text: Table 4: Average benchmark-specific scores of responses to the original and confounded queries with Mistral-7B-Instruct- 
  v0.3 (LLM pair 2) or Llama-2-7B-chat-hf (LLM pair 3) as the weak model, in the white-box setting. Results further 
  emphasize that the rerouting attack improves quality of responses when there is a significant gap between the weak and 
  strong LLMs. 