text: 6 Rerouting Open-Source Routers 
  
  We now empirically evaluate our rerouting attack against the open-source routers described in the previous section. Unless 
  otherwise specified, our evaluation focuses on the query-independent attack setting where the attacker first finds a fixed 
  set of gadgets and then uses them to attack arbitrarily many queries. This is the conservative setting, and query-specific 
  gadgets — which carry a higher computational cost — generally work better. 
  
  In Appendix C we evaluate optimization-free alternatives for generating our confounding gadgets, and show they signifi- 
  cantly underperform our optimization-based approach. 
  
  White-box confounder gadget generation. Following our attack framework described in Section 4, we construct a 
  query-independent control-plane gadget designed to confuse each router. We start with the white-box setting, setting the 
  batch size to B = 32 and the number of iterations to T = 100, ignoring thresholds. We generate four sets of n = 10 
  gadgets, i.e., ten for each router. Examples of generated gadgets can be found in Appendix A. 
  
  When reporting scores below, we therefore report the average over the n gadgets used with all 72 MT-bench queries, 100 
  randomly selected MMLU queries, and 100 randomly selected GSM8K queries. None of these testing queries were used 
  in the training of the routers or their calibration. 