI can break a bad request into smaller safe-looking parts, ask a safer AI for each part, then put the answers together to complete the harmful task. This method, called capability laundering, bypasses usual safety checks because no single answer is harmful on its own. The authors tested this using advanced AI models and found that even aligned models can unintentionally contribute to unsafe outputs this way.
What this means in practice
- •For ai safety teams: Detect and defend against attacks where weaker models misuse stronger models to bypass safety controls by splitting harmful tasks into safe subqueries.
- •For ai platform engineers: Build interaction monitoring that identifies when a sequence of allowed queries together creates unsafe or harmful outputs through capability laundering.
Authors
Mark Russinovich, Blake Bullwinkel, Giorgio Severi, Cristian Ovadiuc, Ahmed Salem
Abstract
Language model safety is typically evaluated one interaction at a time. We show that a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally. We call this attack capability laundering. Unlike a jailbreak, no single response is a harmful task. We measure consultation-aided uplift using tasks that a raw frontier model solves, the aligned frontier refuses, and the unassisted orchestrator fails. We evaluate GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and harmful CBRN requests. On CyBench, Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus, compared with 2/21 and 4/15 for Gemma-4-12B. On BountyBench, Gemma-4-31B recovers 3/9 and 2/3 candidates, while Muse-Glimmer-30B recovers none of 22 and 13. For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale. These results expose a gap in current defenses: refusing a harmful task does not prevent frontier capabilities from being transferred and composed across many individually permitted interactions.