text: Threat models. Within the context of control plane integrity attacks against LLM routers, we identify several threat 
  models that differ in terms of the adversary’s goals and their knowledge about the target control plane RM 
  ω . 
  
  In terms of goals, an adversary may seek to inflate the costs of a victim application that utilizes an LLM control plane. 
  As a kind of denial-of-service attack, such cost inflation would penalize the application developer who expects routing 
  to control costs. Another adversarial goal could be arbitrage: consider an application that charges X dollars per query, 
  whereas directly using Ms costs Y > X. The application’s lower rate X makes economic sense assuming it uses a router 
  to route the bulk of queries to a cheaper model Mw. An input adaptation attack in this setting can gain (indirect) access to 
  Ms, obtaining an arbitrage advantage of Y − X per query. To be effective, this arbitrage adversary would want to ensure 
  that adaptations do not lower response quality (i.e., it extracts all the value out of rerouting to Ms). As before, the victim 
  in this case is the application that relies on routing to lower its costs (unsuccessfully, under this attack). 
  
  We now discuss adversarial capabilities. We assume that our victim application’s prompt includes a substring that can be 
  controlled by the adversary. This represents many real-world apps such as chatbots, coding assistants, writing assistants, 
  and others, that insert user inputs into an LLM prompt. In crafting adversarial portions of prompts, an adversary may have 
  various levels of knowledge about the victim application’s router. We consider the following knowledge settings: 