Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization
Year: 2026
Type: conference-paper
Abstract: Cost-aware routing dynamically dispatches user queries to models of varying capability to balance performance and inference cost.However, the routing strategy introduces a new security concern that adversaries may manipulate the router to consistently select expensive highcapability models.Existing routing attacks depend on either white-box access or heuristic prompts, rendering them ineffective in realworld black-box scenarios.In this work, we propose R 2 A, which aims to mislead black-box LLM routers to expensive models via adversarial suffix optimization.Specifically, R 2 A deploys a hybrid ensemble surrogate router to mimic the black-box router.A suffix optimization algorithm is further adapted for the ensemble-based surrogate.Extensive experiments on multiple open-source and commercial routing systems demonstrate that R 2 A significantly increases the routing rate to expensive models on queries of different distributions.Code and examples: https://github.com/ thcxiker/R2A-Attack.
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
OpenAlex ID: W7166835135