How it works

One distillation copies misalignment into a weaker model unable to hide it. A second extracts only safe capabilities, leaving misalignment behind.