Pith. sign in

REVIEW 5 major objections 6 minor 5 cited by

Rerouting LLM Routers

T0 review · 5 major / 6 minor · reviewed 2026-08-10 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A simple token prefix can hijack LLM routers and force every query to the expensive model.

desk verdict Read this for a well-run white-box attack on LLM routers and a useful new safety framing; don't take the commercial-router claims at face value. read the letter →

arxiv 2501.01818 v1 pith:QBR33H5S submitted 2025-01-03 cs.CR cs.LG

Avital Shafran , Roei Schuster , Thomas Ristenpart , Vitaly Shmatikov This is my paper · ORCID
classification cs.CRcs.LG
keywords LLMroutercontrolplaneintegrityconfoundergadgetadversarialrobustnesscostinflationroutingattackblack-boxtransferperplexity-baseddefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper defines a new safety property, LLM control plane integrity, and shows that current LLM routers fail it. The authors construct query-independent token sequences called confounder gadgets that, when prepended to any query, cause a router to send that query to the strong, expensive LLM. The attack works in white-box and black-box settings against both open-source and commercial routers, and the confounded queries still get high-quality responses. The paper also shows that perplexity-based filtering is not a reliable defense, since gadgets can be optimized to have low perplexity. If routers are widely deployed for cost control, this attack enables cost inflation and premium-model arbitrage.

What carries the argument

The confounder gadget is a short sequence of tokens found by hill-climbing: starting from a fixed token repeated n times, each iteration replaces one token with a random candidate and keeps the replacement that maximizes the router's scoring function applied to the gadget (or to the gadget concatenated with the query). For query-independent attacks, the optimization maximizes the score of the gadget alone, and the resulting prefix transfers across queries and, in the black-box setting, across routers trained on similar data.

What would settle it

A concrete test would be to take a commercial router like Unify or NotDiamond, train a surrogate router on a deliberately different distribution (e.g., only code queries instead of general chat), and check whether gadgets optimized on that surrogate still reroute queries on the target at the reported upgrade rates; if the upgrade rate drops to near zero, the transfer assumption fails.

Watch

Extended reading notes

Core claim

The central claim is that an adversary can generate a single fixed token sequence, a confounder gadget, that when prepended to arbitrary user queries makes an LLM router classify those queries as complex and route them to the strong model. The paper demonstrates this against four open-source routing algorithms (similarity-weighted ranking, matrix factorization, a BERT classifier, and a fine-tuned LLM classifier) and against commercial routers including Unify, NotDiamond, and OpenRouter. In white-box tests the gadgets reroute nearly all weak-model queries to the strong model, often reaching 100% upgrade rates; in black-box transfer tests, gadgets optimized on one router still transfer to others with high upgrade rates. The paper further shows that the attack does not degrade response quality and can even improve it when the strong model is substantially better than the weak one.

Load-bearing premise

The black-box and commercial-router attacks assume that a gadget optimized against a surrogate router trained on similar data will transfer to the actual target router, which is never independently verified for the proprietary routers.

Editorial extensions

If this is right

  • Cost-control mechanisms built on learned routers can be bypassed by a static prefix, so any application relying on routing to keep per-query costs down is exposed to cost inflation.
  • The same gadget can be used across many queries without per-query adaptation, making the attack cheap and easy to automate.
  • Black-box transfer means the attack can target proprietary routers without querying them, as long as a surrogate router trained on similar data is available.
  • Low-perplexity gadget variants make perplexity-based filtering ineffective as a standalone defense, so defenders need workload-level or user-level anomaly detection.
  • The attack can also be reversed to reroute queries to the weak model, showing the control plane can be pushed in either direction.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The attack likely generalizes to other routing architectures that use a learned scalar scoring function, including quality-focused routers and cascading systems, if those scoring functions are differentiable or can be queried.
  • The same mechanism could be extended to indirect settings, where the confounder is embedded in third-party content that a victim application retrieves, enabling control-plane integrity attacks without direct user input.
  • A stronger defense would need to combine perplexity filtering with per-user routing statistics or with an oracle LLM that judges naturalness, but each of these adds cost and can be evaded by more sophisticated gadget optimization.
  • The commercial-router results are an empirical bet on transfer: for proprietary routers whose scoring functions and training data are unknown, the attack's success depends on the surrogate being trained on data similar to the target's, which is not verified.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. The paper introduces the notion of LLM control plane integrity and studies the adversarial robustness of LLM routers. The attack, called a confounder gadget, is a short token sequence optimized by hill-climbing that, when prepended to any query, causes a router to send the query to the strong model. The authors evaluate the attack in white-box and black-box transfer settings against four open-source routers (RSW, RMF, RCLS, RLLM) on MT-Bench, MMLU, and GSM8K, and against three commercial routers (Unify, NotDiamond, OpenRouter). They further show that adding a perplexity penalty to the optimization evades GPT-2-based perplexity filtering, and they discuss alternative defenses.

Significance. If the core white-box and same-family transfer results hold, the paper identifies a practically relevant, economically motivated vulnerability in a class of systems that is growing in deployment. The formalization of control plane integrity is a useful framing, and the open-source-router evaluation is reasonably thorough: it covers four router algorithms, several benchmarks, multiple LLM pairs, and reports standard errors. The paper also honestly reports mixed commercial results rather than selecting favorable cases. The main contributions are the attack methodology and the demonstration that perplexity-based filtering is evadable, though the strength of the commercial-router and response-quality claims is not fully matched by the evidence.

major comments (5)
  1. [Abstract and Section 7] The abstract claims the attack is successful "against a variety of commercial routers," but the Section 7 evidence is mixed: Unify shows 79–91% upgrade rates, NotDiamond only 13–21% upgrades with a high 82% strong-model baseline and 1–3% downgrades, and OpenRouter only 3–4 of 10 gadgets produce full rerouting, while no RCLS gadget has any effect. No confidence intervals or per-gadget breakdowns are given for these commercial runs, and the evaluation uses only 72 MT-Bench queries. The commercial claim should be narrowed to Unify (and partially OpenRouter) or supported with additional experiments and error bars.
  2. [Section 4 and Section 7] The black-box transfer evaluation is dominated by same-family transfer: all four open-source routers come from the same RouteLLM codebase and preference data, so transfer among them does not test cross-distribution transfer. The only cross-family evidence is the commercial-router results, which are mixed as noted above. The paper should either temper the "black-box successful" claim or provide additional evidence, for example by training surrogate routers on different data distributions and measuring transfer.
  3. [Section 7, NotDiamond paragraph] The conclusion that "NotDiamond is more robust than Unify" is not supported by the reported upgrade rates. With GPT-4o/Mixtral, 82% of original queries already go to the strong model, so the maximum possible upgrade rate over the remaining weak queries is 18%; upgrade rates of 15–21% are therefore near or at the ceiling, meaning almost all weak queries are being rerouted. The comparison should account for the baseline strong-model fraction and the downgrade rate, or use a controlled setting with matched baselines.
  4. [Section 6, footnotes on perplexity filtering] The claim that confounding does not affect response quality is partly based on perplexity comparisons after filtering out responses with perplexity greater than 100 (footnote 1). The number of filtered responses is not reported separately for benign and confounded settings. If the attack increases the rate of high-perplexity responses, this filtering could hide a quality degradation. The benchmark-score evidence in Tables 3 and 4 is more convincing, but the authors should either report the filter counts or drop the perplexity-based quality claim.
  5. [Section 8] The conclusion that "perplexity-based filtering is not an effective defense" is too broad. The evasive gadgets are optimized using the same GPT-2 perplexity function that the defender is assumed to use, and the paper tests no other perplexity estimators or ensembles. The claim should be restricted to GPT-2-based perplexity filtering, or additional experiments with other perplexity models should be reported.
minor comments (6)
  1. [Section 4, Eq. (1)] The symbol B is used both for the batch size and for the candidate set B = {c~0, ..., c~B}, which is confusing; consider renaming one of them.
  2. [Tables 5, 6, 7, 9] The column header "SF M" appears to be a typo for "RM F"; please correct it.
  3. [Section 8] The phrase "against against rerouting" contains a duplicated word.
  4. [Appendix D] The word "withing" should be "within" in the sentence about perplexity values being "close and withing the margin of error."
  5. [Appendix B] The phrase "we observe a a small improvement" contains a duplicated article.
  6. [General] The paper does not state whether code or artifacts are available. Providing the implementation and trained gadget examples would aid reproducibility, which would strengthen the paper given the empirical nature of the contributions.

Circularity Check

0 steps flagged · score 1.0 of 10

No significant circularity: the attack is an empirical evaluation against external routers; self-citations are contextual and not load-bearing.

full rationale

The paper's load-bearing claim is that query-independent confounder gadgets reroute queries to the strong LLM. This is established by direct experiments against open-source routers (Section 6), whose scoring functions and thresholds are external artifacts from Ong et al. [47], and against commercial routers (Section 7) via black-box APIs. The white-box optimization in Eq. 1 maximizes the router's own score, but the paper never relabels this optimization as a prediction; the empirical content is that the optimized prefix transfers across held-out queries and across model pairs, with downgrade rates reported. The black-box transfer assumption in Section 4 is an explicit threat-model assumption, not a fitted parameter disguised as a result, and the commercial results honestly include weak cases such as NotDiamond's 15-21% upgrade rates and OpenRouter's only 3-4 of 10 gadgets succeeding. The low-perplexity evasion in Section 8 optimizes against the same GPT-2 perplexity function used by the evaluated defense, which makes evasion partly by construction; however, the remaining claim, that low-perplexity gadgets still reroute with substantial upgrade rates (Table 11), is independently measured. The only self-citations ([55], [69]) appear in related work and a defense discussion and are not load-bearing for the central result. Therefore the derivation chain is self-contained and no circular step can be exhibited.

Assumptions & free parameters 7 free parameters · 5 assumptions · 3 invented entities

This paper is an empirical attack demonstration, not a derivational paper. It introduces no hypothesized physical mechanisms; the only new terms are conceptual or are artifacts demonstrated with data. The hand-set hyperparameters listed above directly affect the reported attack and defense-evasion success rates.

free parameters (7)
  • gadget length n = 10 tokens
    Hand-chosen in Sections 4 and 5. With n=5 the optimization fails to change the router score; with n=20 and n=50 upgrade rates improve, so the reported attack success depends on this choice.
  • optimization iterations T = 100
    Hand-chosen in Section 6. Convergence averages 58 to 66 iterations; early abort after 25 no-update iterations. Larger T for query-independent gadgets increases S(c) and thus transfer.
  • candidate batch size B = 32
    Hand-chosen in Section 6; affects search quality and runtime.
  • perplexity balancing coefficient alpha = 0.01
    Hand-chosen in Section 8 for the low-perplexity evasion variant; Table 11 shows it lowers upgrade rates, and the authors suggest tuning it.
  • target perplexity rho = average GPT-2 perplexity of 100 held-out GSM8K queries
    Hand-chosen in Section 8; calibrates the perplexity constraint for the evasion attack.
  • routing threshold tau (per router and dataset) = calibrated so that 50% of calibration queries route to the strong model
    Section 5: each of the 12 router-dataset pairs gets a threshold set on a calibration set; the attack success rate is measured against these thresholds.
  • Unify metric weights = quality weight 1, cost weight 0.02, time and latency 0
    Section 7: manually calibrated to route 49% of unmodified MT-Bench queries to the strong model; the reported cost inflation factor depends on these weights.
assumptions (5)
  • domain assumption The target router is a binary classifier R(x) = M_w if S_theta(x) < tau, else M_s.
    Section 4 formalizes the attack setting this way, following RouteLLM and other prescriptive routers; the attack is not evaluated against cascades or non-prescriptive routers.
  • domain assumption The adversary can control a contiguous substring of the prompt, specifically a prefix before the user content.
    Stated in Section 4 threat model; covers chatbots and coding assistants that insert user input into prompts, but not applications that sanitize or structurally constrain user tokens.
  • domain assumption A surrogate router trained on data similar to the target's training data yields gadgets that transfer to the target.
    Section 4 black-box setting and Section 7 commercial router evaluation rely on this unverified similarity; for open-source routers surrogate and target share the RouteLLM training data.
  • domain assumption GPT-2 perplexity is a serviceable measure of query naturalness for the defense analysis.
    Section 8 assumes the defender uses GPT-2 perplexity thresholds; the attack's evasion is evaluated against this same measure, not against other perplexity functions.
  • domain assumption RouteLLM routers trained for one strong/weak LLM pair generalize to other pairs.
    Section 5 relies on Ong et al.'s claim to test with Llama-3.1-8B and Mixtral pairs instead of GPT-4 and Mixtral; pair 4 results show similar success.
invented entities (3)
  • LLM control plane
    purpose: Conceptual framing to define a class of multi-LLM orchestration systems and the new safety property 'control plane integrity'.
    A conceptual term, not an empirical entity; no falsifiable handle outside the demonstrated attacks.
  • confounder gadget independent evidence
    purpose: Query-independent adversarial token sequence that reroutes queries to a chosen LLM.
    The artifact is demonstrated empirically across routers and benchmarks in the paper; a third party could re-derive gadgets with the specified algorithm, though no code is released.
  • LLM control plane integrity
    purpose: New AI-safety property: robustness of routing decisions to adversarial inputs.
    A definitional contribution; its value depends on whether the community adopts the property.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Rerouting LLM Routers." pith.science (2026). https://pith.science/paper/QBR33H5S

@misc{pith2026250101818,
  author       = {Pith},
  title        = {Pith review of: Rerouting LLM Routers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QBR33H5S}},
  note         = {Machine review of arXiv:2501.01818}
}
read the original abstract

LLM routers aim to balance quality and cost of generation by classifying queries and routing them to a cheaper or more expensive LLM depending on their complexity. Routers represent one type of what we call LLM control planes: systems that orchestrate use of one or more LLMs. In this paper, we investigate routers' adversarial robustness. We first define LLM control plane integrity, i.e., robustness of LLM orchestration to adversarial inputs, as a distinct problem in AI safety. Next, we demonstrate that an adversary can generate query-independent token sequences we call ``confounder gadgets'' that, when added to any query, cause LLM routers to send the query to a strong LLM. Our quantitative evaluation shows that this attack is successful both in white-box and black-box settings against a variety of open-source and commercial routers, and that confounding queries do not affect the quality of LLM responses. Finally, we demonstrate that gadgets can be effective while maintaining low perplexity, thus perplexity-based filtering is not an effective defense. We finish by investigating alternative defenses.

Figures

Figures reproduced from arXiv: 2501.01818 by the authors.

Figure 1
Figure 1. LLM routers classify queries and route complex ones to an expensive/strong model, others to a cheaper/weak [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of our attack on LLM routing control plane integrity. The attack adds to each query a prefix (repre [PITH_FULL_IMAGE:figures/full_fig_p005_2.png] view at source ↗
Figure 3
Figure 3. Summary of our setup for routers, underlying LLMs, and benchmark datasets used in the experiments. [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: Convergence of gadget generation against different routing algorithms. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Perplexity of the original queries in the GSM8K benchmark compared to the perplexity of confounded queries [PITH_FULL_IMAGE:figures/full_fig_p015_5.png]
Figure 6
Figure 6. Figure 6: Perplexity values of the original and confounded queries, and the corresponding ROC curves of the defense that [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: Histograms of the perplexity values of clean responses generated by the strong and weak models. [PITH_FULL_IMAGE:figures/full_fig_p025_7.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. When Compression Becomes an Attack Surface: Black-Box Attacks on Prompt-Compressed LLM Agents

    cs.CR 2025-10 reject novelty 6.0 of 10

    The paper claims prompt compression is a new attack surface, but the abstract's COMA attack never appears in the body and the body's SoftCom requires white-box access.

  2. BadMoE: Backdooring Mixture-of-Experts LLMs via Optimizing Routing Triggers and Infecting Dormant Experts

    cs.CR 2025-04 conditional novelty 6.0 of 10

    BadMoE implants backdoors into dormant experts of MoE LLMs and uses routing-trigger optimization to activate them, achieving high attack success while preserving normal accuracy.

  3. Breaking the Mirror: Activation-Based Mitigation of Self-Preference in LLM Evaluators

    cs.CL 2025-09 conditional novelty 5.0 of 10

    Steering vectors flip most unjustified self-preference decisions of an LLM judge but also disturb legitimate ones, showing the bias is not captured by a single linear direction.

  4. Universal Model Routing for Efficient LLM Inference

    cs.CL 2025-02 conditional novelty 5.0 of 10

    UniRoute represents each language model by its error rates on a few prompt clusters, letting a router choose among models it has never seen during training.

  5. Securing Agentic AI: From Per-Action Checks to Trajectory Assurance

    cs.AI 2026-08 conditional novelty 3.0 of 10

    A vision paper organizing agentic AI security into eleven research directions, with the thesis that safety requires verifiable trajectory-level behavioral guarantees, not per-action checks.

Reference graph

Works this paper leans on

73 extracted references · 44 canonical work pages · cited by 5 Pith papers

  1. [1]

    Chatbot Arena LLM Leaderboard: Community-driven evaluation for best LLM and AI chatbots,

    “Chatbot Arena LLM Leaderboard: Community-driven evaluation for best LLM and AI chatbots,” https:// huggingface.co/spaces/lmarena-ai/chatbot-arena-leaderboard, accessed: 2024-11-14

    work page 2024

  2. [2]

    Hello gpt-4o,

    “Hello gpt-4o,” https://openai.com/index/hello-gpt-4o/, published: 2024-05-23

    work page 2024

  3. [3]

    Introducing Llama 3.1: Our most capable models to date,

    “Introducing Llama 3.1: Our most capable models to date,” https://ai.meta.com/blog/meta-llama-3-1/, published: 2024-07-23

    work page 2024

  4. [4]

    Introducing Meta Llama 3: The most capable openly available LLM to date,

    “Introducing Meta Llama 3: The most capable openly available LLM to date,” https://ai.meta.com/blog/ meta-llama-3/, published: 2024-04-18

    work page 2024

  5. [5]

    Martian LLM router,

    “Martian LLM router,” https://withmartian.com/

    work page

  6. [6]

    New embedding models and API updates,

    “New embedding models and API updates,” https://openai.com/index/new-embedding-models-and-api-updates, published: 2024-01-25

    work page 2024

  7. [7]

    Notdiamond LLM router,

    “Notdiamond LLM router,” https://www.notdiamond.ai/

    work page

  8. [8]

    OpenAI and others seek new path to smarter AI as current meth- ods hit limitations,

    “OpenAI and others seek new path to smarter AI as current meth- ods hit limitations,” https://www.reuters.com/technology/artificial-intelligence/ openai-rivals-seek-new-path-smarter-ai-current-methods-hit-limitations-2024-11-11, published: 2024-11-15

    work page 2024

Show all 73 references
  1. [9]

    OpenAI, Google and Anthropic are struggling to build more advanced AI,

    “OpenAI, Google and Anthropic are struggling to build more advanced AI,” https://www.bloomberg.com/news/ articles/2024-11-13/openai-google-and-anthropic-are-struggling-to-build-more-advanced-ai?sref=CrGXSfHu, published: 2024-11-13

    2024

  2. [10]

    OpenAI shifts strategy as rate of ‘GPT’ AI improvements slows,

    “OpenAI shifts strategy as rate of ‘GPT’ AI improvements slows,” https://www.theinformation.com/articles/ openai-shifts-strategy-as-rate-of-gpt-ai-improvements-slows, published: 2024-11-9

    2024

  3. [11]

    Openrouter LLM router,

    “Openrouter LLM router,” https://openrouter.ai/

  4. [12]

    Unify LLM router,

    “Unify LLM router,” https://unify.ai/

  5. [13]

    What is a control plane?

    “What is a control plane?” https://www.ibm.com/think/topics/control-plane, published: 2024-10-31

    2024

  6. [14]

    GPT-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkat et al., “GPT-4 technical report,” arXiv preprint arXiv:2303.08774, 2023

    2023 arXiv

  7. [15]

    Automix: Automatically mixing language models,

    P. Aggarwal, A. Madaan, A. Anand, S. P. Potharaju, S. Mishra, P. Zhou, A. Gupta, D. Rajagopal, K. Kappaganthu, Y . Yanget al., “Automix: Automatically mixing language models,” arXiv preprint arXiv:2310.12963, 2023

    2023 arXiv

  8. [16]

    Detecting language model attacks with perplexity,

    G. Alon and M. Kamfonas, “Detecting language model attacks with perplexity,” arXiv preprint arXiv:2308.14132, 2023

    2023 arXiv

  9. [17]

    Rank analysis of incomplete block designs: I. the method of paired comparisons,

    R. A. Bradley and M. E. Terry, “Rank analysis of incomplete block designs: I. the method of paired comparisons,” Biometrika, vol. 39, no. 3/4, 1952

    1952

  10. [18]

    Stealing part of a production language model,

    N. Carlini, D. Paleka, K. D. Dvijotham, T. Steinke, J. Hayase, A. F. Cooper, K. Lee, M. Jagielski, M. Nasr, A. Conmy et al., “Stealing part of a production language model,” arXiv preprint arXiv:2403.06634, 2024

    2024 arXiv

  11. [19]

    Phantom: General trigger attacks on retrieval augmented language generation,

    H. Chaudhari, G. Severi, J. Abascal, M. Jagielski, C. A. Choquette-Choo, M. Nasr, C. Nita-Rotaru, and A. Oprea, “Phantom: General trigger attacks on retrieval augmented language generation,” arXiv preprint arXiv:2405.20485, 2024

    2024

  12. [20]

    FrugalGPT: How to use large language models while reducing cost and improving performance,

    L. Chen, M. Zaharia, and J. Zou, “FrugalGPT: How to use large language models while reducing cost and improving performance,” arXiv preprint arXiv:2305.05176, 2023

    2023 arXiv

  13. [21]

    Chatbot arena: An open platform for evaluating LLMs by human preference,

    W.-L. Chiang, L. Zheng, Y . Sheng, A. N. Angelopoulos, T. Li, D. Li, B. Zhu, H. Zhang, M. Jordan, J. E. Gon- zalez, and I. Stoica, “Chatbot arena: An open platform for evaluating LLMs by human preference,” in Forty-first International Conference on Machine Learning (ICML), 2024

    2024

  14. [22]

    Typos that broke the RAG’s back: Genetic attack on RAG pipeline by simulating documents in the wild via low-level perturbations,

    S. Cho, S. Jeong, J. Seo, T. Hwang, and J. C. Park, “Typos that broke the RAG’s back: Genetic attack on RAG pipeline by simulating documents in the wild via low-level perturbations,”arXiv preprint arXiv:2404.13948, 2024

    2024 arXiv

  15. [23]

    Comprehensive assessment of jailbreak attacks against LLMs,

    J. Chu, Y . Liu, Z. Yang, X. Shen, M. Backes, and Y . Zhang, “Comprehensive assessment of jailbreak attacks against LLMs,” arXiv preprint arXiv:2402.05668, 2024

    2024 arXiv

  16. [24]

    Training verifiers to solve math word problems,

    K. Cobbe, V . Kosaraju, M. Bavarian, M. Chen, H. Jun, L. Kaiser, M. Plappert, J. Tworek, J. Hilton, R. Nakanoet al., “Training verifiers to solve math word problems,”arXiv preprint arXiv:2110.14168, 2021

    2021 arXiv

  17. [25]

    Adversarial classification,

    N. Dalvi, P. Domingos, Mausam, S. Sanghai, and D. Verma, “Adversarial classification,” inProceedings of the tenth ACM SIGKDD international conference on Knowledge discovery and data mining, 2004. 19

    2004

  18. [26]

    BERT: Pre-training of deep bidirectional transformers for language understanding,

    J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “BERT: Pre-training of deep bidirectional transformers for language understanding,” in Proceedings of the 2019 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologi...

    2019

  19. [27]

    Hybrid LLM: Cost-efficient and quality-aware query routing,

    D. Ding, A. Mallick, C. Wang, R. Sim, S. Mukherjee, V . R ¨uhle, L. V . Lakshmanan, and A. H. Awadallah, “Hybrid LLM: Cost-efficient and quality-aware query routing,” in International Conference on Learning Representations (ICLR), 2024

    2024

  20. [28]

    How robust is Google’s Bard to adversarial image attacks?

    Y . Dong, H. Chen, J. Chen, Z. Fang, X. Yang, Y . Zhang, Y . Tian, H. Su, and J. Zhu, “How robust is Google’s Bard to adversarial image attacks?” arXiv preprint arXiv:2309.11751, 2023

    2023 arXiv

  21. [29]

    Glam: Efficient scaling of language models with mixture-of-experts,

    N. Du, Y . Huang, A. M. Dai, S. Tong, D. Lepikhin, Y . Xu, M. Krikun, Y . Zhou, A. W. Yu, O. Firat et al., “Glam: Efficient scaling of language models with mixture-of-experts,” in International Conference on Machine Learning (ICML), 2022

    2022

  22. [30]

    Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity,

    W. Fedus, B. Zoph, and N. Shazeer, “Switch transformers: Scaling to trillion parameter models with simple and efficient sparsity,”Journal of Machine Learning Research (JMLR), 2022

    2022

  23. [31]

    Graphrouter: A graph-based router for LLM selections,

    T. Feng, Y . Shen, and J. You, “Graphrouter: A graph-based router for LLM selections,” arXiv preprint arXiv:2410.03834, 2024

    2024 arXiv

  24. [32]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in International Conference on Learning Representations (ICLR), 2015

    2015

  25. [33]

    Not what you’ve signed up for: Compro- mising real-world LLM-integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compro- mising real-world LLM-integrated applications with indirect prompt injection,” in ACM AISec, 2023

    2023

  26. [34]

    Buffer overflow in mixture of experts,

    J. Hayes, I. Shumailov, and I. Yona, “Buffer overflow in mixture of experts,”arXiv preprint arXiv:2402.05526, 2024

    2024 arXiv

  27. [35]

    Measuring massive multitask language understanding,

    D. Hendrycks, C. Burns, S. Basart, A. Zou, M. Mazeika, D. Song, and J. Steinhardt, “Measuring massive multitask language understanding,” in International Conference on Learning Representations (ICLR), 2021

    2021

  28. [36]

    Baseline defenses for adversarial attacks against aligned language models,

    N. Jain, A. Schwarzschild, Y . Wen, G. Somepalli, J. Kirchenbauer, P.-y. Chiang, M. Goldblum, A. Saha, J. Geip- ing, and T. Goldstein, “Baseline defenses for adversarial attacks against aligned language models,” arXiv preprint arXiv:2309.00614, 2023

    2023 arXiv

  29. [37]

    Interpolated estimation of Markov source parameters from sparse data,

    F. Jelinek, “Interpolated estimation of Markov source parameters from sparse data,” 1980. [Online]. Available: https://api.semanticscholar.org/CorpusID:61012010

    1980

  30. [38]

    Mistral 7B,

    A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. d. l. Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier et al., “Mistral 7B,” arXiv preprint arXiv:2310.06825, 2023

    2023 arXiv

  31. [39]

    Mixtral of experts,

    A. Q. Jiang, A. Sablayrolles, A. Roux, A. Mensch, B. Savary, C. Bamford, D. S. Chaplot, D. d. l. Casas, E. B. Hanna, F. Bressand et al., “Mixtral of experts,” arXiv preprint arXiv:2401.04088, 2024

    2024 arXiv

  32. [40]

    LLM-Blender: Ensembling large language models with pairwise ranking and generative fusion,

    D. Jiang, X. Ren, and B. Y . Lin, “LLM-Blender: Ensembling large language models with pairwise ranking and generative fusion,” in Proceedings of the 61st Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), 2023

    2023

  33. [41]

    OrchestraLLM: Efficient orchestration of language models for dialogue state tracking,

    C.-H. Lee, H. Cheng, and M. Ostendorf, “OrchestraLLM: Efficient orchestration of language models for dialogue state tracking,” in Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies (V...

    2024

  34. [42]

    Jailbreaking ChatGPT via prompt engineering: An empirical study,

    Y . Liu, G. Deng, Z. Xu, Y . Li, Y . Zheng, Y . Zhang, L. Zhao, T. Zhang, K. Wang, and Y . Liu, “Jailbreaking ChatGPT via prompt engineering: An empirical study,” arXiv preprint arXiv:2305.13860, 2023

    2023 arXiv

  35. [43]

    Adversarial learning,

    D. Lowd and C. Meek, “Adversarial learning,” in ACM International Conference on Knowledge Discovery in Data Mining (SIGKDD), 2005

    2005

  36. [44]

    Pointer sentinel mixture models,

    S. Merity, C. Xiong, J. Bradbury, and R. Socher, “Pointer sentinel mixture models,” in International Conference on Learning Representations (ICLR), 2016

    2016

  37. [45]

    Tryage: Real-time, intelligent routing of user prompts to large language models,

    S. Narayanan Hari and M. Thomson, “Tryage: Real-time, intelligent routing of user prompts to large language models,” arXiv e-prints, 2023

    2023

  38. [46]

    Scalable extraction of training data from (production) language models,

    M. Nasr, N. Carlini, J. Hayase, M. Jagielski, A. F. Cooper, D. Ippolito, C. A. Choquette-Choo, E. Wallace, F. Tram`er, and K. Lee, “Scalable extraction of training data from (production) language models,” arXiv preprint arXiv:2311.17035, 2023

    2023 arXiv

  39. [47]

    RouteLLM: Learning to route LLMs with preference data,

    I. Ong, A. Almahairi, V . Wu, W.-L. Chiang, T. Wu, J. E. Gonzalez, M. W. Kadous, and I. Stoica, “RouteLLM: Learning to route LLMs with preference data,” arXiv preprint arXiv:2406.18665, 2024. 20

    2024 arXiv

  40. [48]

    Practical black-box attacks against machine learning,

    N. Papernot, P. McDaniel, I. Goodfellow, S. Jha, Z. B. Celik, and A. Swami, “Practical black-box attacks against machine learning,” in Proceedings of the 2017 ACM on Asia conference on computer and communications security, 2017

    2017

  41. [49]

    The limitations of deep learning in adversarial settings,

    N. Papernot, P. McDaniel, S. Jha, M. Fredrikson, Z. B. Celik, and A. Swami, “The limitations of deep learning in adversarial settings,” in IEEE European symposium on security and privacy (EuroS&P), 2016

    2016

  42. [50]

    Ignore previous prompt: Attack techniques for language models,

    F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” in NeurIPS ML Safety Workshop, 2022

    2022

  43. [51]

    Language models are unsupervised multitask learners,

    A. Radford, J. Wu, R. Child, D. Luan, D. Amodei, and I. Sutskever, “Language models are unsupervised multitask learners,” https://cdn.openai.com/better-language-models/language models are unsupervised multitask learners.pdf, 2019

    2019

  44. [52]

    Scaling vision with sparse mixture of experts,

    C. Riquelme, J. Puigcerver, B. Mustafa, M. Neumann, R. Jenatton, A. Susano Pinto, D. Keysers, and N. Houlsby, “Scaling vision with sparse mixture of experts,” Advances in Neural Information Processing Systems (NeurIPS) , 2021

    2021

  45. [53]

    Fly-swat or cannon? cost-effective language model choice via meta-modeling,

    M. ˇSakota, M. Peyrard, and R. West, “Fly-swat or cannon? cost-effective language model choice via meta-modeling,” in Proceedings of the 17th ACM International Conference on Web Search and Data Mining, 2024

    2024

  46. [54]

    Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition,

    S. Schulhoff, J. Pinto, A. Khan, L.-F. Bouchard, C. Si, S. Anati, V . Tagliabue, A. Kost, C. Carnahan, and J. Boyd- Graber, “Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition,” in EMNLP, 2023

    2023

  47. [55]

    Machine against the RAG: Jamming retrieval-augmented generation with blocker documents,

    A. Shafran, R. Schuster, and V . Shmatikov, “Machine against the RAG: Jamming retrieval-augmented generation with blocker documents,” arXiv preprint arXiv:2406.05870, 2024

    2024 arXiv

  48. [56]

    Outrageously large neural net- works: The sparsely-gated mixture-of-experts layer,

    N. Shazeer, A. Mirhoseini, K. Maziarz, A. Davis, Q. Le, G. Hinton, and J. Dean, “Outrageously large neural net- works: The sparsely-gated mixture-of-experts layer,” in International Conference on Learning Representations , 2016

    2016

  49. [57]

    Large language model routing with benchmark datasets,

    T. Shnitzer, A. Ou, M. Silva, K. Soule, Y . Sun, J. Solomon, N. Thompson, and M. Yurochkin, “Large language model routing with benchmark datasets,” arXiv preprint arXiv:2309.15789, 2023

    2023 arXiv

  50. [58]

    Harnessing the power of multiple minds: Lessons learned from LLM routing,

    K. Srivatsa, K. K. Maurya, and E. Kochmar, “Harnessing the power of multiple minds: Lessons learned from LLM routing,” arXiv preprint arXiv:2405.00467, 2024

    2024 arXiv

  51. [59]

    Tensoropera router: A multi-model router for efficient LLM inference,

    D. Stripelis, Z. Hu, J. Zhang, Z. Xu, A. Shah, H. Jin, Y . Yao, S. Avestimehr, and C. He, “Tensoropera router: A multi-model router for efficient LLM inference,” arXiv preprint arXiv:2408.12320, 2024

    2024 arXiv

  52. [60]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” arXiv preprint arXiv:1312.6199, 2013

    2013 arXiv

  53. [61]

    Gemini: a family of highly capable multimodal models,

    G. Team, R. Anil, S. Borgeaud, J.-B. Alayrac, J. Yu, R. Soricut, J. Schalkwyk, A. M. Dai, A. Hauth, K. Millican et al., “Gemini: a family of highly capable multimodal models,” arXiv preprint arXiv:2312.11805, 2023

    2023 arXiv

  54. [62]

    Openhermes 2.5: An open dataset of synthetic data for generalist LLM assistants,

    Teknium, “Openhermes 2.5: An open dataset of synthetic data for generalist LLM assistants,” 2023. [Online]. Available: https://huggingface.co/datasets/teknium/OpenHermes-2.5

    2023

  55. [63]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y . Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  56. [64]

    Tensor Trust: Interpretable prompt injection attacks from an online game,

    S. Toyer, O. Watkins, E. A. Mendes, J. Svegliato, L. Bailey, T. Wang, I. Ong, K. Elmaaroufi, P. Abbeel, T. Darrell et al., “Tensor Trust: Interpretable prompt injection attacks from an online game,” in International Conference on Learning Representations (ICLR), 2023

    2023

  57. [65]

    Stealing machine learning models via prediction APIs,

    F. Tram `er, F. Zhang, A. Juels, M. K. Reiter, and T. Ristenpart, “Stealing machine learning models via prediction APIs,” in USENIX Security Symposium, 2016

    2016

  58. [66]

    Jailbroken: How does LLM safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does LLM safety training fail?” in Advances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  59. [67]

    Stealing user prompts from mixture of experts,

    I. Yona, I. Shumailov, J. Hayes, and N. Carlini, “Stealing user prompts from mixture of experts,” arXiv preprint arXiv:2410.22884, 2024

    2024 arXiv

  60. [68]

    Large language model cascades with mixture of thought represen- tations for cost-efficient reasoning,

    M. Yue, J. Zhao, M. Zhang, L. Du, and Z. Yao, “Large language model cascades with mixture of thought represen- tations for cost-efficient reasoning,” in International Conference on Learning Representations (ICLR), 2024

    2024

  61. [69]

    Controlled generation of natural adversarial documents for stealthy retrieval poisoning,

    C. Zhang, T. Zhang, and V . Shmatikov, “Controlled generation of natural adversarial documents for stealthy retrieval poisoning,” arXiv preprint arXiv:2410.02163, 2024

    2024 arXiv

  62. [70]

    Effective prompt extraction from language models,

    Y . Zhang, N. Carlini, and D. Ippolito, “Effective prompt extraction from language models,” in First Conference on Language Modeling, 2024. 21

    2024

  63. [71]

    Judging LLM- as-a-judge with MT-Bench and chatbot arena,

    L. Zheng, W.-L. Chiang, Y . Sheng, S. Zhuang, Z. Wu, Y . Zhuang, Z. Lin, Z. Li, D. Li, E. Xinget al., “Judging LLM- as-a-judge with MT-Bench and chatbot arena,” Advances in Neural Information Processing Systems (NeurIPS) , 2023

    2023

  64. [72]

    AutoDAN: Automatic and interpretable adversarial attacks on large language models,

    S. Zhu, R. Zhang, B. An, G. Wu, J. Barrow, Z. Wang, F. Huang, A. Nenkova, and T. Sun, “AutoDAN: Automatic and interpretable adversarial attacks on large language models,” arXiv preprint arXiv:2310.15140, 2023

    2023 arXiv

  65. [73]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” arXiv preprint arXiv:2307.15043, 2023. A Gadget Examples Below are a few examples of the optimized confounder gadgets c we got, for the different rout...

    2023 arXiv

Pith tools

Reviewed August 10, 2026 · model on record in the stance chip above.