text: abnormal about the query. Intuitively, this reflects the fact that while LLMs are built to be robust to noisy inputs, the 
  router itself is not. 
  
  In summary, the attack is highly successful at rerouting queries from the weak to the strong model. Overall, quality 
  improves if there is a significant gap between the strong and weak LLMs used by the router. Either way, confounding has 
  no negative impact on the quality of responses. 