text: (a) RSW  (b) RM F  (c) RCLS  (d) RLLM 
  
  (e) RSW  (f) RM F  (g) RCLS  (h) RLLM 
  
  Figure 6: Perplexity values of the original and confounded queries, and the corresponding ROC curves of the defense that 
  detects confounded queries by checking if they cross a perplexity threshold, when the confounder gadget is optimized for 
  low perplexity, in the GSM8K benchmark and for one gadget sampled uniformly at random. Confounded queries have 
  similar perplexity values as the original queries, and can no longer be easily distinguished based on perplexity alone. 