mlsanityData to 14 Oct 2026

Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs

arXiv 2609.15383 ↗First posted 14 Sep 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Language model safety is typically evaluated one interaction at a time. We show that a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally. We call this attack capability laundering. Unlike a jailbreak, no single response is a harmful task. We measure consultation-aided uplift using tasks that a raw frontier model solves, the aligned frontier refuses, and the unassisted orchestrator fails. We evaluate GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and harmful CBRN requests. On CyBench, Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus, compared with 2/21 and 4/15 for Gemma-4-12B. On BountyBench, Gemma-4-31B recovers 3/9 and 2/3 candidates, while Muse-Glimmer-30B recovers none of 22 and 13. For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale. These results expose a gap in current defenses: refusing a harmful task does not prevent frontier capabilities from being transferred and composed across many individually permitted interactions.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Builds on 20 of its 28 references that are in the map. First posted on arXiv 14 Sep 2026.

Builds on

20 of 28 references.

References · 20

  1. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 1,032
  2. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  3. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 390
  4. 2025Constitutional Classifiers: Defending against Universal Jailbreaks across Thousands of Hours of Red Teamingcited by 181
  5. 2023Large Language Models are Versatile Decomposers: Decompose Evidence and Questions for Table-based Reasoningcited by 178
  6. 2024Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Modelscited by 164
  7. 2024A Comprehensive Study of Jailbreak Attack versus Defense for Large Language Modelscited by 106
  8. 2024DrAttack: Prompt Decomposition and Reconstruction Makes Powerful LLM Jailbreakerscited by 101
  9. 2022Successive Prompting for Decomposing Complex Questionscited by 94
  10. 2024Against The Achilles' Heel: A Survey on Red Teaming for Generative Modelscited by 59
  11. 2025BountyBench: Dollar Impact of AI Agent Attackers and Defenders on Real-World Cybersecurity Systemscited by 40
  12. 2025Chasing Moving Targets with Online Self-Play Reinforcement Learning for Safer Language Modelscited by 39
8 more
  1. 2024Adversaries Can Misuse Combinations of Safe Modelscited by 32
  2. 2025Monitoring Decomposition Attacks in LLMs with Lightweight Sequential Monitorscited by 25
  3. 2025SoK: Evaluating Jailbreak Guardrails for Large Language Modelscited by 21
  4. 2026Comparison requires valid measurement: Rethinking attack success rate comparisons in AI red teamingcited by 15
  5. 2025Latent-space adversarial training with post-aware calibration for defending large language models against jailbreak attackscited by 7
  6. 2026GRP-Obliteration: Unaligning LLMs With a Single Unlabeled Promptcited by 7
  7. 2026Not All Refusals Are Equal: How Safety Alignment Fails Cybersecurity at Scalecited by 1
  8. 2026Decomposition Attacks Across Unlinkable Identities: Limits of Stateful Defenses for LLM Servicescited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026On-Policy Distillation for LLM Safety: A Routing Approach to Template-Robust Realignment
  2. 2026When Skills Meet Safety: Benchmarking and Characterizing the Adaptive Jailbreak Robustness of Skill-Merged LLMs
  3. 2025Why Safeguarded Ships Run Aground? Aligned Large Language Models' Safety Mechanisms Tend to Be Anchored in The Template Region
  4. 2026Capability-Gated Language Models: Security Composes, Utility Does Not
  5. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deep
  6. 2026Few Tokens, Big Leverage: Preserving Safety Alignment by Constraining Safety Tokens during Fine-tuning
  7. 2025LLM-Safety Evaluations Lack Robustness
  8. 2025Decoding One Safety Trigger Token for Balancing Safety and Usability in Large Language Models