Can a dangerous goal slip past AI safety checks by being chopped into small steps that each look harmless?
Can task decomposition fragment harmful objectives into locally plausible subtasks?
This explores whether a harmful goal can be split into small steps that each look innocent, so that no single step trips a safety check, and what the corpus says about why that works.
This explores whether splitting a harmful goal into small steps that each look innocent can get past safety checks. The corpus says yes, and it says the cause is the same task-splitting that makes multi-agent systems useful. SafeFlow shows that splitting tasks and giving each agent a specialized role creates a blind spot. Malicious intent can be spread across steps that each look benign, and the harm only appears when the pieces are put together Can task decomposition hide harmful intent across agents?. No single step is objectionable, so a check that reads one step at a time has nothing to flag.
This blind spot is not an accidental bug. Engineers build the same property in on purpose. LLM Programs put each model call inside an explicit algorithm and show it only the context for that step, hiding everything else. That makes complex tasks modular and debuggable Can algorithms control LLM reasoning better than LLMs alone?. Hiding information helps reliability, but it hurts oversight, because a model that can't see the overall goal can't object to it. Splitting the planner from the solver works the same way. Separate decomposer and solver models beat a single monolithic model, and the finding that decomposition skill transfers across domains while solving skill doesn't is a notable detail Does separating planning from execution improve reasoning accuracy?. This is my inference rather than something the note claims. If the planning half is the portable skill, it is also the half an attacker needs, and the solver only ever sees a small, harmless-looking piece.
The MAKER result shows how far this can go. Extreme decomposition into minimal subtasks, with voting at every step, let small non-reasoning models run million-step tasks with zero errors Can extreme task decomposition enable reliable execution at million-step scale?. That paper is about accuracy, not safety. But voting and correlated-error flagging catch wrong answers, not wrong purposes. Nothing in the mechanism described would stop a fragmented harmful plan from being executed just as reliably as a benign one.
The corpus has one note on the attack itself and no notes on defenses. The other notes cover decomposition as an engineering tool, and I'm connecting them to the safety question myself. The pattern they suggest is a trade-off. The more finely a task is cut, and the more context is hidden at each step, the more reliability you gain and the less oversight you keep. That points toward checking the composed plan, or the whole trajectory of steps, rather than checking each step alone.