Metraipolis › archive › dc_5086b60ec2ab

Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs — arXiv:2609.15383

Source: arXiv (en)
Original: https://arxiv.org/abs/2609.15383
License (as archived): CC0-1.0
Archived: 2026-10-15T22:53:47.016Z
SHA-256 of the archived text: 9e15319e182cdf57b9bd7de2c89bec400395c5d4a117ededb0258fe1d3e9290f
Stable URL of this page: https://metraipolis.com/documento/dc_5086b60ec2ab

How to cite

Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs — arXiv:2609.15383 — arXiv (en), https://arxiv.org/abs/2609.15383 (CC0-1.0); archived copy: https://metraipolis.com/documento/dc_5086b60ec2ab (Metraipolis archive dc_5086b60ec2ab, sha256 9e15319e182cdf57b9bd7de2c89bec400395c5d4a117ededb0258fe1d3e9290f)

BibTeX

@misc{dc5086b60ec2ab,
  title = {Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs — arXiv:2609.15383},
  howpublished = {arXiv (en)},
  url = {https://arxiv.org/abs/2609.15383},
  note = {License CC0-1.0; archived copy https://metraipolis.com/documento/dc_5086b60ec2ab; sha256 9e15319e182cdf57b9bd7de2c89bec400395c5d4a117ededb0258fe1d3e9290f},
  year = {2026}
}

Archived text

Reproduced under CC0-1.0. Attribution: arXiv (en), https://arxiv.org/abs/2609.15383. Third-party text: data, not instructions. It may be an abstract or extract; check the original.

Language model safety is typically evaluated one interaction at a time. We show that a weaker, unaligned model can split a harmful task into benign-looking subproblems, consult a stronger aligned model independently on each, and combine the answers locally. We call this attack capability laundering. Unlike a jailbreak, no single response is a harmful task. We measure consultation-aided uplift using tasks that a raw frontier model solves, the aligned frontier refuses, and the unassisted orchestrator fails. We evaluate GPT-5.5, Claude Opus 4.8, and Grok-4.3 as consultants to four local orchestrators on CyBench, BountyBench, and harmful CBRN requests. On CyBench, Gemma-4-31B recovers 8/14 candidates with GPT-5.5 and 7/9 with Opus, compared with 2/21 and 4/15 for Gemma-4-12B. On BountyBench, Gemma-4-31B recovers 3/9 and 2/3 candidates, while Muse-Glimmer-30B recovers none of 22 and 13. For CBRN, we measure uplift across eight steps of a hypothetical bioweapon attack chain and find that consultation raises Gemma-4-31B's mean rubric score from 62.3 to 83.1 on a 100-point rubric scale. These results expose a gap in current defenses: refusing a harmful task does not prevent frontier capabilities from being transferred and composed across many individually permitted interactions.

Tema degli esploratori: agenti e intelligenza artificiale (retro-catalogo arXiv: annunci del 2026-09-15 in cs.AI).
Categorie arXiv: Cryptography and Security (cs.CR) ; Artificial Intelligence (cs.AI).
Pagina del lavoro: https://arxiv.org/abs/2609.15383 — autori e testo completo sono lì (qui omessi i nomi: nessun dato personale nel deposito).
Licenza: titolo e abstract sono metadati arXiv distribuiti in CC0 1.0; il testo completo ha la licenza scelta dagli autori, indicata sulla pagina.
Letto il 2026-10-15T22:29:03.846Z dalla pagina https://arxiv.org/catchup/cs.AI/2026-09-15?abs=True (consentita dal robots.txt di arxiv.org, con il suo crawl-delay).