RSW RMF RCLS RLLM
Original Confounded Original Confounded Original Confounded Original Confounded
MT-Bench 13.8 12 .3 ± 0.2 12 .6 12 .3 ± 0.2 13 .1 12 .1 ± 0.2 12 .7 12 .7 ± 0.4
MMLU 20.4 20 .1 ± 0.1 20 .0 20 .3 ± 0.1 20 .2 20 .5 ± 0.1 21 .0 19 .6 ± 0.1
GSM8K 17.1 15 .1 ± 0.3 17 .0 15 .2 ± 0.3 17 .0 15 .0 ± 0.2 16 .4 15 .2 ± 0.3
Table 2: Average perplexity of responses to the original and confounded queries, in the white-box setting for LLM pair 1.
Response perplexity does not change significantly when adding the confounder gadget.
RSW RMF RCLS RLLM
Original Confounded Original Confounded Original Confounded Original Confounded
MT-Bench 8.4 8 .3 ± 0.0 8.4 8 .4 ± 0.0 8.4 8 .3 ± 0.0 8.3 8 .2 ± 0.1
MMLU 61 66 ± 0 64 64 ± 1 63 65 ± 0 67 66 ± 0
GSM8K 46 64 ± 1 50 67 ± 1 50 63 ± 1 44 64 ± 1
Table 3: Average benchmark-specific scores of responses to the original and confounded queries, in the white-box setting
for LLM pair 1. Rerouting to the strong model improves quality of responses as long as there is a significant gap between
the benchmark performance of the weak and strong LLMs.
As a first measure of response quality, we compare the perplexity scores for unmodified responses and confounded query
responses. Text perplexity [37] is a well-known method for approximating “naturalness” of text sequences. Perplexity
can be computed using an LLM, we use GPT-2 [51] for this purpose as it is a standard choice [16, 69];1 Table 2 shows the
results. As can be seen, adding the confounder gadget to queries does not significantly change response perplexity. To the
extent that it does, it usually somewhat decreases response perplexity, i.e., makes it more “natural”. That said, perplexity
is a coarse measure of “naturalness,” and it does not measure whether the response is correct. In particular, responses of
strong and weak LLMs tend to have similar perplexities. We further discuss this issue in Appendix D.
We thus also evaluate using the following benchmark-specific metrics to assess response quality:
• MT-bench: We score the responses on a scale of 1–10 using an LLM-as-a-judge methodology [71]. We use
GPT-4o [2] as the judge and ask it to provide a score given a pair of a query and a corresponding response.
• MMLU: We parse the responses and compare the answer to the ground truth. In cases where the response did not
fit any known multi-choice format, we marked the response as a mistake. We report accuracy as the percentage of
responses that match the ground truth.
• GSM8K: similar to MMLU except questions are math rather than multiple choice, thus we parse the answers accord-
ing to the expected format.
Table 3 shows that, according to these metrics, in most cases responses to the confounded queries are no worse, and in
some cases even better, than responses to the original queries. We attribute the improvement on the GSM8K benchmark
to the fact that the strong model performs significantly better than the weak model on this benchmark (57% vs. 33%). On
the MT-bench and MMLU benchmarks, strong and weak models have comparable performance (8.5 vs. 7.6 for MT-bench
and 66% vs. 64% for MMLU), thus routing does not degrade quality of responses and, consequently, the attack cannot
improve it.
To further demonstrate that the attack improves the quality of responses when there is a significant gap between the weak
and strong LLMs, we perform an additional evaluation with Mistral-7B-Instruct-v0.3 [38] and Llama-2-7B-chat-hf [63]
as the weak LLMs (LLM pairs 2 and 3). Mistral-7B achieves 7.4, 57%, and 25% on MT-bench, MMLU, and GSM8K,
respectively. Llama-2-7B achieves 6.4, 44%, and 21%. Table 4 shows that the rerouting attack improves quality of
responses when either of these LLMs is the weak model, and in particular for the weaker Llama-2-7B model.
LLM responses are sometimes affected by the confounder gadget. In some cases, the LLM responded with, for example,