text: Routing attacks can be deployed for various adversarial objectives, e.g., to ensure that the adversary always obtains the 
  highest-quality answer regardless of the target applications’s internal routing policies and cost constraints, or to mali- 
  ciously inflate the target’s LLM costs. As LLM control planes grow in importance and sophistication, we hope that this 
  work will motivate further research on their adversarial robustness. 
  
  2 LLM Control Planes and Routing 
  
  Inference using large language models (LLMs) is traditionally monolithic: a single model is applied to an input or se- 
  quence of inputs. This methodology can be sub-optimal for various reasons. State-of-the-art models are often expensive, 
  with API access to LLMs costing as much as several dollars for each query. Elsewhere, distinct LLMs may excel at dif- 
  ferent tasks, and selectively using them may improve overall quality on a diverse workload. Finally, combining multiple 
  LLMs, even all trained for similar tasks, may become increasingly prevalent as performance improvements of individual 
  LLMs plateaus [8–10]. 
  
  Researchers and practitioners are therefore now developing inference architectures that use multiple LLMs to answer 
  queries. These LLMs are orchestrated by what we call an LLM control plane (borrowing the terminology from network- 
  ing [13]). The control plane may route queries or parts of queries to different LLMs, derive new strings to query to 
  underlying LLMs, combine answers from underlying LLMs, and more. 