where I(ij) = 1 if ij = s and I(ij) = 0 if ij = w. In other words, the predicate is that the fraction of queries routed to the
strong model is bounded by ϵ.
Control plane integrity. A control plane integrity adversaryis a randomized algorithm A that seeks to maliciously guide
inference flow.
In an unconstrained LLM control plane integrity attack, the adversary A seeks to generate inputs ⃗ x= ⃗ x1, . . . , ⃗ xq such
that running RM
ω (⃗ x) generates a transcript for which P((x1, i1), . . . ,(xq, iq)) = 0. This attack could be launched by an
adversary who wants to maximize inference costs for a victim application using an LLM router.
A harder setting requires input adaptation, where the adversary is given inputs x1, . . . , xq and it must find new inputs
ˆx1, . . . ,ˆxq for which the transcript resulting fromP((ˆx1, i1), . . . ,(ˆxq, iq)) = 0. There will be some competing constraint,
such as that xj and ˆxj are very similar for each j, or that the outputs yj ←$ RM
ω (xj) and ˆyj ←$ RM
ω (ˆxj) are close. In the
routing context, the adversary’s goal is to increase the fraction of queries that get routed to the strong model, in order to
improve the overall quality of responses, drive up the victim application’s inference costs, or both.
Relationship to evasion attacks. Evasion attacks [25, 43, 60] against an inference system (also called adversarial exam-
ples [32, 48, 49]) would, in our setting, seek to find a small modification∆ to an input x such that RM
ω (x + ∆) ̸= RM
ω (x)
where addition is appropriately defined based on input type (e.g., slight changes to text).
Our attack setting is not the same. The control plane integrity adversary seeks to maliciously control the inferenceflow, not
necessarily the output of inference. In an unconstrained attack, the adversary does not care what outputs are generated.
In the input adaptation attack, the adversary seeks to craft inputs that modify the inference flow yet do not change the
responses of the strong underlying LLM to the extent possible. Looking ahead, we will use evasion techniques in our
adaptation attacks against learned control plane routers, but, importantly, not the overall inference.
In the other direction, undermining LLM control plane integrity could be a stepping stone toward evasion attacks. For
example, if RM
ω is used to classify malicious content by combining LLMs each tuned to different types of harm categories,
then modifying inputs to force inference flows away from appropriate models could aid evasion. We leave evaluation of
how control-plane integrity attacks can enable evasion to future work.
Threat models. Within the context of control plane integrity attacks against LLM routers, we identify several threat
models that differ in terms of the adversary’s goals and their knowledge about the target control planeRM
ω .
In terms of goals, an adversary may seek to inflate the costs of a victim application that utilizes an LLM control plane.
As a kind of denial-of-service attack, such cost inflation would penalize the application developer who expects routing
to control costs. Another adversarial goal could be arbitrage: consider an application that charges X dollars per query,
whereas directly using Ms costs Y > X. The application’s lower rate X makes economic sense assuming it uses a router
to route the bulk of queries to a cheaper model Mw. An input adaptation attack in this setting can gain (indirect) access to
Ms, obtaining an arbitrage advantage of Y − X per query. To be effective, this arbitrage adversary would want to ensure
that adaptations do not lower response quality (i.e., it extracts all the value out of rerouting to Ms). As before, the victim
in this case is the application that relies on routing to lower its costs (unsuccessfully, under this attack).
We now discuss adversarial capabilities. We assume that our victim application’s prompt includes a substring that can be