text: Black-box attack results. Next, we consider the black-box attack, where the attacker does not know the algorithm 
  used by the target router. We assume that the attacker has access to another, surrogate router that it can use to generate 
  confounder gadgets. In effect, we evaluate transferability of the attack from a known, white-box router to unknown, 
  black-box routers. 
  Table 5 shows the results for all combinations of surrogate (denoted by ˆR) and target routers. For conciseness we focus 
  on the upgrade and downgrade rates for the remainder of this work. Upgrade rates are lower than in the white-box setting 
  but still high, indicating that the attack transfers. The LLM-based routing algorithm RLLM has the lowest rates, perhaps 
  because it is the most complex of the four. The downgrade rate is 0 in most cases and is 1.2% on average. 
  
  Table 6 shows that the black-box attack does not increase the average perplexity of responses as generated by LLM 
  pair 1. Table 7 shows that the attack does not decrease benchmark-specific scores, other than some small decrease in 
  some cases for the MMLU benchmark. For GSM8K, similar to the behaviour observed in the white-box setting, we see 
  an improvement with our attack due to the performance difference between the strong and weak models for this task. This 
  indicates that confounding affects only the routing, not the quality of responses. When the weak model is significantly 
  weaker than the strong model, i.e., LLM pairs 2 and 3, the attack can improve the quality of responses significantly. 