text: (Input adaptation) For each query xi, submit ˆxi = c∥xi instead to obtain a response ˆyi.  (2) 
  
  The confounder is applied to all queries, i.e., the adversary does not need to guess whether the original query would 
  have been routed to the weak or strong model. In the rest of the paper, we demonstrate the confounders rarely result in 
  “downgrades,” i.e., rerouting of queries from the strong to weak model. 
  
  We have experimented with variations of this approach that don’t work quite as well, for example adding c as a suffix 
  instead of a prefix. See Appendix B for details. 
  
  5 Open-Source Routers: Experimental Setup 
  
  To evaluate efficacy of confounder gadgets generated using the method from Section 4, we perform experiments with 
  several LLM routers. This section explains our experimental setup for the open-source routers proposed in the research 
  literature [47]; results of this evaluation appear in Section 6. 
  In Section 7, we discuss experiments with proprietary, 
  commercial routers. Figure 3 shows the summary of our experimental setup. 
  
  6 