text: • White-box setting: The adversary knows the control plane algorithm and its parameters ω. 
  
  • Black-box (transfer) setting: The adversary does not know the control plane algorithm R and ω for the target model, 
  but knows instead another control plane algorithm R′ 
  ω′ as the surrogate. For 
  example, this could arise if an adversary trains their own router using available data. In this setting our attacks are 
  also zero-shot in that they do not require any interaction with the target control plane before the query that is being 
  rerouted. 
  
  ω′ and its parameters. We refer to R′ 
  
  4 Confounding Control Planes with Gadgets 
  
  We now turn to our main contribution: a methodology for attacking LLM control plane integrity. The key insight is that 
  an adversary can modify queries to mislead or “confound” the routing logic into routing these queries to an LLM of the 
  adversary’s choosing. Furthermore, we will demonstrate that these attacks can be black-box and query-independent, i.e., 
  a single modification works for all queries and does not require advance knowledge of the specific router being attacked. 
  
  4 