text: At the same time, optimizing for low perplexity does not significantly impact the attack success rate. Table 11 compares 
  the average upgrade rates (over n = 10 gadgets) of the original perplexity-agnostic optimization approach from Section 4 
  and the perplexity-minimizing one described above. The attack efficacy might be improvable further by adjusting α to 
  find a sweet spot that avoids the defense effectively while ensuring high rerouting success rate. 
  
  The attack is not particularly sensitive to the choice of queries used to obtain the calibration value ρ. Although ρ was 
  computed using GSM8K queries, we observe similar performance when evaluating on the MT-bench and MMLU bench- 
  marks, with average ROCAUC scores of 0.50 (±0.01), 0.51 (±0.01), 0.52 (±0), and 0.51 (±0.01) for MT-bench, and 0.52 
  (±0.03), 0.54 (±0.02), 0.55 (±0.01), and 0.53 (±0.02) for MMLU. One might also try removing the calibration value al- 
  together, instead simply minimizing the gadget’s perplexity value. However, this can result with an “overshooting” effect, 
  where the perplexity value is significantly lower than that of normal queries, thereby making it still distinguishable from 
  standard queries. 