text: [71] L. Zheng, W.-L. Chiang, Y. Sheng, S. Zhuang, Z. Wu, Y. Zhuang, Z. Lin, Z. Li, D. Li, E. Xing et al., “Judging LLM- 
  as-a-judge with MT-Bench and chatbot arena,” Advances in Neural Information Processing Systems (NeurIPS), 
  2023. 
  
  [72] S. Zhu, R. Zhang, B. An, G. Wu, J. Barrow, Z. Wang, F. Huang, A. Nenkova, and T. Sun, “AutoDAN: Automatic 
  and interpretable adversarial attacks on large language models,” arXiv preprint arXiv:2310.15140, 2023. 
  
  [73] A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language 
  models,” arXiv preprint arXiv:2307.15043, 2023. 
  
  A Gadget Examples 
  
  Below are a few examples of the optimized confounder gadgets c we got, for the different routing algorithms: 