text: A natural solution to balancing performance and economic considerations is to take advantage of the availability of mul- 
  tiple LLMs at different price-performance points. Recently proposed LLM routing systems [5, 12, 27, 47, 53] orchestrate 
  two or more LLMs and adaptively route each query to the cheapest LLM they deem likely to generate a response of 
  sufficient quality. In the two-LLM case, let Ms be an expensive, high-quality model and Mw a weaker, lower-grade one. 
  Given query q, the routing algorithm R(·) applies a classifier to q that outputs 0 if Mw is sufficient for answering q, or 1 
  if Ms is required. The system then routes q accordingly. 
  
  LLM routing is an example of a general class of systems we call LLM control planes, which orchestrate the use of multiple 
  LLMs to process inputs, as further described in Section 2. 
  
  Our contributions. First, we introduce LLM control plane integrity as a novel problem in AI safety. Recently proposed 
  LLM control-plane algorithms are learned, calibrated classifiers (see Section 2). Their inputs are queries from potentially 
  adversarial users. Robustness of control-plane algorithms to adversarial queries is a new problem, distinct from adversarial 
  robustness of the underlying LLMs. 