Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs
Mark Russinovich, Blake Bullwinkel, Giorgio Severi, Cristian Ovadiuc, Ahmed Salem
cs.CR · cs.AI
Quick verdict
Shows weak unaligned LLMs launder frontier capabilities via task decomposition; solid uplift design, but bespoke policy prompt and judge bias temper claims.
Summary
This paper introduces "capability laundering," an attack in which a weak, unaligned local language model (the orchestrator) decomposes a harmful task into benign-looking subproblems, consults a stronger aligned frontier model on each fragment through sessionless API calls, and recombines the answers locally so no single interaction is harmful. Using tasks that the raw frontier model solves, the aligned frontier refuses under a strict custom alignment prompt, and a harness-only orchestrator fails, the authors measure uplift on CyBench (43 CTF tasks), BountyBench exploit workflows (43 scoreable instances), and eight rubric-scored steps of a hypothetical bioweapon chain. With Gemma-4-31B orchestrating, consultation recovers 8/14 CyBench candidates with GPT-5.5 and 7/9 with Claude Opus 4.8, versus 3/9 and 2/3 on BountyBench; weaker or differently trained orchestrators (Gemma-4-12B, Muse-Glimmer-30B) recover far less. CBRN rubric means rise from 62.3 (model alone) to 75.3 (harness-only) to 83.1 with either consultant, judged by Grok-4.3. Main limitations: a bespoke alignment prompt rather than provider-native safeguards, an LLM judge that is also a consultant, small candidate sets without confidence intervals, and attack code withheld pending controlled access.
Review complete
Assessment at a glance
4
risk flags identified
● high 0
● medium 3
● low 1
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- A weak unaligned orchestrator can automate decomposition so that individually policy-compliant frontier consultations compose into capabilities the frontier withholds directly, an attack the authors name capability laundering.
- On CyBench, consultation recovers 57% (8/14) and 78% (7/9) of the measured Gemma-4-31B capability gap with GPT-5.5 and Opus 4.8 respectively; on BountyBench recovery is sparser (3/9 and 2/3).
- Recovery is gated by orchestrator competence: Gemma-4-12B recovers only 2/21 and 4/15 CyBench candidates and Muse-Glimmer-30B none of 22/13 BountyBench candidates.
- CBRN consultation raises Gemma-4-31B's mean rubric score from 75.3 (harness-only) to 83.1 with either consultant, with the largest gains on dual-use upstream stages and none on aerosol formulation.
- Per-request defenses cannot detect composed capability transfer; defenses must preserve provenance and reason across interactions.
Strengths
Task-matched candidate construction isolates causality
Section 4.5 requires raw-frontier solve, trace-confirmed aligned refusal, and harness-only failure (all pass@3) before freezing candidate sets per frontier x orchestrator x benchmark, cleanly separating the consultant's contribution from harness effects - a real methodological advance over KDA and Jones et al. evaluations discussed in Section 2.1.
Honest, multi-level reporting
Harness-only baselines are quantified (Fig 7a; CBRN 62.3 to 75.3 in Table 2), every rate carries numerator/denominator (Section 4.6), persistent failures are enumerated (seven never-solved CyBench candidates, Section 5.2), and Figs 12-13 expose task-level outcomes rather than aggregates only.
Cross-domain, multi-provider coverage
Mechanistic case study of why recovery varies
Responsible disclosure posture
Weaknesses
Bespoke alignment prompt, not provider-native policy
LLM-judge circularity in the CBRN arm
No uncertainty quantification
Abliteration confound and restricted reproducibility
Harness effect rivals the attack effect in CBRN
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
The paper (arXiv 2609.15383, five Microsoft authors) introduces **capability laundering**: a weak, unaligned local SLM (the orchestrator) decomposes a refused harmful objective into benign-looking fragments, consults a stronger aligned frontier model on each fragment via sessionless `consult_ask` calls, and recombines results locally, so no single exchange is harmful (Section 1, Fig 1). The central claim is that per-interaction refusal does not prevent frontier capability transfer under adversarial decomposition. Evidence comes from two arms: (i) cyber uplift on CyBench (43 CTF tasks) and BountyBench Exploit workflows (43 scoreable instances), and (ii) rubric-scored CBRN quality across eight steps of a hypothetical bioweapon chain. The paper positions itself beyond KDA [28] and Jones et al. [7] by demanding causal necessity: candidates must be tasks the orchestrator cannot solve unaided (Sections 2.1, 4.5).
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 4 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is capability laundering in LLMs?
An attack where a weak, unaligned local model splits a harmful task into individually benign-looking sub-questions, asks a stronger safety-aligned model each fragment separately, and reassembles the answers locally. No single response contains the harmful task, so per-request safety filters can approve every exchange while the composed result transfers harmful capability.
How well does the capability laundering attack work?
It depends on the orchestrator. With Gemma-4-31B orchestrating, 8 of 14 CyBench uplift candidates were solved with GPT-5.5 consultation and 7 of 9 with Claude Opus 4.8; on BountyBench exploit tasks, 3 of 9 and 2 of 3. Weaker orchestrators (Gemma-4-12B, Muse-Glimmer-30B) recovered far less, and CBRN rubric means rose from 75.3 to 83.1 with consultation.
Is the attack code or paper artifact publicly available?
No. The authors explicitly withhold the attack implementation and automation code, providing them only to qualified researchers through controlled access; the alignment prompts are promised for public release but appear in the paper only as summarized operative clauses.
How was the CBRN (biological) harm measured?
By rubric score, not binary success: a CBRN expert wrote 100-point operational rubrics for eight steps of a hypothetical bioweapon chain, and an LLM judge (Grok-4.3) scored 25 responses per step per condition. Higher scores mean more operationally coherent plans; the authors caution this does not prove real-world capability.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 8, 11 and the difficulty breakdown (Figure 6) are image/garbled in the extracted text; CBRN stage-level numbers were taken from Table 2 instead.
- Alignment prompts appear only as summarized operative clauses (Figs 9-10); full prompt wording, which may materially affect refusal behavior, is not shown.
- Fig 7a panel values for Muse-Glimmer harness-only performance are partially garbled in extraction; only figures stated in prose were relied upon.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.