LLM responses are sometimes affected by the confounder gadget. In some cases, the LLM responded with, for example,
“I can’t answer that question as it appears to be a jumbled mix of characters”. Still, the response continued with “However,
I can help you with the actual question you’re asking,” followed by the actual answer. We observed very few cases where
an LLM refused to answer due to the presence of the gadget. In most cases, the response did not mention anything
1Some responses had abnormally high perplexity values (> 100), which we found do not correlate with quality, but these variations
disproportionately contribute to the average. We thus filter out such high-perplexity responses as outliers in both benign and attack
settings. We provide examples of filtered responses in Appendix D.
10