set of gadgets and then uses them to attack arbitrarily many queries. This is the conservative setting, and query-specific
gadgets — which carry a higher computational cost — generally work better.
In Appendix C we evaluate optimization-free alternatives for generating our confounding gadgets, and show they signifi-
cantly underperform our optimization-based approach.
White-box confounder gadget generation. Following our attack framework described in Section 4, we construct a
query-independent control-plane gadget designed to confuse each router. We start with the white-box setting, setting the
batch size to B = 32 and the number of iterations to T = 100, ignoring thresholds. We generate four sets of n = 10
gadgets, i.e., ten for each router. Examples of generated gadgets can be found in Appendix A.
When reporting scores below, we therefore report the average over the n gadgets used with all 72 MT-bench queries, 100
randomly selected MMLU queries, and 100 randomly selected GSM8K queries. None of these testing queries were used
in the training of the routers or their calibration.
Runtime and convergence. Figure 4 shows the convergence rates for 10 different gadgets, against different routing
algorithms. The overall average number of iterations before convergence is 58. Generation against RSW converges the
8