making them readily distinguishable from the original queries. For instance, in the case of the RSW router, setting the
threshold value at55 yields a false-positive rate of3% and a true-positive rate of97%. Results are similar for other gadgets
and benchmarks and were omitted due to space constraints.
Unfortunately, this defense can be evaded if an adversary incorporates a perplexity constraint into the gadget generation
process. To demonstrate the feasibility of this evasion strategy, we modify gadget generation to maximize the score of the
routing algorithm R and simultaneously aligning the the gadget’s perplexity to some predefined perplexity value. In more
detail, in each iteration t ∈ [T], we uniformly sample a target index j ∈ [1, n] and generate a set B of B + 1candidates as
explained in Section 4. We then modify Eq. 1 such that we now find the candidate that maximizes the difference between
the router’s score and the perplexity constraint for the confounder:
c(t+1) ← arg max
c∈B

Sθ(c∥xi) − α · |PPL(c) − ρ|

,
14