标题： 重新路由 LLM 路由器 显示英文标题

标题： Rerouting LLM Routers

摘要： LLM路由器旨在通过分类查询并将它们路由到更便宜或更昂贵的LLM来平衡生成的质量和成本，具体取决于查询的复杂性。 路由器代表我们所谓的LLM控制平面的一种类型：协调使用一个或多个LLM的系统。 在本文中，我们研究了路由器的对抗鲁棒性。 我们首先将LLM控制平面完整性定义为AI安全中的一个独立问题，即LLM编排对对抗输入的鲁棒性。 接下来，我们证明攻击者可以生成我们称之为“混淆工具”的与查询无关的标记序列，当这些序列被添加到任何查询中时，会导致LLM路由器将查询发送到一个强大的LLM。 我们的定量评估显示，这种攻击在针对各种开源和商业路由器的白盒和黑盒设置中都取得了成功，并且混淆查询不会影响LLM响应的质量。 最后，我们证明了工具可以在保持低困惑度的同时有效，因此基于困惑度的过滤不是一种有效的防御措施。 最后，我们研究了其他防御方法。 显示英文摘要

摘要： LLM routers aim to balance quality and cost of generation by classifying queries and routing them to a cheaper or more expensive LLM depending on their complexity. Routers represent one type of what we call LLM control planes: systems that orchestrate use of one or more LLMs. In this paper, we investigate routers' adversarial robustness. We first define LLM control plane integrity, i.e., robustness of LLM orchestration to adversarial inputs, as a distinct problem in AI safety. Next, we demonstrate that an adversary can generate query-independent token sequences we call ``confounder gadgets'' that, when added to any query, cause LLM routers to send the query to a strong LLM. Our quantitative evaluation shows that this attack is successful both in white-box and black-box settings against a variety of open-source and commercial routers, and that confounding queries do not affect the quality of LLM responses. Finally, we demonstrate that gadgets can be effective while maintaining low perplexity, thus perplexity-based filtering is not an effective defense. We finish by investigating alternative defenses.