text: C Optimization-Free Gadget Generation 
  
  We evaluate optimization-free alternatives to our black-box optimization method for generating confounder gadgets. 
  
  Fixed gadget. A simple way to create a gadget without resorting to optimization is to repeat n tokens. We use ! as the 
  initialization token, so the gadget in this case is !!!!!!!!!!. Another possibility is to select n tokens uniformly at random. 
  Table 14 shows the upgrade rates for both options, were in the latter setting we repeat the process 10 times and report the 
  average result and the standard error. While they are non-negligible, especially for the randomly sampled gadgets, they 
  significantly underperform the upgrade rates reported in Table 1 for optimized gadgets. 
  
  Instruction injection. Prompt injection is a known attack on LLMs [50, 64], thus we consider a gadget consisting of a 
  direct instruction to the router to treat the query as a complex one and obtain a high-quality response. 
  
  We evaluated 4 differently phrased instructions: two created manually and two generated by, respectively, Gemini [61] 
  and GPT-4o [2], denoted as “ours-1”, “ours-2”, “Gemini”, and “GPT”. 
  
  Table 15 reports the results. This method works well in a few cases but poorly in most. This highlights the difference 
  between attacking LLMs and attacking LLM routers. 