We report standard error values for both the upgrade rates and the total percentage of queries routed to the strong model.
The maximal standard error is in the low single digits, indicating similar success rates across gadgets.
Quality of attack responses. We now turn to evaluating the quality of the responses generated by the attack. Note that
because we have calibrated the routers to target ϵ = 0 .5, our attacks can improve response quality by rerouting to the
stronger model. In the other direction, our attacks add confounder gadgets which might degrade response quality.
9