text: LLM responses are sometimes affected by the confounder gadget. In some cases, the LLM responded with, for example, 
  “I can’t answer that question as it appears to be a jumbled mix of characters”. Still, the response continued with “However, 
  I can help you with the actual question you’re asking,” followed by the actual answer. We observed very few cases where 
  In most cases, the response did not mention anything 
  an LLM refused to answer due to the presence of the gadget. 
  
  1Some responses had abnormally high perplexity values (> 100), which we found do not correlate with quality, but these variations 
  disproportionately contribute to the average. We thus filter out such high-perplexity responses as outliers in both benign and attack 
  settings. We provide examples of filtered responses in Appendix D. 