text: Figure 2: Overview of our attack on LLM routing control plane integrity. The attack adds to each query a prefix (repre- 
  sented by the gear), called a “confounder gadget,” that causes the router to send the query to the strong model. 