text: Target routers. We focus our evaluation on the four prescriptive routing algorithms proposed by Ong et al. [47], 
  which provides open-source code and trained parameters, and does so for a representative variety of routing ap- 
  proaches: similarity-based classification [41, 59], an MLP constructed via matrix factorization [59], BERT-based clas- 
  sification [27, 53, 59], and a fine-tuned LLM. 
  
  The routers we evaluate were trained in a supervised fashion using a set of reference (training) queries whose performance 
  score on each of the considered models is known. The scores were computed from a collection of human pairwise rankings 
  of model answers for each of the queries. We note that while the routers we consider are all learned using this training 
  set, there is no reason to believe a non-learning-based approach (e.g., rule based) to routing would be more adversarially 
  robust. 
  
  We now outline the routing methods considered in this work. See Ong et al. [47] for their full implementation details. 
  
  Similarity-weighted ranking: The first method is based on the Bradley-Terry (BT) model [17]. For a given user query, 
  this model derives a function to compute the probability of the weak model being preferred over the strong model. The 
  probability-function expressions all share parameters, which are optimized to minimize the sum of cross-entropy losses 
  over the training-set queries, where each element in the sum is weighted by the respective query’s similarity with the 
  user’s query (computed as embeddings cosine similarity, with the embedding derived using OpenAI’s text-embedding-3- 
  small [6]). We denote this method as RSW . 