text: As a first measure of response quality, we compare the perplexity scores for unmodified responses and confounded query 
  responses. Text perplexity [37] is a well-known method for approximating “naturalness” of text sequences. Perplexity 
  can be computed using an LLM, we use GPT-2 [51] for this purpose as it is a standard choice [16, 69];1 Table 2 shows the 
  results. As can be seen, adding the confounder gadget to queries does not significantly change response perplexity. To the 
  extent that it does, it usually somewhat decreases response perplexity, i.e., makes it more “natural”. That said, perplexity 
  is a coarse measure of “naturalness,” and it does not measure whether the response is correct. In particular, responses of 
  strong and weak LLMs tend to have similar perplexities. We further discuss this issue in Appendix D. 
  
  We thus also evaluate using the following benchmark-specific metrics to assess response quality: 
  
  • MT-bench: We score the responses on a scale of 1–10 using an LLM-as-a-judge methodology [71]. We use 
  GPT-4o [2] as the judge and ask it to provide a score given a pair of a query and a corresponding response. 
  
  • MMLU: We parse the responses and compare the answer to the ground truth. In cases where the response did not 
  fit any known multi-choice format, we marked the response as a mistake. We report accuracy as the percentage of 
  responses that match the ground truth. 
  
  • GSM8K: similar to MMLU except questions are math rather than multiple choice, thus we parse the answers accord- 
  ing to the expected format. 