text: Results for LLM pair 4. As discussed in Section 5, we replace the strong model that was used by Ong et al. [47], GPT-4- 
  1106-preview (rank 28 in the Chatbot Arena leaderboard [1, 21]), with the open-sourced Llama-3.1-8B (rank 58) to reduce 
  the costs of our extensive set of evaluations. In this section we perform a smaller-scale evaluation of the quality-enhancing 
  attack performance when using GPT as the strong model, i.e., LLM pair 4. We evaluate this setting using three of the 
  n = 10 confounder gadgets for each router. 
  
  Table 10 shows the results across benchmarks in the white-box setting. Compared to the pair 1 setting (Table 3), the attack 
  results in a higher increase in benchmark performance. This further demonstrates higher attack effect on response quality 
  when the performance gap between the weak and strong models is higher. 
  
  7 Rerouting Commercial Routers 
  
  We evaluate our rerouting attack on several commercial routers: Unify [12], NotDiamond [7], OpenRouter [11], and 
  Martian [5]. These routers are available through black-box APIs. Therefore, we use our black-box attack with the 
  40 gadgets optimized for the open-sourced routers RSW , RM F , RCLS, and RLLM (10 per router). We perform this 
  evaluation using the MT-bench benchmark. 