text: Control plane integrity. A control plane integrity adversary is a randomized algorithm A that seeks to maliciously guide 
  inference flow. 
  
  In an unconstrained LLM control plane integrity attack, the adversary A seeks to generate inputs ⃗x = ⃗x1, . . . , ⃗xq such 
  that running RM 
  ω (⃗x) generates a transcript for which P((x1, i1), . . . , (xq, iq)) = 0. This attack could be launched by an 
  adversary who wants to maximize inference costs for a victim application using an LLM router. 
  
  A harder setting requires input adaptation, where the adversary is given inputs x1, . . . , xq and it must find new inputs 
  ˆx1, . . . , ˆxq for which the transcript resulting from P((ˆx1, i1), . . . , (ˆxq, iq)) = 0. There will be some competing constraint, 
  such as that xj and ˆxj are very similar for each j, or that the outputs yj ←$ RM 
  ω (ˆxj) are close. In the 
  routing context, the adversary’s goal is to increase the fraction of queries that get routed to the strong model, in order to 
  improve the overall quality of responses, drive up the victim application’s inference costs, or both. 
  
  ω (xj) and ˆyj ←$ RM 