text: Relationship to evasion attacks. Evasion attacks [25, 43, 60] against an inference system (also called adversarial exam- 
  ples [32, 48, 49]) would, in our setting, seek to find a small modification ∆ to an input x such that RM 
  ω (x) 
  where addition is appropriately defined based on input type (e.g., slight changes to text). 
  ω (x + ∆) ̸= RM 
  
  Our attack setting is not the same. The control plane integrity adversary seeks to maliciously control the inference flow, not 
  necessarily the output of inference. In an unconstrained attack, the adversary does not care what outputs are generated. 
  In the input adaptation attack, the adversary seeks to craft inputs that modify the inference flow yet do not change the 
  responses of the strong underlying LLM to the extent possible. Looking ahead, we will use evasion techniques in our 
  adaptation attacks against learned control plane routers, but, importantly, not the overall inference. 
  
  In the other direction, undermining LLM control plane integrity could be a stepping stone toward evasion attacks. For 
  example, if RM 
  ω is used to classify malicious content by combining LLMs each tuned to different types of harm categories, 
  then modifying inputs to force inference flows away from appropriate models could aid evasion. We leave evaluation of 
  how control-plane integrity attacks can enable evasion to future work. 