text: Table 3 shows that, according to these metrics, in most cases responses to the confounded queries are no worse, and in 
  some cases even better, than responses to the original queries. We attribute the improvement on the GSM8K benchmark 
  to the fact that the strong model performs significantly better than the weak model on this benchmark (57% vs. 33%). On 
  the MT-bench and MMLU benchmarks, strong and weak models have comparable performance (8.5 vs. 7.6 for MT-bench 
  and 66% vs. 64% for MMLU), thus routing does not degrade quality of responses and, consequently, the attack cannot 
  improve it. 
  
  To further demonstrate that the attack improves the quality of responses when there is a significant gap between the weak 
  and strong LLMs, we perform an additional evaluation with Mistral-7B-Instruct-v0.3 [38] and Llama-2-7B-chat-hf [63] 
  as the weak LLMs (LLM pairs 2 and 3). Mistral-7B achieves 7.4, 57%, and 25% on MT-bench, MMLU, and GSM8K, 
  respectively. Llama-2-7B achieves 6.4, 44%, and 21%. Table 4 shows that the rerouting attack improves quality of 
  responses when either of these LLMs is the weak model, and in particular for the weaker Llama-2-7B model. 