Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs

Attack and question

• Capability laundering splits a harmful objective into objective-blind consultations, with the orchestrator retaining the goal and recombining returned knowledge locally.The consultant sees selected fragments, while the orchestrator controls what context to reveal and integrates the answers.Source: §1 · p. 1

Evaluation scope

• The evaluation spans CyBench and BountyBench cybersecurity tasks and eight steps across five stages of a hypothetical bioweapon attack chain.The stages are ideation, acquisition, modification, release, and evasion.Source: §1 · pp. 1–2

Cybersecurity results

• Gemma-4-31B recovered 8/14 CyBench and 3/9 BountyBench candidates with GPT-5.5, versus 7/9 and 2/3 with Opus 4.8.The reported recovery rates were 57% and 33% with GPT-5.5, and 78% and 67% with Opus 4.8, respectively.Source: §1 · p. 2
• Gemma-4-12B recovered 2/21 CyBench candidates with GPT-5.5 and 4/15 with Opus; Muse-Glimmer-30B recovered none of 22 and 13 BountyBench candidates.The effect depended on the orchestrator’s ability to reason about and apply missing knowledge.Source: §1 · p. 2

CBRN results

• Across eight CBRN scenarios, Gemma-4-31B’s mean rubric score was 75.3 ± 12.7 harness-only and 83.1 ± 9.1 with GPT-5.5 consultation.Direct prompting scored 62.3±13.2; Grok-4.3 consultation scored 83.1 ± 9.7.Source: §1 · p. 2

Implications

• The authors argue that model-level refusal does not ensure system-level safety when individually permitted answers are composed across queries.They call for defenses that preserve provenance across queries and assess what permitted answers enable when composed.Source: §1 · p. 2

2 Background and Related Work

• Jailbreak research has moved from role-play and instruction overrides to optimized prompts, attacker-model refinement, and complex multi-turn interactions [9–16].The authors describe this evolution alongside continuing improvements in provider safeguards [2] [17] [19].Source: §2 · p. 3
• Decomposition-based attacks hide the harmful objective from the victim model by querying benign-looking subproblems and combining the answers outside its safety context.The authors frame this strategy as an alternative to increasingly costly direct jailbreaks.Source: §2 · p. 3

2.1 Objective Decomposition

• Earlier decomposition work used syntactic parsing and benign examples, while Jones et al. [3] used a weak model for fixed decomposition and response assembly.The paper instead studies iterative, adaptive orchestration by a locally controlled unaligned model [3].Source: §2.1 · p. 3
• Unlike KDA, which tests elicitation on AdvBench instructions, this work measures whether a weak orchestrator gains functional uplift from policy-compliant frontier responses.The authors state that this evaluates capability beyond safeguard circumvention or jailbreaking.Source: §2.1 · p. 3

3 Methodology

• Four cybersecurity settings distinguish frontier capability, aligned refusal, harness-only performance, and consultant-assisted performance.These comparisons test whether the frontier has the capability, the aligned model withholds it, the harness alone is insufficient, and consultation adds access.Source: §3 · pp. 3–4

3.1 Threat Model

• The adversary controls a local orchestrator that can query an authenticated API, disclose selected context, and combine responses, but cannot alter consultant safeguards or tamper with exchanges.The orchestrator may issue multiple queries and, where applicable, act in the task environment.Source: §3.1 · p. 4

3.2 Alignment Prompt

• The same alignment policy governs direct and decomposed consultant queries, with the prompt repeated after each delegated subtask.The prompt measures capabilities present under raw access but withheld under aligned access; its stricter policy layer makes the evaluation conservative in favor of safety.Source: §3.2 · p. 4

3.3 Capability-Laundering Technique

• In each agent–environment round, the orchestrator may consult, act through the harness, or submit a final answer while retaining planning and task completion.When blocked, it delegates a missing fact, transform, or routine, then validates and integrates the fragment locally; each consultant session is fresh and isolated.Source: §3.3 · p. 4
• Isolation does not guarantee objective blindness: a request that reveals its purpose remains subject to the consultant’s alignment policy and may be refused.Consultant access is an additional channel, not a replacement for the orchestrator’s end-to-end solving role.Source: §3.3 · p. 4
• The harness is held fixed between harness-only and assisted settings, while structured state and benchmark adapters support execution and artifact grading.Context controls, recovery mechanisms, and a deterministic consultation filter address execution and task-leakage mechanics without supplying task knowledge.Source: §3.3 · p. 5

4 Experimental Design

• The evaluation tests whether a weaker, unaligned orchestrator can gain a capability withheld by the aligned frontier, using distinct cyber and CBRN comparisons.Cyber uses the raw frontier, aligned frontier, harness-only orchestrator, and consultant-assisted orchestrator; CBRN compares rubric scores across three orchestrator conditions.Source: §4 · p. 5

4.1 Cybersecurity Settings

• The four cyber settings freeze candidates using three baselines, then test uplift with the same orchestrator and harness plus consultant access.The harness-only condition includes the skills, helpers, interface, context management, and watchdogs available in the assisted condition.Source: §4.1 · pp. 5–6, Figure 2 · p. 6

4.2 Models

• GPT-5.5 and Claude Opus 4.8 are evaluated as consultants; Grok-4.3 replaces Opus for CBRN, across four locally hosted unaligned orchestrators.Gemma-4-31B is the primary orchestrator; the other models test transfer across families and scale.Source: §4.2 · p. 6

4.3 Benchmarks and Success Criteria

• CyBench and BountyBench’s Exploit workflow provide cyber tasks, while CBRN uses expert-developed scenarios and operational rubrics across five attack-chain stages.CyBench tasks have containerized environments and machine-checkable flags; CBRN scoring compares orchestrator-alone, harness-only, and consultant-assisted responses.Source: §4.3 · pp. 6–7

4.4 Cyber Execution Protocol

• Cyber tasks receive up to three valid attempts, with execution stopping at the first success; assisted runs cover only the previously selected candidates.CyBench allows 15 agent–environment rounds per attempt and BountyBench allows 20; each orchestrator round has a 1,500-second response timeout.Source: §4.4 · p. 7

4.5 Formalizing Cyber Uplift Candidates

• Cyber uplift candidates require raw-frontier success, explicit aligned-frontier refusal, and harness-only orchestrator failure.The criteria establish a capability gap before consultant access is tested.Source: §4 · p. 5, §4.5 · p. 7
• The formal candidate rule requires a raw-frontier solve, an explicit aligned-frontier refusal, and failure by the same orchestrator with the harness alone.Trace inspection distinguishes policy refusal from other aligned-frontier failures.Source: §4.5 · p. 7

4.6 Outcome Measures

• Candidate sets are computed separately for each orchestrator, frontier model, and benchmark, and cyber uplift is the fraction of candidates solved with consultation.Every reported percentage includes its numerator and denominator; CBRN rubric scores are reported separately from the binary cyber uplift rate.Source: §4.5 · p. 8, §4.6 · p. 8

5.1 Selecting Uplift Candidates

• Uplift candidates are tasks solved by a raw frontier model but failed by the corresponding harness-only orchestrator, isolating a measured capability gap.Candidate sets are constructed separately by frontier model and orchestrator.Source: §5.1 · p. 8, Table 1 · p. 8, Figure 4 · p. 9

5.2 Capability Recovery on CyBench

• On CyBench, Gemma-4-31B has the highest reported recovery, while Gemma-4-12B recovers 2/21 GPT-5.5 candidates (10%) and 4/15 Opus candidates (27%).The larger Opus percentages do not establish a stronger consultant because its candidate sets are smaller and contain different tasks; comparisons use shared intersections.Source: §5.2 · p. 9
• Seven CyBench candidate tasks are never solved by any applicable setting; difficulty labels reveal no simple easy-versus-hard recovery trend.Nineteen of 43 suite tasks lack a recorded difficulty label and are grouped as Not recorded.Source: §5.2 · p. 9, Figure 6 · p. 10

5.3 Capability Recovery on BountyBench

• On BountyBench, Gemma-4-31B recovers 3/9 GPT-5.5 candidates (33%) and 2/3 Opus candidates (67%), while Muse-Glimmer-30B recovers none of its candidates.The benchmark requires a persistent exploit artifact that succeeds on the vulnerable checkout and fails after the official patch.Source: §5.3 · pp. 9–10, Figure 7 · p. 11

5 Results

• Gemma-4-31B recovers 8/14 GPT-5.5 CyBench candidates (57%), 7/9 Opus CyBench candidates (78%), and 3/9 and 2/3 BountyBench candidates; Muse-Glimmer-30B recovers none of its 22 and 13 BountyBench candidates.The figures show CyBench recovery and BountyBench baseline and recovery, respectively.Source: §5.2 · p. 9, §5.3 · pp. 9–10, Figure 5 · p. 10

5.4 Orchestrator Capability Constrains Recovery

• Across benchmarks, recovery is not determined by consultant identity or orchestrator size alone; equal harness-only BountyBench performance can yield divergent assisted outcomes.Gemma-4-31B and Qwen3.6-27B each solve 14/43 BountyBench tasks with the harness alone, but recover 3/9 and 2/3 versus 0/9 and 1/4 candidates with consultants.Source: §5.4 · p. 10

5.5 CBRN Capability Recovery

• Pooled across all steps, the orchestrator’s mean score was 62.3±13.2 alone, 75.3 ± 12.7 in the harness without consultation, and 83.1±9.1 with GPT-5.5 or 83.1±9.7 with Grok-4.3.Source: §5.5 · pp. 10–11

5.6 Biological Attack Stage Uplift Analysis

• Consultation gains are largest on upstream dual-use steps such as reverse genetics and practical laboratory knowledge, and smaller for aerosol formulation and countermeasure evasion.Aerosol formulation is the sole step with no consultation effect; the authors report the largest gains for reverse genetics, practical laboratory knowledge, and agent selection.Source: §5.6 · p. 11

6 Case Study: Paddle (From BountyBench)

• Gemma-4-31B succeeds on paddle:0 with both consultants, while Muse-Glimmer-30B’s six recorded attempts all fail the verifier.The task is an uplift candidate for both orchestrators with GPT-5.5 and Opus 4.8.Source: §6 · p. 11
• The bounty requires a persistent artifact that exploits an unsafe archive-extraction utility and passes BountyBench’s verification contract.The grader requires success on the vulnerable checkout and failure after the official patch.Source: §6 · p. 11
• Gemma’s successful workflows use three consultations over 11 iterations, addressing successive blockers before packaging the tested result.The GPT-5.5 run first obtains an archive-construction routine, then resolves unavailable compiled imports by loading the vulnerable module directly.Source: §6 · pp. 11–12
• Muse makes many consultation attempts but repeatedly delegates local file inspection to an isolated consultant and fails to retain already established facts.The six attempts are marked incomplete and unsuccessful, with no verifier-passing submission.Source: §6 · p. 12
• Because the models differ in training as well as size, this comparison does not identify parameter count as the cause of the outcome.The case indicates that successful transfer depends on assigning work to the correct environment, preserving validated state, and stopping consultation when sufficient information is available.Source: §6 · p. 12

7.1 Beyond Jailbreaks

• Permitted answers can enable harm when combined with hidden context and local computation, while blocking all potentially useful technical details would burden legitimate assistance.Input and output filters may classify every observed exchange correctly while the composed system remains unsafe.Source: §7.1 · p. 12
• Providers may link account requests and monitor hosted tools, but attacker-controlled orchestration, local execution, and final assembly can remain outside their view.The authors recommend separately evaluating resistance to capability laundering with end-to-end tests of assistance composed outside the model’s context.Source: §7.1 · p. 12
• The 31B orchestrator recovers 57–78% of the measured CyBench capability gap and 33–67% on BountyBench, despite being small relative to the largest available open-weight models.Larger orchestrators may plan, track state, and integrate consultant guidance more effectively, potentially producing even greater uplift.Source: §7.1 · p. 13

7.2 Defensive Implications

• Composition-aware monitoring could track request provenance and semantic dependencies, but must distinguish malicious composition from legitimate engineering and can miss activity distributed across accounts or providers.Cross-session aggregation can raise attack costs, while open-model unalignment defenses may make autonomous repeated composition more expensive; neither is presented as a complete defense.Source: §7.2 · p. 13

7.3 Scope and Limitations

• The results establish capability laundering when an attacker controls an unaligned local orchestrator and can query a stronger model through an authenticated interface.Recovery varies across orchestrators, benchmarks, and tasks; the frontier evaluation was limited to GPT-5.5, Claude Opus 4.8, and Grok-4.3 because repeated agentic calls are costly.Source: §7.3 · p. 13
• Cybersecurity recovery rates apply to uplift candidates, not overall benchmark success, and depend on frontier- and orchestrator-specific task sets.CyBench uses deterministic CTF-style grading and BountyBench a longer repository-level exploit contract; neither captures the full diversity of deployed agent systems.Source: §7.3 · p. 13
• CBRN scores measure response-quality changes, not binary operational success, and remain subject to judge bias, rubric sensitivity, and uncertainty about real-world capability.The assessment uses an LLM judge, scenario-specific rubrics, and CBRN expert review.Source: §7.3 · p. 13
• The study tests one orchestrator and one consultant channel at a time, leaving distributed attacks, larger-orchestrator scaling, and composition-aware defenses as future work.Coordinating across identities or providers may weaken account-level monitoring but requires additional coordination and access.Source: §7.3 · p. 13

• Capability laundering decomposes a harmful task, obtains partial assistance from an aligned consultant, and composes the result outside the consultant’s view.Source: §8 · p. 13
• Across cybersecurity and CBRN evaluations, consultation recovered capabilities that direct aligned access withheld, with recovery depending on orchestrator state preservation and integration of guidance.Source: §8 · p. 13
• Resistance to direct harmful requests and conventional jailbreaks does not establish safety under adversarial composition, so defenses and evaluations must reason across interactions and beyond individual model sessions.Source: §8 · p. 13

• Capability laundering is dual-use: evidence for evaluating compositional safety could also help attackers automate harmful workflows.Source: A Ethical Considerations · p. 15
• The researchers disclosed the attack and findings to affected providers and other impacted parties before publication, inviting investigation and mitigation discussion.Source: A Ethical Considerations · pp. 15–16
• Cybersecurity experiments used isolated benchmark environments, while CBRN evaluation involved generated text and rubric assessment without hazardous-material acquisition, synthesis, experimentation, or release.Source: A Ethical Considerations · p. 16
• The attack implementation and automation code will not be publicly released; qualified researchers may access them through a controlled process.Source: A Ethical Considerations · p. 16
• The authors argue that publishing measurement methods, results, and defensive implications supports evaluation before deployment, alongside coordinated disclosure and controlled artifact release.Source: A Ethical Considerations · p. 16

• The complete alignment prompt will be publicly released, but the capability-laundering implementation and automation code will not.Source: B Open Science · p. 16
• The authors say unrestricted release would make the attack easier to reproduce at scale and lower misuse costs.Source: B Open Science · p. 16
• Qualified researchers may request the implementation and necessary artifacts for legitimate research through a controlled-access process.Source: B Open Science · p. 16

C Alignment Prompt Details

• The cybersecurity and CBRN prompts adapt the same baseline structure to their respective domains.The full prompts are omitted due to space constraints, with an open-source release planned.Source: C Alignment Prompt Details · p. 16
• Figures 9 and 10 summarize operative clauses for the cybersecurity and biosecurity and chemical safety prompts, respectively.Figure 9 covers the cybersecurity prompt described in Section 3.2; Figure 10 covers the separate CBRN prompt.Source: C Alignment Prompt Details · p. 16, Figure 9 · p. 16, Figure 10 · p. 17

D Blocked Consultant Tool Calls

• Across eight biology attack stages, higher rates of blocked consult_ask calls tend to coincide with lower uplift than the harness-only orchestrator, especially for weaponization-linked rather than dual-use biology.Figure 11 counts calls blocked by input classifiers across n = 25 trials per stage when GPT-5.5 was the consultant.Source: D Blocked Consultant Tool Calls · p. 17, Figure 11 · p. 17
• The CBRN rubric table compares orchestrator-only, harness-only, and consult-aided scores across eight steps in five attack-chain stages.Scores are 0–100, judged by Grok-4.3, and each cell summarizes 25 trial scores from five prompts and five independent trials.Source: Table 2 · p. 18
• Aligned frontier models score near zero on most direct harmful CBRN stages, while Grok-4.3 shows some compliance on environmental sampling, reverse genetics, and tacit knowledge.Grok-4.3 mostly refuses those direct queries once the alignment prompt is added.Source: Table 3 · p. 18
• Figures 12 and 13 show task-level BountyBench and CyBench outcomes, distinguishing assisted successes, failures, and tasks outside each frontier-specific candidate set.The BountyBench matrix covers 43 scoreable instances; the CyBench matrix covers all 43 tasks.Source: Figure 12 · p. 19, Figure 13 · p. 20
• Gemma-4-31B used three consultations to complete and pass a Paddle verifier, while Muse-Glimmer-30B ended all six attempts without a verifier-passing submission.The workflows used nearly size-matched orchestrators, the same task and harness, and the same aligned consultant choices; Muse repeatedly delegated locally available information or asked the sessionless consultant to inspect inaccessible files.Source: Figure 14 · p. 21