text: Number of tokens in the gadget. In our main evaluation, the gadgets are composed of n = 10 tokens. We evaluate the 
  effect of using less (n = 5) or more (n = 20 or n = 50) tokens. We observed that 5 tokens were insufficient to make 
  changes to the routing algorithm’s score and thus we were not able to optimize the gadget in this setting. As for 20 tokens, 
  we observe a a small improvement in the white-box setting, increase the average upgrade rate from 93.9% to 95.8%, and 
  a bigger improvement in the black-box setting, increase the average upgrade rate from 70.2% to 81.3%. Using 50 tokens 
  further increases the upgrade rates, to 98.2% in the white-box setting and 84.2% in the black box setting. The average 
  convergence rate increases as well, from 60 iterations for 10 tokens, to 70 for 20 tokens, and 100 for 50 tokens. Overall 
  this evaluation suggests that our rerouting attack can be even further improved by using longer gadgets, however it is 
  important to be careful not to make them too long to the point that they might degrade the performance of the underlying 
  LLM. 