Rerouted

About this attack

What it is. A router sits between the user and two models. It embeds the question with the same embedding model the search page uses, compares it with 28 labelled reference questions, and scores it as the similarity-weighted share of hard neighbours: at or above 0.5 the strong model answers, below it the cheap one. The first two steps show the router working on an easy and a hard question. The third asks it nicely to route the easy question to the strong model, which the paper found does not work. The fourth runs the paper's search in the browser: ten tokens, one position at a time, sixteen swaps a round, keep whatever pushes the score up, until it crosses the threshold with room to spare or the rounds run out. The prefix goes in front of the same easy question, and the router sends it to the strong model.

Why it works. A learned router is a classifier, and a classifier weighs tokens. It does not read the question for meaning; it reads it for a score, and a score can be pushed from outside with no access to the question itself. The paper found a prefix that works in front of any question, on every router it tried, including three commercial ones, and the strong model's bill went up 1.7 to over 8 times. Asking the router to treat the question as hard did nothing, because the request is text the router scores like any other. The site runs one chat model, so the same model answers whichever tier was picked: the verdict is the route, and the panel shows the score, the nearest references, and every round of the climb.

What the verdict measures. Whether the router's score for the question with the prefix crosses the threshold the question alone did not. The panel shows both scores, every reference question with its share of the vote, and the climb round by round. The scores on screen are cosine similarities from the in-browser embedding model, so a climb that fails is a result too. Not yet run in a browser; the climb budget (24 rounds of 16) is a guess at what moves this router in under a minute.

Mitigations.

• Do not let the router's decision carry a security property: the cheap model needs the same safety training as the strong one, because the attacker picks which one answers.
• Filter high-perplexity prefixes before routing, and expect the next gadget to be searched with a perplexity term, as the paper's were.
• Rate-limit by user and watch for a sudden shift of one user's traffic to the strong model.
• Route on a signal the user does not write, such as the account's plan, next to the learned score.

Taxonomy. The codes this attack demonstrates, under the taxonomy’s own four kinds: how the payload enters, how it is dressed, how it hides, and what it is after. Each code links to its row on the taxonomy page.

Based on Rerouting LLM Routers, Shafran, Schuster, Ristenpart, and Shmatikov, 2025, arXiv:2501.01818. RouteLLM, Ong et al., ICLR 2025, arXiv:2406.18665.

Codes from the Arcanum Prompt Injection Taxonomy (v1.6.1) by Jason Haddix, Arcanum Information Security (arcanum-sec.com), CC BY 4.0.