will be evaluated with respect to this pair, which we refer to as LLM pair 1. We performed more limited experiments with
the original strong, weak model pair (LLM pair 4) and had similar success in rerouting.
We additionally performed experiments with two further weaker models, in order to better evaluate the case where weak
models produce much lower-quality responses for queries (compared to the strong model). In particular, we define LLM
pair 2 as the strong model plus Mistral-7B-Instruct-v0.3 [38] and LLM pair 3 as the strong model plus Llama-2-7B-chat-
hf [63]. The weaker models in pairs 2 and 3 were chosen to represent smaller (Mistral 7B) and older-generation (Llama-2)
models: according to the Chatbot Arena LLM ranking leaderboard [1, 21], Llama-3.1-8B is ranked in the 58th place,
Mixtral 8x7B at the 88th place, Mistral-7B at the 108th place, and Llama-2-7B at the 125th place.
The LLM strong-weak pairs with which we performed experiments are summarized in Figure 3.
Evaluation datasets. We will evaluate our attacks using three standard LLM benchmarks as workloads: MT-Bench [71],
a dataset of 160 open-ended questions, MMLU [35], a dataset of 14,042 multi-choice questions, and GSM8K [24], a
dataset of 1,319 grade-school math problems. Note that Ong et al. [47] flagged that some data points are “contaminated”,
i.e., they are too similar to the ones used in their training of the routers. We use these datasets without these contaminated
elements, resulting in 72 MT-bench queries, 14,037 MMLU queries, and 1,307 GSM8K queries.
For MMLU and GSM8K, we will require that the LLMs respond in a predefined format so we can parse and compare
the responses to ground-truth answers. To facilitate this, we prepended formatting instructions to the query, inserted as
a prefix before the gadget in the case of confounded queries. In other words, a confounded query ends up defined as
ˆxi = instr∥c∥xi for instruction template instr, confounder gadget c, and original query xi. Thus in this case we model
a scenario where the adversary only controls a part of the prompt rather than the entire prompt. See Appendix B for
formatting examples and ablations.
Router calibration. For each workload, we must calibrate each router by setting the threshold τ to achieve some target
fraction ϵ of queries routed to the strong model. Note that the calibration process we use is agnostic to the underlying
LLM pair. We therefore must define 12 distinct thresholds, one for each router, dataset pair. For our experiments here,
we set ϵ = 0.5, meaning the goal is to have about half the queries routed to the strong model. This reflects an application
developer that seeks to control for costs, even if it may mean sacrificing some performance for some workloads.
To calibrate for MT-bench, we use the Chatbot Arena [21] dataset as the calibration set, computing the threshold using
the 55 K queries for which Ong et al. precomputed the scoring function outputs. To calibrate for MMLU and GSM8K,
we select 1,000 queries uniformly at random and uses these to set thresholds. Looking ahead, we do not use these queries
during evaluation of the attacks.
Note that it important that the distribution of calibration queries be similar to the distribution of the target workload (and,
in our experiments, the test queries). We observed that the Chatbot Arena-based threshold did not transfer well to MMLU
and GSM8K, resulting in the majority of queries (≈ 98%) routed to the strong model.
6 Rerouting Open-Source Routers
We now empirically evaluate our rerouting attack against the open-source routers described in the previous section. Unless
otherwise specified, our evaluation focuses on the query-independent attack setting where the attacker first finds a fixed
set of gadgets and then uses them to attack arbitrarily many queries. This is the conservative setting, and query-specific
gadgets — which carry a higher computational cost — generally work better.