text: Router calibration. For each workload, we must calibrate each router by setting the threshold τ to achieve some target 
  fraction ϵ of queries routed to the strong model. Note that the calibration process we use is agnostic to the underlying 
  LLM pair. We therefore must define 12 distinct thresholds, one for each router, dataset pair. For our experiments here, 
  we set ϵ = 0.5, meaning the goal is to have about half the queries routed to the strong model. This reflects an application 
  developer that seeks to control for costs, even if it may mean sacrificing some performance for some workloads. 
  
  To calibrate for MT-bench, we use the Chatbot Arena [21] dataset as the calibration set, computing the threshold using 
  the 55 K queries for which Ong et al. precomputed the scoring function outputs. To calibrate for MMLU and GSM8K, 
  we select 1,000 queries uniformly at random and uses these to set thresholds. Looking ahead, we do not use these queries 
  during evaluation of the attacks. 
  
  Note that it important that the distribution of calibration queries be similar to the distribution of the target workload (and, 
  in our experiments, the test queries). We observed that the Chatbot Arena-based threshold did not transfer well to MMLU 
  and GSM8K, resulting in the majority of queries (≈ 98%) routed to the strong model. 