RSW RMF RCLS RLLM
Orig. Conf. Orig. Conf. Orig. Conf. Orig. Conf.
LLM pair 2
MT-Bench 8.5 8 .3 ± 0.0 8.4 8 .3 ± 0.1 8.4 8 .4 ± 0.1 8.4 8 .3 ± 0.1
MMLU 55 64 ± 1 63 64 ± 0 58 66 ± 1 62 66 ± 0
GSM8K 46 64 ± 1 51 67 ± 1 49 63 ± 1 38 63 ± 2
LLM pair 3
MT-Bench 8.4 8 .3 ± 0.0 8.1 8 .3 ± 0.1 8.3 8 .4 ± 0.1 8.1 8 .2 ± 0.1
MMLU 51 64 ± 1 57 63 ± 1 52 66 ± 1 59 66 ± 1
GSM8K 40 64 ± 1 44 67 ± 1 45 63 ± 1 37 64 ± 1
Table 4: Average benchmark-specific scores of responses to the original and confounded queries with Mistral-7B-Instruct-
v0.3 (LLM pair 2) or Llama-2-7B-chat-hf (LLM pair 3) as the weak model, in the white-box setting. Results further
emphasize that the rerouting attack improves quality of responses when there is a significant gap between the weak and
strong LLMs.
Surrogate ˆRSW ˆRMF ˆRCLS ˆRLLM
Target RMF RCLS RLLM RSW RCLS RLLM RSW SFM RLLM RSW RMF RCLS
MT-Bench 99±1 88 ±5 45 ±5 100±0 96 ±2 39 ±3 100±0 79 ±9 51 ±5 100±0 83 ±5 85 ±7
MMLU 66±5 44 ±11 81 ±3 82±4 56 ±7 74 ±2 64±6 16 ±7 80 ±5 53±4 20 ±5 46 ±11
GSM8K 99±1 72 ±11 63 ±4 92±2 88 ±3 62 ±4 76±6 60 ±9 65 ±8 60±8 70 ±7 73 ±10
Table 5: Average upgrade rates for our attack in the black-box setting. This is the average percentage of queries rerouted
from the weak to strong model under the target router due to a confounder gadget generated using the surrogate. The
average downgrade rate (i.e., strong-to-weak rerouting) is 1.2% across all routers. Upgrade rates are lower than in the
white-box setting but still high, indicating that the attack transfers.
abnormal about the query. Intuitively, this reflects the fact that while LLMs are built to be robust to noisy inputs, the
router itself is not.
In summary, the attack is highly successful at rerouting queries from the weak to the strong model. Overall, quality
improves if there is a significant gap between the strong and weak LLMs used by the router. Either way, confounding has
no negative impact on the quality of responses.
Black-box attack results. Next, we consider the black-box attack, where the attacker does not know the algorithm
used by the target router. We assume that the attacker has access to another, surrogate router that it can use to generate
confounder gadgets. In effect, we evaluate transferability of the attack from a known, white-box router to unknown,
black-box routers.
Table 5 shows the results for all combinations of surrogate (denoted by ˆR) and target routers. For conciseness we focus
on the upgrade and downgrade rates for the remainder of this work. Upgrade rates are lower than in the white-box setting
but still high, indicating that the attack transfers. The LLM-based routing algorithm RLLM has the lowest rates, perhaps
because it is the most complex of the four. The downgrade rate is 0 in most cases and is 1.2% on average.
Table 6 shows that the black-box attack does not increase the average perplexity of responses as generated by LLM
pair 1. Table 7 shows that the attack does not decrease benchmark-specific scores, other than some small decrease in
some cases for the MMLU benchmark. For GSM8K, similar to the behaviour observed in the white-box setting, we see
an improvement with our attack due to the performance difference between the strong and weak models for this task. This
indicates that confounding affects only the routing, not the quality of responses. When the weak model is significantly
weaker than the strong model, i.e., LLM pairs 2 and 3, the attack can improve the quality of responses significantly.
Query-specific gadgets. By default, our gadget generation method is query-independent and the same gadget can be used
to reroute any query. An adversary with more resources may instead generate a dedicated gadget for each query (using
the same algorithm).
Table 8 and Table 9 show the results for the white-box and black-box settings, respectively. (Here, percentage numbers
are not averaged and there is no standard error since we used a single gadget per query.) The white-box results are nearly