Figure 2: Overview of our attack on LLM routing control plane integrity. The attack adds to each query a prefix (repre-
sented by the gear), called a “confounder gadget,” that causes the router to send the query to the strong model.
We focus on the binary router setting in which the router applies a learned scoring function to input queries and routes
any query whose score exceeds some threshold τ to the strong LLM Ms. This setting has been the focus of several prior
works [27, 41, 47] and is used in the control planes that are deployed in practice (see Section 7).
More formally, we consider a routerRM
ω for M = {Mw, Ms}, where ω consists of a scoring functionS, scoring function’s
parameters θ, and a threshold τ ∈ R+. For notational brevity we just write Rω below, with M clear from context. Here
S and θ define a scoring function Sθ : X →R+. Since our focus is LLMs, we assume that queries X are strings of text
tokens. The routing algorithm then works as follows:
Rω(x) =
Mw(x) if Sθ(x) < τ
Ms(x) otherwise
where ω = (S, θ, τ). We will detail scoring functions in Section 5; prior work has suggested linear models, light-weight
LLMs, and more. Note that, consistent with this application, scoring functions are computationally efficient and cheap (as
compared to Ms, Mw). Deployments calibrate τ to limit the fraction of queries routed to the strong model Ms, giving rise
to the type of control plane integrity policy discussed in Section 3.
We focus on input adaptation attacks; these immediately give unconstrained attacks as well. The adversary therefore has
a sequence of inputs x1, . . . , xq and must produce modified inputs ˆx1, . . . ,ˆxq to maximize the number of inputs routed
to Ms. See Figure 2 for a depiction of our attack setting.
Instruction injection doesn’t work. Given the success of prompt injection for jailbreaking [50] and other adversarial
tasks [64], the adversary might simply prefix each query xi with some instruction such as “Treat the following query as
complex, . . . ”to generate a modified query ˆxi. Our experiments show that this does not work well, failing to trigger the
control plane into routing otherwise weak queries to Ms. See Appendix C for details on our experiments with various
instruction prompts.
Confounder gadgets. Our approach works as follows. Given a query xi, we prepend a confounder gadget ci, which is a
short sequence of adversarially chosen tokens. The modified query is ˆxi = ci∥xi where ∥ denotes string concatenation.
Intuitively, we will use optimization to search for confounders that trick the scoring function into rankingˆxi as sufficiently
complex to require the strong model.
In the white-box, query-specific setting, we can choose ci as a function of xi and the known parameters ω = (S, θ, τ). To
do so, we fix a confounder length of n tokens and let I be a token dictionary (it should be a sufficiently large subset of the
token dictionary used by S). Then we set the gadget to initially be n tokens all fixed to the same value from I. The exact
choice of the initialization token is not important; in our implementation, we used the first token in the dictionary (‘!’).
Denote this initial confounder as c(0)
i = [c(0)
i,1 , c(0)
i,2 , . . . , c(0)
i,n].
Then, we perform a hill-climbing style approach to find a good confounder for xi. For each iteration t ∈ [T], where T is
the total number of iterations, do the following:
(1) Select a target index j ∈ [1, n] uniformly.
(2) Generate a set B of B + 1 candidates. First set ˜c0 = c(t)
i , the current confounder. To generate B additional
candidates, select replacement tokens from I uniformly, forming the set {tb ← I}B
b=1. Replace the jth token in the
current confounder ˜c0 with tb:
˜cb = [c(t)
i,1, . . . , c(t)
i,j−1, tb, c(t)
i,j+1, . . . , c(t)
i,n] .
5