text: We introduced and defined a new safety property, LLM control plane integrity. 
  Informally, this property holds if an 
  adversarial user cannot influence routing decisions made by the control plane. To show that existing LLM routers do not 
  satisfy this property, we designed, implemented, and evaluated a black-box optimization method for generating query- 
  independent “confounder gadgets.” When added to any query, the confounder gadget confuses the router into routing the 
  query to the adversary-chosen LLM. 
  
  We evaluated the efficacy of confounder gadgets on multiple open-source and commercial routers and demonstrated that 
  they successfully reroute queries without a negative impact on the quality of responses. We also discussed defenses against 
  these attacks and indicated directions for future research. 
  
  Acknowledgments 
  
  This research was supported in part by the Google Cyber NYC Institutional Research Program, the Israel Science Founda- 
  tion (Grant No. 1336/22), and the European Union (ERC, FTRC, 101043243). Views and opinions expressed are however 
  those of the author(s) only and do not necessarily reflect those of the European Union or the European Research Council. 
  Neither the European Union nor the granting authority can be held responsible for them. 