text: To initiate the study of this problem, we show that existing LLM routing algorithms are not adversarially robust. We 
  design, implement, and evaluate a method that generates query-independent adversarial token sequences we call “con- 
  founder gadgets.” If a gadget is added to any query, this query is routed to the strong model with high probability. Next, 
  we show that this attack is effective even in the transfer setting where the adversary does not have full knowledge of the 
  target LLM router (it is black-box), but has access to another router (e.g., an internally trained surrogate). We also evaluate 
  the integrity of commercial LLM routers, showing that they can be confounded as well. 
  
  Third, we investigate defenses. Our basic method generates gadgets that have anomalously high perplexity. Confounded 
  queries are thus easily distinguished from normal queries and can be filtered out by the routing system. Unfortunately, this 
  defense can be evaded by an adversary who incorporates a low-perplexity objective into the gadget generation algorithm, 
  producing gadgets that have low perplexity—and yet are effective at re-routing queries to the strong model. We also 
  discuss higher-level defenses, such as identifying users whose queries are routed to the strong model with abnormal 
  frequency. 