text: LLM-based filtering. Even though adversarially modified queries cannot be easily detected using perplexity, they may 
  still be “unnatural.” A possible defense is to employ an oracle LLM to determine if the query is natural or not. This defense 
  requires the router to invoke an additional LLM for every processed query, which is computationally expensive in the case 
  of a high-quality open-sourced LLM or financially costly in the case of a high-quality commercial LLM. Therefore, this 
  defense is unlikely to be practical. Furthermore, it is possible to optimize gadgets so that they both have low perplexity 
  and appear “natural” to LLM evaluators [69]. 
  
  Paraphrasing. Filtering defenses like those discussed above are passive. An active alternative is to paraphrase queries 
  using an oracle LLM. LLMs are trained to generate natural text and are thus likely to remove unnatural substrings when 
  paraphrasing a query. This defense is likely impractical for two reasons. First, and as with LLM-based filtering, it requires 
  
  16 