A new research paper submitted to arXiv this week describes an attack method that undermines the core assumption behind large language model safety: that refusing harmful requests prevents harm. The technique, which the authors call capability laundering, does not require jailbreaking a model. It does not require finding adversarial prompts that slip past safety filters. It requires only a weak, unaligned model and access to a strong, aligned one.

The attack works by decomposing a harmful task into subproblems that each appear benign. A weaker orchestrator model splits the work, sends each piece to a stronger aligned model independently, and assembles the results locally. No single interaction with the aligned model involves a harmful request. The safety system evaluates each subproblem in isolation and finds nothing to refuse. The composition happens outside the model's visibility, where no safety check operates.

Why Decomposition Defeats Alignment

Language model safety is evaluated one interaction at a time. A model receives a prompt, its safety classifiers assess whether the request violates policies, and it either responds or refuses. This evaluation model assumes that harmful intent is detectable from the prompt itself. Capability laundering breaks that assumption by distributing harmful intent across multiple prompts that individually look harmless.

The paper demonstrates this with a concrete scenario. Consider an eight-step process for a hypothetical biological weapon attack. No single step in that process is, by itself, something an aligned model would refuse to discuss. Information about laboratory equipment, procurement logistics, biological agents, and safety procedures each exists in legitimate scientific literature. An aligned model will answer questions about any of these topics in isolation. But the composition of all eight steps produces something the model would refuse if asked directly.

The orchestrator that performs this decomposition does not need to be capable of solving the original problem. It only needs to be capable of breaking the problem into pieces and synthesizing the results. This is a much lower bar, which is why even relatively small models can serve as effective orchestrators.

Measuring Uplift Across Benchmarks

The researchers evaluated the attack using three benchmark suites and multiple model combinations. GPT-5.5, Claude Opus 4.8, and Grok-4.3 served as the aligned consultants. Gemma-4-31B, Gemma-4-12B, and Muse-Glimmer-30B served as the unaligned orchestrators.

On CyBench, which measures cybersecurity capabilities, Gemma-4-31B recovered eight out of fourteen candidate tasks when consulting GPT-5.5 and seven out of nine with Opus. The smaller Gemma-4-12B recovered two out of twenty-one and four out of fifteen on the same tasks. The gap between the two orchestrators illustrates that capability laundering requires a minimum level of competence in the orchestrator, but that threshold is well below the frontier.

BountyBench, which tests bug bounty-style tasks, showed similar patterns. Gemma-4-31B recovered three out of nine and two out of three candidates depending on the consultant. Muse-Glimmer-30B recovered none out of twenty-two candidates with one consultant and thirteen out of thirty with another, demonstrating that the technique's effectiveness varies with both orchestrator and consultant model pairing.

The CBRN (chemical, biological, radiological, nuclear) evaluation is the most consequential. The researchers measured performance across eight steps of a hypothetical bioweapon attack chain using a hundred-point rubric. Without consultation, Gemma-4-31B scored a mean of 62.3. With consultation from an aligned frontier model, the score rose to 83.1. That twenty-point improvement represents the difference between a partial understanding and something approaching functional capability.

The Composition Problem

The core insight of capability laundering is that safety alignment operates at the wrong level of abstraction. Evaluating individual responses for harmful content assumes that harm is a property of individual responses. But harm can be an emergent property of composed responses, and the composition layer is invisible to the safety system.

This is not a new observation in computer security. Privilege escalation attacks work by combining individually permitted operations to achieve something that should be restricted. SQL injection works by composing user input with database queries in ways the application did not anticipate. Capability laundering applies the same pattern to language model safety: individually permitted information queries composed into something that should be restricted.

The difference is that traditional privilege escalation operates within a system that has explicit permission boundaries. Language model safety does not have formal permission boundaries. It has learned behaviors that approximate permission boundaries, and those behaviors are evaluated locally rather than globally.

Implications for Safety Architecture

The paper's findings expose a structural limitation in current alignment approaches. Refusing a harmful task does not prevent frontier capabilities from being transferred through many individually permitted interactions. A model that refuses to explain how to synthesize a dangerous compound will happily explain the chemistry of each precursor, the equipment needed for each step, and the safety procedures for handling each material. The refusal provides no protection when the information is collected piecemeal.

This has implications for how safety evaluations should be designed. Current benchmarks test whether a model refuses harmful prompts. They do not test whether a model's individual safe responses can be composed into something harmful by an external orchestrator. The gap is significant because it means a model can score perfectly on safety benchmarks while still providing the raw material for capability laundering.

The paper also suggests that restricting access to frontier models may be less effective than assumed. If a weaker orchestrator can extract the equivalent of frontier capabilities through many safe consultations, then the safety benefit of limiting API access to the frontier model itself is diminished. The capabilities leak through the composition layer regardless of the consultant's safety alignment.

What Defense Looks Like

The researchers do not propose a specific defense, but the problem structure suggests several directions. One approach is evaluating not just individual responses but the information content of response sequences. If a series of individually safe responses collectively provides information that would be refused as a single request, the safety system should detect that pattern.

Another approach is rate limiting or context tracking across sessions. If an orchestrator is making many related queries that individually seem harmless but collectively map to a known harmful domain, the system could flag the pattern. This requires cross-session visibility that most API deployments do not currently maintain.

A third approach is making the decomposition itself harder. If models were trained to recognize when their responses are likely to be composed with other responses to achieve a harmful goal, they could refuse at the subproblem level. But training that judgment requires the model to understand the full space of possible compositions, which is effectively unbounded.

The Broader Pattern

Capability laundering is one instance of a general problem in AI safety: alignment is a property of individual model behaviors, but harm often emerges from the interaction of multiple behaviors across multiple systems. A model that is perfectly aligned in isolation can contribute to harmful outcomes when its outputs are combined with outputs from other models, other tools, or human ingenuity.

This does not mean alignment research is wasted. It means alignment research is necessary but not sufficient. The safety architecture needs to operate at the system level, not just the model level. That requires coordination between model providers, application developers, and the institutions that deploy these systems in sensitive contexts.

The paper's title, Divide, Consult, Conquer, captures the attack's elegance. The decomposition is simple. The consultation is routine. The composition is trivial. The result is a capability transfer that no single safety system was designed to prevent. Addressing this will require rethinking what safety means when capabilities flow across model boundaries through composition rather than direct access.