LLM routers are designed to save money: classify incoming queries by complexity, route simple ones to cheap models and hard ones to expensive models. The router's job is to detect whether a query needs GPT-4 or can be handled by a smaller model. If it works, you get the same quality at lower cost.
Shafran, Schuster, Ristenpart, and Shmatikov (arXiv:2501.01818) show that simple, reusable token sequences — “confounder gadgets” — can manipulate routers into always selecting the expensive model. The gadgets are query-independent: prepend them to any input and the router classifies it as complex. The response quality is unchanged. The cost silently increases.
The structural vulnerability is that the router's complexity signal is separable from the response quality signal. The router doesn't evaluate whether the response will be better — it evaluates surface features of the query that correlate with complexity. The confounder exploits this: it changes the features the router reads without changing the features the model needs. The classifier sees a hard problem; the model sees a normal one.
This is an instance of a broader pattern: any proxy metric can be attacked by anything that moves the proxy without moving the target. Cost routers use query features as a proxy for response difficulty. The proxy is attackable because it doesn't check against the target. Perplexity-based filtering — the natural defense — also fails, because the gadgets are designed to be perplexity-neutral.
The attack is invisible because it leaves every observable unchanged except the bill.