We now discuss adversarial capabilities. We assume that our victim application’s prompt includes a substring that can be
controlled by the adversary. This represents many real-world apps such as chatbots, coding assistants, writing assistants,
and others, that insert user inputs into an LLM prompt. In crafting adversarial portions of prompts, an adversary may have
various levels of knowledge about the victim application’s router. We consider the following knowledge settings:
• White-box setting: The adversary knows the control plane algorithm and its parameters ω.
• Black-box (transfer) setting: The adversary does not know the control plane algorithm R and ω for the target model,
but knows instead another control plane algorithm R′
ω′ and its parameters. We refer to R′
ω′ as the surrogate. For
example, this could arise if an adversary trains their own router using available data. In this setting our attacks are
also zero-shot in that they do not require any interaction with the target control plane before the query that is being
rerouted.
4 Confounding Control Planes with Gadgets
We now turn to our main contribution: a methodology for attacking LLM control plane integrity. The key insight is that
an adversary can modify queries to mislead or “confound” the routing logic into routing these queries to an LLM of the
adversary’s choosing. Furthermore, we will demonstrate that these attacks can be black-box and query-independent, i.e.,
a single modification works for all queries and does not require advance knowledge of the specific router being attacked.
4