text: where PPL(·) denotes the perplexity function computed using GPT-2, the value ρ denotes a target perplexity value to 
  which we want gadgets’ perplexity to be close, and the value α is a balancing coefficient. For the experiments below, we 
  set ρ to be the average perplexity value of 100 uniformly sampled queries3 from the GSM8K benchmark. 
  
  Figure 6 shows the results when setting α = 0.01, for the GSM8K benchmark and one confounder gadget. The results 
  demonstrate that modified queries can no longer be easily distinguished from normal queries by their perplexity alone. 
  For instance, in the case of the RSW router, setting the threshold value at 55 as before, no confounded queries are flagged 
  as anomalous, meaning the true-positive rate is zero. We note that there is some variability across gadgets. The average 
  ROCAUC scores of the defense across ten gadgets with standard deviation indicated parenthetically, are 0.66 (±0.04), 
  0.69 (±0.02), 0.71 (±0.02), and 0.69 (±0.03) for the RSW , RM F , RCLS, and RLLM routers, respectively. 