text: Table 7: Differences between average benchmark specific scores of responses to the original and confounded queries, 
  when the confounder gadget was generated for a different surrogate router than the target (black-box setting) for three 
  LLM pairs. Positive values indicate a higher average score for responses to the confounded queries; higher values are 
  better for the attacker. Results are averaged across gadgets. Standard errors were omitted for readability and are on 
  average 0.1, 0.8, and 1.8 for MT-bench, MMLU and GSM8K, respectively. Aligned with the white-box setting, results 
  show almost no decrease in performance, and improvement when there is a performance gap for the LLM pair. 