text: Evaluation datasets. We will evaluate our attacks using three standard LLM benchmarks as workloads: MT-Bench [71], 
  a dataset of 160 open-ended questions, MMLU [35], a dataset of 14,042 multi-choice questions, and GSM8K [24], a 
  dataset of 1,319 grade-school math problems. Note that Ong et al. [47] flagged that some data points are “contaminated”, 
  i.e., they are too similar to the ones used in their training of the routers. We use these datasets without these contaminated 
  elements, resulting in 72 MT-bench queries, 14,037 MMLU queries, and 1,307 GSM8K queries. 
  
  For MMLU and GSM8K, we will require that the LLMs respond in a predefined format so we can parse and compare 
  the responses to ground-truth answers. To facilitate this, we prepended formatting instructions to the query, inserted as 
  a prefix before the gadget in the case of confounded queries. In other words, a confounded query ends up defined as 
  ˆxi = instr∥c∥xi for instruction template instr, confounder gadget c, and original query xi. Thus in this case we model 
  a scenario where the adversary only controls a part of the prompt rather than the entire prompt. See Appendix B for 
  formatting examples and ablations. 