text: Unfortunately, this defense can be evaded if an adversary incorporates a perplexity constraint into the gadget generation 
  process. To demonstrate the feasibility of this evasion strategy, we modify gadget generation to maximize the score of the 
  routing algorithm R and simultaneously aligning the the gadget’s perplexity to some predefined perplexity value. In more 
  detail, in each iteration t ∈ [T ], we uniformly sample a target index j ∈ [1, n] and generate a set B of B + 1 candidates as 
  explained in Section 4. We then modify Eq. 1 such that we now find the candidate that maximizes the difference between 
  the router’s score and the perplexity constraint for the confounder: 
  
  (cid:0)Sθ(c∥xi) − α · |PPL(c) − ρ|(cid:1) ,  c(t+1) ← arg max 
  c∈B 
  
  14 