rather than an external control plane that orchestrates multiple LLMs. MoE has increased in popularity as it allows to
build larger models at a fixed compute budget—not all parameters are used at the same time.
Hayes et al. [34] identified a vulnerability in MoE that can be exploited for a denial-of-service attack against MoE. Thus
control plane integrity issues appear to extend to the context of single-LLM MoE systems, and future work could explore
this connection further.
Yona et al. [67] presented a side-channel attack on MoE that enables an attacker to reveal other users’ prompts. We expect
that side-channel attacks against LLM control planes exist as well, for example, to infer which models are used via timing
of responses. Such attacks, which target confidentiality, are outside the scope of control plane integrity.
10 Conclusion
LLM routers balance quality and cost of LLM inference by routing different queries to different LLMs. They are an
example of a broader, emerging class of systems we call “LLM control planes” that aim to achieve various quality,
efficiency, and cost objectives by orchestrating use of multiple LLMs to respond to a query.
17