text: (a) RSW  (b) RM F  (c) RCLS  (d) RLLM 
  
  (e) RSW  (f) RM F  (g) RCLS  (h) RLLM 
  
  Figure 5: Perplexity of the original queries in the GSM8K benchmark compared to the perplexity of confounded queries 
  using a single uniformly sampled gadget. We additionally present the ROC curve of the defense that detects confounded 
  queries by checking if they cross a perplexity threshold, and it’s corresponding ROCAUC score. Confounded queries have 
  significantly higher perplexity values, and are thus easy to recognize and filter out. 