text: Table 5: Average upgrade rates for our attack in the black-box setting. This is the average percentage of queries rerouted 
  from the weak to strong model under the target router due to a confounder gadget generated using the surrogate. The 
  average downgrade rate (i.e., strong-to-weak rerouting) is 1.2% across all routers. Upgrade rates are lower than in the 
  white-box setting but still high, indicating that the attack transfers. 