text: Table 6: Differences between average perplexity of responses to the original and confounded queries, in the black-box 
  setting, when the confounder gadget was generated for a different surrogate router than the target, for LLM pair 1. Positive 
  values indicate a lower average perplexity (more natural) of responses to the confounded queries; higher values are better 
  for the attacker. Standard errors were omitted for readability but are 0.2 on average. As in the white-box setting, the attack 
  does not increase the average response perplexity. 