Search papers, labs, and topics across Lattice.
The paper introduces R$^2$A, a novel black-box attack that optimizes adversarial suffixes to manipulate LLM routers into consistently selecting more expensive, high-capability models. R$^2$A uses a hybrid ensemble surrogate router to mimic the target black-box router, enabling effective suffix optimization. Experiments across various routing systems show R$^2$A significantly increases the routing rate to expensive models, highlighting a vulnerability in cost-aware routing strategies.
Adversarial suffixes can stealthily force LLM routers to consistently choose expensive models, even in black-box settings.
Cost-aware routing dynamically dispatches user queries to models of varying capability to balance performance and inference cost. However, the routing strategy introduces a new security concern that adversaries may manipulate the router to consistently select expensive high-capability models. Existing routing attacks depend on either white-box access or heuristic prompts, rendering them ineffective in real-world black-box scenarios. In this work, we propose R$^2$A, which aims to mislead black-box LLM routers to expensive models via adversarial suffix optimization. Specifically, R$^2$A deploys a hybrid ensemble surrogate router to mimic the black-box router. A suffix optimization algorithm is further adapted for the ensemble-based surrogate. Extensive experiments on multiple open-source and commercial routing systems demonstrate that {R$^2$A} significantly increases the routing rate to expensive models on queries of different distributions. Code and examples: https://github.com/thcxiker/R2A-Attack.
