text: As mentioned in Section 5, throughout our evaluations we filter out responses with perplexity values higher than 100. 
  This is due to a few responses getting arbitrarily high perplexity values although corresponding to valid responses. For 
  example, for the query: 
  
  Suppose you are a mathematician and poet. You always write your proofs as short poets with less than 10 lines 
  but rhyme. Prove the square root of 2 is irrational number. 
  
  The weak model responses with: 
  
  In squares, two seeks a home, Two whole numbers, never roam. If it did, in pairs combined, A different square 
  would it find. But take root, two’s square, or four, Still leaves a remainder’s roar. The square root of two’s no child 
  of two, Its irrational nature ever true. 
  
  which results with an high perplexity value of 166. We also observed a few responses containing lists, code, or math 
  equations with abnormally high perplexity values. 
  
  E Rerouting to the Weak Model 
  
  In this section we evaluate the generality of our attack and show that generation of confounder gadgets can be optimized 
  for the opposite objective from what we consider so far: reroute queries to the weak model. For this, we repeat the same 
  optimization process as in Section 4 but minimize the router’s score. Table 16 shows the upgrade and downgrade rates 
  for this variant of the attack, in the white-box setting. In most cases we see a significant downgrade rate and a minimal 
  upgrade rate, meaning that most of the modified queries were routed to the weak model. One notable exception is the 
  LLM-based router RLLM , for which the attack does not work well. Future work will be needed to explore improving 
  confounder generation for this setting further. 