text: Rerouting success rates. Recall that our attack adds the same confounder gadget to all queries. We start by evaluating the 
  reroute success rates: What fraction of confounded queries does the target router send to the strong model Ms? We show 
  the results for our attack in Table 1. Focusing first on the columns labeled ‘Strong’, the notation “X → Y ± Z” relays 
  that for unmodified queries, X% are routed to the strong model Ms, and that for the n = 10 confounders we achieved an 
  average of Y % of queries sent to Ms. The standard error is Z. Note that while calibration targets ϵ = 0.5, we see some 
  natural variance in X for the test sets. 
  
  To breakdown success further, we additionally report the upgrade rate, which focuses on the percentage of queries that 
  were (a) originally routed to the weak model, and (b) routed to the strong model after they were modified with the 
  confounder gadget. Because in our attacks few queries get “downgraded” (confounders cause them to be rerouted to the 
  weak model instead of strong), the upgrade rate dictates the success rate. 
  
  As can be seen, the gadgets reroute almost all weak queries to the strong model. In most cases we see 100% success, or 
  close to it. The worst case still achieves 88% rerouting success, boosting the fraction of queries sent to the strong LLM by 
  1.5x. Rerouting fails only for some queries that even after confounding are sent to the weak model: the fixed gadget did 
  not sufficiently increase the router’s estimate of those queries’ complexity. This is the only source of error for the attack: 
  no queries in these experiments got “downgraded”, i.e., a query that would otherwise be sent to Ms ends up rerouted to 
  Mw. This also means that adding the confounder to every single query does not have negative impact on rerouting efficacy. 
  We report standard error values for both the upgrade rates and the total percentage of queries routed to the strong model. 
  The maximal standard error is in the low single digits, indicating similar success rates across gadgets. 