text: an extra potentially expensive LLM invocation for each query processed by the router. Second, it may degrade the quality 
  of responses from the destination LLMs, which are sensitive to the phrasing of queries and prompts. 
  
  Detecting anomalous user workloads. Another possible defense requires the router to monitor individual user work- 
  loads, and identify those users whose queries are routed to the strongest model with an abnormally high frequency. The 
  router can then impose a user-specific threshold. Of course such workloads may have a benign explanation, e.g., the user’s 
  queries may be unusually complex. Even so, routers could potentially be designed to perform user-specific routing. For 
  example, one could imagine using per-user thresholds that are calibrated dynamically to attempt to maintain a consistent 
  fraction of queries being routed to the strong model. 
  
  Such user-specific routing would complicate implementations, and would make inaccurate decisions for a user until there 
  is sufficient data about their queries. The latter is relevant in adversarial settings, since such an approach would still be 
  circumventable should attackers be able to mount Sybil attacks in which the attacker creates a new user for, in the limit, 
  each query. 
  
  9 Related Work 
  
  Evasion attacks against ML systems. A large body of work has investigated evasion attacks against ML systems [25, 
  43, 60], also referred to as adversarial examples [32, 48, 49], and these attacks are now being explored in the context of 
  multi-modal LLMs [28] as well as text-only LLMs (for just one example, see [22]). We discussed in Section 3 how our 
  results compare: LLM control plane integrity is a distinct AI safety issue, but related in that: (1) control plane integrity 
  attacks may use evasion-style techniques, and (2) control plane integrity attacks might be useful for performing evasion. 