[48] N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against
machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security,
2017.
[49] N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in
adversarial settings,” in IEEE European symposium on security and privacy (EuroS&P), 2016.
[50] F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” in NeurIPS ML Safety
Workshop, 2022.
[51] A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, “Language models are unsupervised
multitask learners,” https://cdn.openai.com/better-language-models/language models are unsupervised multitask
learners.pdf, 2019.
[52] C. Riquelme, J. Puigcerver, B. Mustafa, M. Neumann, R. Jenatton, A. Susano Pinto, D. Keysers, and N. Houlsby,
“Scaling vision with sparse mixture of experts,” Advances in Neural Information Processing Systems (NeurIPS) ,
2021.
[53] M. ˇSakota, M. Peyrard, and R. West, “Fly-swat or cannon? cost-effective language model choice via meta-modeling,”
in Proceedings of the 17th ACM International Conference on Web Search and Data Mining, 2024.
[54] S. Schulhoff, J. Pinto, A. Khan, L.-F. Bouchard, C. Si, S. Anati, V . Tagliabue, A. Kost, C. Carnahan, and J. Boyd-
Graber, “Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt
hacking competition,” in EMNLP, 2023.
[55] A. Shafran, R. Schuster, and V . Shmatikov, “Machine against the RAG: Jamming retrieval-augmented generation
with blocker documents,” arXiv preprint arXiv:2406.05870, 2024.
[56] N. Shazeer, A. Mirhoseini, K. Maziarz, A. Davis, Q. Le, G. Hinton, and J. Dean, “Outrageously large neural net-
works: The sparsely-gated mixture-of-experts layer,” in International Conference on Learning Representations ,
2016.
[57] T. Shnitzer, A. Ou, M. Silva, K. Soule, Y . Sun, J. Solomon, N. Thompson, and M. Yurochkin, “Large language model
routing with benchmark datasets,” arXiv preprint arXiv:2309.15789, 2023.
[58] K. Srivatsa, K. K. Maurya, and E. Kochmar, “Harnessing the power of multiple minds: Lessons learned from LLM
routing,” arXiv preprint arXiv:2405.00467, 2024.
[59] D. Stripelis, Z. Hu, J. Zhang, Z. Xu, A. Shah, H. Jin, Y . Yao, S. Avestimehr, and C. He, “Tensoropera router: A
multi-model router for efficient LLM inference,” arXiv preprint arXiv:2408.12320, 2024.
[60] C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of
neural networks,” arXiv preprint arXiv:1312.6199, 2013.
[61] G. Team, R. Anil, S. Borgeaud, J.-B. Alayrac, J. Yu, R. Soricut, J. Schalkwyk, A. M. Dai, A. Hauth, K. Millican
et al., “Gemini: a family of highly capable multimodal models,” arXiv preprint arXiv:2312.11805, 2023.
[62] Teknium, “Openhermes 2.5: An open dataset of synthetic data for generalist LLM assistants,” 2023. [Online].
Available: https://huggingface.co/datasets/teknium/OpenHermes-2.5
[63] H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale
et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288, 2023.
[64] S. Toyer, O. Watkins, E. A. Mendes, J. Svegliato, L. Bailey, T. Wang, I. Ong, K. Elmaaroufi, P. Abbeel, T. Darrell
et al., “Tensor Trust: Interpretable prompt injection attacks from an online game,” in International Conference on
Learning Representations (ICLR), 2023.
[65] F. Tram `er, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction
APIs,” in USENIX Security Symposium, 2016.
[66] A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does LLM safety training fail?” in Advances in Neural
Information Processing Systems (NeurIPS), 2023.