gadget RSW RMF RCLS RLLM
MT-Bench Init 7 3 8 3
Random 97 ± 2 37 ± 8 62 ± 10 38 ± 4
MMLU Init 21 4 0 13
Random 49 ± 5 6 ± 3 14 ± 7 68 ± 5
GSM8K Init 21 20 0 9
Random 58 ± 8 34 ± 8 37 ± 9 41 ± 7
Table 14: Average upgrade rates when the gadget is not optimized and is either defined to be the the initial set of tokens
or a set of uniformly sampled tokens. The optimization-based approach outperforms these optimization-free approaches.
intro type RSW RMF RCLS RLLM
Up. Down. Up. Down. Up. Down. Up. Down.
MT-Bench
Ours-1 100 0 0 31 33 8 26 7
Ours-2 100 0 0 60 75 0 35 5
Gemini 100 0 0 50 100 0 55 0
GPT 100 0 0 48 46 2 19 7
MMLU
Ours-1 28 0 0 57 2 47 0 42
Ours-2 32 0 0 66 19 26 0 42
Gemini 35 0 0 60 100 0 21 21
GPT 54 0 0 51 0 66 26 23
GSM8K
Ours-1 4 46 0 100 0 77 4 36
Ours-2 6 63 0 100 16 43 2 43
Gemini 4 56 0 100 98 0 9 9
GPT 4 77 0 100 0 95 6 25
Table 15: Average upgrade and downgrade rates of gadgets containing injected instructions to the router. This method
significantly underperforms the optimization-based approach in most cases.
C Optimization-Free Gadget Generation
We evaluate optimization-free alternatives to our black-box optimization method for generating confounder gadgets.
Fixed gadget. A simple way to create a gadget without resorting to optimization is to repeat n tokens. We use ! as the
initialization token, so the gadget in this case is !!!!!!!!!!. Another possibility is to select n tokens uniformly at random.
Table 14 shows the upgrade rates for both options, were in the latter setting we repeat the process 10 times and report the
average result and the standard error. While they are non-negligible, especially for the randomly sampled gadgets, they
significantly underperform the upgrade rates reported in Table 1 for optimized gadgets.
Instruction injection. Prompt injection is a known attack on LLMs [50, 64], thus we consider a gadget consisting of a
direct instruction to the router to treat the query as a complex one and obtain a high-quality response.
We evaluated 4 differently phrased instructions: two created manually and two generated by, respectively, Gemini [61]
and GPT-4o [2], denoted as “ours-1”, “ours-2”, “Gemini”, and “GPT”.
Table 15 reports the results. This method works well in a few cases but poorly in most. This highlights the difference
between attacking LLMs and attacking LLM routers.
D Perplexity issues
In Section 5 we present perplexity as one of the metrics we use for evaluating the effect of our attack over the quality of
the generated response. However, perplexity is intended to measure the naturalness of text, and as such it is ill-suited for
comparing the quality of multiple natural texts. This results with the perplexity values of the responses of both the weak
and the strong model being close and withing the margin of error. Figure 7 shows the distribution of perplexity values of
the clean responses generated by both models, and the ROCAUC score computed on these two sets of values. As can be
seen, the perplexity values are quite similar between both models, with ROCAUC scores ranging between0.38 to 0.47.
24