A weak local model launders frontier capability by splitting the task.

An unaligned orchestrator consults an aligned frontier model on individually benign subproblems and recombines the answers locally, so no single response is harmful (arXiv 2609.15383). With GPT-5.5 as consultant, Gemma-4-31B recovers 8 of 14 CyBench candidates it couldn't solve alone, 7 of 9 with Claude Opus 4.8. On an eight-step bioweapon attack chain, consultation lifts its mean rubric score from 62.3 to 83.1 out of 100. Per-interaction refusal does not stop capability transfer, which is a hard problem for every safety approach that evaluates one turn at a time.