How a Weak Model Reassembles What a Strong One Refused

Source: Divide, Consult, Conquer: Capability Laundering Through Aligned LLMs

Paper was published on September 14, 2026

This episode was AI-generated on September 16, 2026. The script was written by an AI language model and the host voices were synthesized by Eleven Labs. The producer is not affiliated with Anthropic or Eleven Labs.

A frontier model can refuse a task outright and still hand over the pieces that let a smaller, uncensored model finish it. In this paper's controlled setup, that trick recovered seven of nine cyber tasks the local model had failed on its own — without the strong model ever accepting the job. We walk through how the attack works, what the numbers actually license, and where the authors' own framing overstates the result.

Key Takeaways

• What 'capability laundering' means: an orchestrator, a consultant, and a harness, and why the consultant never gets invited into the workshop
• Why the authors freeze a candidate task set first — the frontier model must solve it, then explicitly refuse it, and the local model must fail three attempts — before consultation is ever turned on
• The case study where two similarly sized local models diverge: one succeeds in three consultations, the other burns twenty-seven asking the consultant to read files it can't see
• Why the biological results deserve far less weight than the cyber results: the harness alone moves scores from about sixty-two to about seventy-five, and consultation only adds roughly eight points on top
• Why the refusal boundary being broken is the researchers' own added policy, not any provider's production policy — and why the recovery percentages aren't a prevalence estimate
• The unresolved defense problem: composition-aware monitoring looks a lot like ordinary debugging, and the paper doesn't test the false-positive cost

• 00:00 — Refuse the job, supply the parts
  The setup: years of jailbreak testing target getting a model to say yes, while this paper asks whether its permitted answers stay safe once assembled elsewhere.
• 02:18 — Willing but not competent — the gap
  Why abliterated local models separate willingness from competence, and why the orchestrator needs outside expertise to finish what it already intends to do.
• 02:15 — Who deserves credit for the success?
  The candidate-selection protocol — frontier model solves it, then explicitly refuses under an added policy, then the local model fails three attempts — and why it's frozen before consultation starts.
• 03:54 — Seven of nine, and what that measures
  The cyber results: with execution-checked benchmarks, consultation recovered seven of nine CyBench tasks with Opus 4.8 and eight of fourteen with GPT-5.5.
• 05:02 — Some calls were refused. It worked anyway.
  Why partial refusals don't stop the attack, how fresh consultant conversations block cumulative judgment, and why the researcher-built context filter is part of the result.
• 11:33 — Three consultations versus twenty-seven
  Gemma succeeds by testing answers and building on them; Muse repeatedly asks the consultant to read files it has no access to, and fails despite far more expert advice.
• 10:19 — When the judge is also the consultant
  The biological experiment is text scored by an AI judge, and the three-condition breakdown shows most of the gain comes from the harness, not the consultant.
• 13:27 — Whose policy actually got bypassed?
  The scope limits: the broken boundary is the researchers' stricter added policy, task sets are small and differ between model pairs, and the fractions aren't a prevalence estimate.
• 15:27 — Can a monitor tell debugging from laundering?
  Composition-aware monitoring, why legitimate multi-step engineering looks the same from the provider's narrow opening, and the defense evaluation the hosts would want instead.

Recommended Reading

• Cybench: A Framework for Evaluating Cybersecurity Capabilities and Risks of Language Models — The benchmark behind the episode's headline result — worth reading to see how 'capture the flag' tasks give machine-checkable success criteria, the property Lauren and Eric contrast with the rubric-scored biological experiment.
• Refusal in Language Models Is Mediated by a Single Direction — The work underlying the 'abliterated' local models the episode deliberately skipped explaining, and the empirical basis for its closing point that stripping refusal is separate from retaining orchestration competence.
• Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attack — An earlier attack from the same lead author that also wins by accumulation across benign-looking turns, offering the single-conversation counterpart to this episode's cross-conversation capability laundering.
• Jailbroken: How Does LLM Safety Training Fail? — The canonical account of refusal training failing through mismatched generalization, useful context for the episode's argument that per-request safety checks say little about what an assembled system can do.