text: The black-box setting: confounders that transfer. Finally, the attacks so far are in the white-box setting, where the 
  attacker can optimize directly against Sθ. While in some cases routing control planes will be public knowledge, in others, 
  including the proprietary control planes we explore in Section 7, they are hidden. This gives rise to the black-box setting. 
  While an attacker might seek to perform model extraction attacks [43, 65] to learn θ, we instead explore attacks that 
  transfer from one router to another. 
  In more detail, we assume the adversary has access to a router R′ 
  ω′, called the surrogate, that is trained on data similar to 
  that used for the target router. Then the attack is the same as above, except that we use the surrogate’s scoring function 
  S′ 
  θ′ instead of the target’s Sθ. Again, we will see that this works surprisingly well: the query-independent confounders 
  found for the surrogate transfer to successfully reroute queries against the target router. 
  
  Putting it all together. In summary, our methodology for input adaptation attacks is: 
  
  (Preprocessing) Develop a single query-independent confounder gadget c, using either the target router or surrogate 
  to score the confounder. 
  (1) 