Let B = {˜c0, . . . ,˜cB}.
(3) Find the candidate that maximizes the score:
c(t+1)
i ← arg max
c∈B
Sθ(c∥xi) . (1)
The final confounder c(T)
i is used with query xi. We early abort if, after 25 iterations, there is no update to the confounder
gadget. Technically, we could abort early if we find a confounder whose score exceeds τ. Running further can be useful
when an adversary does not know τ.
The attack’s runtime is dominated byT ·B times the cost of executing S. In practice, S are designed to be fast (otherwise
routers would significantly increase the latency of applications that use them). We report precise timings later; in summary,
the attack is fast because we can set T to be relatively small and still find high-scoring confounders.
Due to the randomness in index and token selection, the method converges to different, yet similarly effective, confounder
gadgets on each run. Our evaluation will thus measure average performance over multiple gadgets.
Query-independent confounders. One downside of the per-query approach is that the adversary must repeat, for each
query, the search for a good confounder. In practice, the adversary might prefer a query-independent attack. Our con-
founder gadget approach extends to this setting readily: perform the search routine above for an empty query. In other
words, just ignore xi in the query-dependent attack above, replacing Sθ(c∥xi) in Eq. 1 with Sθ(c). This finds a sin-
gle query-independent confounder c that can be prefixed to all queries, i.e., ˆxi = c∥xi. We will show that this works
surprisingly well.
It is tempting to assume the reason a query-independent confounder works well is that a good scoring function should be
roughly monotonic in query extensions, i.e., one might expect thatSθ(c∥x) ≥ Sθ(c) for almost any suffixx. This intuition
is not correct. In our experiments, we found that Sθ(c∥x) < Sθ(c) for many x and some of the routers discussed below.
Nevertheless, by ensuring that Sθ(c) is pretty high (set the number of iterationsT higher) the resulting query-independent
confounder works well. That is, we at least get that Sθ(c∥x) > Sθ(x).
The black-box setting: confounders that transfer. Finally, the attacks so far are in the white-box setting, where the
attacker can optimize directly against Sθ. While in some cases routing control planes will be public knowledge, in others,
including the proprietary control planes we explore in Section 7, they are hidden. This gives rise to the black-box setting.
While an attacker might seek to perform model extraction attacks [43, 65] to learn θ, we instead explore attacks that
transfer from one router to another.
In more detail, we assume the adversary has access to a router R′
ω′ , called the surrogate, that is trained on data similar to
that used for the target router. Then the attack is the same as above, except that we use the surrogate’s scoring function
S′
θ′ instead of the target’s Sθ. Again, we will see that this works surprisingly well: the query-independent confounders
found for the surrogate transfer to successfully reroute queries against the target router.
Putting it all together. In summary, our methodology for input adaptation attacks is:
(1) (Preprocessing) Develop a single query-independent confounder gadget c, using either the target router or surrogate
to score the confounder.
(2) (Input adaptation) For each query xi, submit ˆxi = c∥xi instead to obtain a response ˆyi.
The confounder is applied to all queries, i.e., the adversary does not need to guess whether the original query would
have been routed to the weak or strong model. In the rest of the paper, we demonstrate the confounders rarely result in
“downgrades,” i.e., rerouting of queries from the strong to weak model.
We have experimented with variations of this approach that don’t work quite as well, for example adding c as a suffix
instead of a prefix. See Appendix B for details.
5 Open-Source Routers: Experimental Setup