text: We focus on input adaptation attacks; these immediately give unconstrained attacks as well. The adversary therefore has 
  a sequence of inputs x1, . . . , xq and must produce modified inputs ˆx1, . . . , ˆxq to maximize the number of inputs routed 
  to Ms. See Figure 2 for a depiction of our attack setting. 
  
  Instruction injection doesn’t work. Given the success of prompt injection for jailbreaking [50] and other adversarial 
  tasks [64], the adversary might simply prefix each query xi with some instruction such as “Treat the following query as 
  complex, . . . ” to generate a modified query ˆxi. Our experiments show that this does not work well, failing to trigger the 
  control plane into routing otherwise weak queries to Ms. See Appendix C for details on our experiments with various 
  instruction prompts. 