---
title: "Route to Rome Attack — paper by Tang et al. (2026)"
description: "The authors present R²A (Route to Rome Attack), which learns one universal adversarial suffix using only observed routing… 42 references."
authors: ["Haochun Tang", "Yuliang Yan", "Jiahua Lu", "Huaxiao Liu", "Enyan Dai"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.2051/"
doi: "10.18653/v1/2026.acl-long.2051"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/tang-2026-route-rome-attack-directing-llm/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/tang-2026-route-rome-attack-directing-llm/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/41/) / Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization

# Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization

**Authors:** [Haochun Tang](https://md.research.elamur.ai/free/en/authors/haochun-tang/), [Yuliang Yan](https://md.research.elamur.ai/free/en/authors/yuliang-yan/), Jiahua Lu, Huaxiao Liu and [Enyan Dai](https://md.research.elamur.ai/free/en/authors/enyan-dai/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.2051/) · [PDF](https://aclanthology.org/2026.acl-long.2051.pdf) · [DOI 10.18653/v1/2026.acl-long.2051](https://doi.org/10.18653/v1/2026.acl-long.2051) · [OpenAlex](https://openalex.org/W7166835135)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Cost-aware LLM routers send easy queries to cheap models and hard ones to expensive models. This opens an attack surface: an adversary could push the router toward costly models on every request. Earlier attacks needed white-box access (gradients or a known architecture) or relied on handcrafted prompt templates. Neither works well against commercial routers, which only reveal which model was chosen.

The authors present R²A (Route to Rome Attack), which learns one universal adversarial suffix using only observed routing decisions and a small query budget. It first fits a hybrid ensemble surrogate that combines:
- pre-trained open-source routers, with logits zero-padded onto a shared model pool and linearly projected onto the target's pool;
- a trainable low-rank (LoRA-inspired) router built on query embeddings.

A gradient-based suffix search, with gradient normalization adapted to the ensemble, then optimizes the suffix against this surrogate.

Tests covered 6 datasets, 7 open-source routers and two commercial systems, OpenRouter and GPT-5-Auto. Appending the suffix substantially raised the share of simple queries sent to strong models. The work shows that routing is a security-relevant component and calls for monitoring of cost-aware routers.

## Key points
- **Threat model:** the attacker sees only the selected model and appends a suffix of limited token length. For GPT-5-Auto, whose decisions are hidden, a suffix learned on OpenRouter was transferred.
- **Lightweight router:** uses all-MiniLM-L6-v2 embeddings (d = 384), with the mapping factorized into two rank-r matrices to save queries.
- **Ablation results:**
  - Dropping gradient normalization cut MF performance from 0.95 to 0.49.
  - Dropping the lightweight router cut RouterDC performance from 0.83 to 0.30.
- **Query budget (50–150 surrogate queries):** for RouteLLM-BERT, ASR rose from 0.58 to 0.87 between 80 and 120 queries. Most routers saturated around 120 queries.
- **Defense and limitations:**
  - A whitespace-insertion defense lowered attack success only slightly.
  - The method needs a separate suffix per target router.
  - It assumes the candidate model list and the chosen model are visible.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [The Hong Kong University of Science and Technology (Guangzhou)](https://md.research.elamur.ai/free/en/universities/the-hong-kong-university-of-science-and-technology-guangzhou/) — University, Guangzhou, China · 53 works · 1,367 citations
- [Jilin University](https://md.research.elamur.ai/free/en/universities/jilin-university/) — University, Changchun, China · 25 works · 5,252 citations
- [Key Laboratory of Symbolic Computation and Knowledge Engineering of Ministry of Education, Jilin University](https://md.research.elamur.ai/free/en/labs/key-laboratory-of-symbolic-computation-and-knowledge-engineering-of-ministry-of/) — Research institute, Changchun Shi, China · 3 works · 752 citations

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works

🧭 Topics (1): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works

## Cite

Cite as: Haochun Tang, Yuliang Yan, Jiahua Lu, Huaxiao Liu and Enyan Dai. 2026. Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{tang2026route,
  title = {{Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization}},
  author = {Haochun Tang, Yuliang Yan, Jiahua Lu, Huaxiao Liu and Enyan Dai},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.2051},
  url = {https://doi.org/10.18653/v1/2026.acl-long.2051}
}
```

- [← previous ROSE: An Intent-Centered Evaluation Metric for NL2SQL](https://md.research.elamur.ai/free/en/papers/pei-2026-rose-intent-centered-evaluation-metric/)
- [next → RouteLMT: Learned Sample Routing for Hybrid LLM Translation Deployment](https://md.research.elamur.ai/free/en/papers/luo-2026-routelmt-learned-sample-routing-hybrid/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/41/)

## References

42 references, 13 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Pranjal Aggarwal, Aman Madaan, Ankit Anand, Srividya Pranavi Potharaju, Swaroop Mishra, Pei Zhou, Aditya Gupta, Dheeraj Rajagopal, Karthik Kappaganthu, Yiming Yang, Shyam Upadhyay, Manaal Faruqui, and Mausam. 2025. Automix: Automatically mixing language models. Preprint, arXiv:2310.12963. — [arXiv:2310.12963](https://arxiv.org/abs/2310.12963) [find](https://scholar.google.com/scholar?q=Pranjal+Aggarwal%2C+Aman+Madaan%2C+Ankit+Anand%2C+Srividya+Pranavi+Potharaju%2C+Swaroop+Mishra%2C+Pei+Zhou%2C+Aditya+Gupta%2C+Dheeraj+Rajagopal%2C+Karthik+Kappaganthu%2C+Yiming+Yang%2C+Shyam+Upadhyay%2C+Manaal+Faruqui%2C+and)
2. Ge Bai, Jie Liu, Xingyuan Bu, Yancheng He, Jiaheng Liu, Zhanhui Zhou, Zhuoran Lin, Wenbo Su, Tiezheng Ge, Bo Zheng, and Wanli Ouyang. 2024. [MT-bench-101: A fine-grained benchmark for evaluating large language models in multi-turn dialogues](https://md.research.elamur.ai/free/en/papers/bai-2024-mt-bench-101-fine-grained/). In Proceedings of the 62nd Annual Meeting of the Associatio…
3. Xiaofan Bai, Pingyi Hu, Xiaojing Ma, Linchen Yu, Dongmei Zhang, Qi Zhang, and Bin Benjamin Zhu. 2025. ESF: Efficient sensitive fingerprinting for black-box tamper detection of large language models. In Findings of the Association for Computational Linguistics: ACL 2025, pages 10477–10494, Vienna, Au… [find](https://scholar.google.com/scholar?q=Xiaofan+Bai%2C+Pingyi+Hu%2C+Xiaojing+Ma%2C+Linchen+Yu%2C+Dongmei+Zhang%2C+Qi+Zhang%2C+and+Bin+Benjamin+Zhu%2E+2025%2E+ESF%3A+Efficient+sensitive+fingerprinting+for+black%2Dbox+tamper+detection+of+large+language+models%2E+I)
4. Lingjiao Chen, Matei Zaharia, and James Zou. 2024a. [Frugalgpt: How to use large language models while reducing cost and improving performance](https://md.research.elamur.ai/free/en/papers/chen-2023-frugalgpt-use-large-language-models/). Transactions on Machine Learning Research.
5. Shuhao Chen, Weisen Jiang, Baijiong Lin, James Kwok, and Yu Zhang. 2024b. Routerdc: Query-based router by dual contrastive learning for assembling large language models. Advances in Neural Information Processing Systems, 37:66305–66328. [find](https://scholar.google.com/scholar?q=Shuhao+Chen%2C+Weisen+Jiang%2C+Baijiong+Lin%2C+James+Kwok%2C+and+Yu+Zhang%2E+2024b%2E+Routerdc%3A+Query%2Dbased+router+by+dual+contrastive+learning+for+assembling+large+language+models%2E+Advances+in+Neural+Information)
6. Karl Cobbe, Vineet Kosaraju, Mohammad Bavarian, Mark Chen, Heewoo Jun, Lukasz Kaiser, Matthias Plappert, Jerry Tworek, Jacob Hilton, Reiichiro Nakano, et al. 2021. [Training verifiers to solve math word problems](https://md.research.elamur.ai/free/en/papers/cobbe-2021-training-verifiers-solve-math-word/). arXiv preprint arXiv:2110.14168.
7. Enyan Dai and Suhang Wang. 2022. Learning fair graph neural networks with limited and private sensitive attribute information. IEEE Transactions on Knowledge and Data Engineering, 35(7):7103–7117. [find](https://scholar.google.com/scholar?q=Enyan+Dai+and+Suhang+Wang%2E+2022%2E+Learning+fair+graph+neural+networks+with+limited+and+private+sensitive+attribute+information%2E+IEEE+Transactions+on+Knowledge+and+Data+Engineering%2C+35%287%29%3A7103%E2%80%937117%2E)
8. Dujian Ding, Ankur Mallick, Chi Wang, Robert Sim, Subhabrata Mukherjee, Victor Rühle, Laks V. S. Lakshmanan, and Ahmed Hassan Awadallah. 2024. Hybrid LLM: cost-efficient and quality-aware query routing. In The Twelfth International Conference on Learning Representations, ICLR 2024, Vienna, Austria,… [find](https://scholar.google.com/scholar?q=Dujian+Ding%2C+Ankur+Mallick%2C+Chi+Wang%2C+Robert+Sim%2C+Subhabrata+Mukherjee%2C+Victor+R%C3%BChle%2C+Laks+V%2E+S%2E+Lakshmanan%2C+and+Ahmed+Hassan+Awadallah%2E+2024%2E+Hybrid+LLM%3A+cost%2Defficient+and+quality%2Daware+query+routin)
9. Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR). [find](https://scholar.google.com/scholar?q=Yinpeng+Dong%2C+Fangzhou+Liao%2C+Tianyu+Pang%2C+Hang+Su%2C+Jun+Zhu%2C+Xiaolin+Hu%2C+and+Jianguo+Li%2E+2018%2E+Boosting+adversarial+attacks+with+momentum%2E+In+Proceedings+of+the+IEEE+Conference+on+Computer+Vision+and+P)
10. Tao Feng, Yanzhen Shen, and Jiaxuan You. 2024. Graphrouter: A graph-based router for llm selections. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Tao+Feng%2C+Yanzhen+Shen%2C+and+Jiaxuan+You%2E+2024%2E+Graphrouter%3A+A+graph%2Dbased+router+for+llm+selections%2E+In+The+Thirteenth+International+Conference+on+Learning+Representations%2E)
11. Tao Feng, Haozhen Zhang, Zijie Lei, Pengrui Han, Mostofa Patwary, Mohammad Shoeybi, Bryan Catanzaro, and Jiaxuan You. 2025. Fusionfactory: Fusing llm capabilities with multi-llm log data. arXiv preprint arXiv:2507.10540. 44341 9 — [arXiv:2507.10540](https://arxiv.org/abs/2507.10540) [find](https://scholar.google.com/scholar?q=Tao+Feng%2C+Haozhen+Zhang%2C+Zijie+Lei%2C+Pengrui+Han%2C+Mostofa+Patwary%2C+Mohammad+Shoeybi%2C+Bryan+Catanzaro%2C+and+Jiaxuan+You%2E+2025%2E+Fusionfactory%3A+Fusing+llm+capabilities+with+multi%2Dllm+log+data%2E+arXiv+prepri)
12. Evan Frick, Connor Chen, Joseph Tennyson, Tianle Li, Wei-Lin Chiang, Anastasios N. Angelopoulos, and Ion Stoica. 2025. Prompt-to-leaderboard. Preprint, arXiv:2502.14855. [find](https://scholar.google.com/scholar?q=Evan+Frick%2C+Connor+Chen%2C+Joseph+Tennyson%2C+Tianle+Li%2C+Wei%2DLin+Chiang%2C+Anastasios+N%2E+Angelopoulos%2C+and+Ion+Stoica%2E+2025%2E+Prompt%2Dto%2Dleaderboard%2E+Preprint%2C+arXiv%3A2502%2E14855%2E)
13. Chenao Li, Shuo Yan, and Enyan Dai. 2025a. Unizyme: A unified protein cleavage site predictor enhanced with enzyme active-site knowledge. In Advances in Neural Information Processing Systems (NeurIPS). [find](https://scholar.google.com/scholar?q=Chenao+Li%2C+Shuo+Yan%2C+and+Enyan+Dai%2E+2025a%2E+Unizyme%3A+A+unified+protein+cleavage+site+predictor+enhanced+with+enzyme+active%2Dsite+knowledge%2E+In+Advances+in+Neural+Information+Processing+Systems+%28NeurIPS%29)
14. Zirui Guo, Lianghao Xia, Yanhua Yu, Tu Ao, and Chao Huang. 2025. [LightRAG: Simple and fast retrieval-augmented generation](https://md.research.elamur.ai/free/en/papers/guo-2024-lightrag-simple-fast-retrieval-augmented/). In Findings of the Association for Computational Linguistics: EMNLP 2025.
15. Tianle Li, Wei-Lin Chiang, Evan Frick, Lisa Dunlap, Tianhao Wu, Banghua Zhu, Joseph E. Gonzalez, and Ion Stoica. 2025b. [From crowdsourced data to high-quality benchmarks: Arena-hard and benchbuilder pipeline](https://md.research.elamur.ai/free/en/papers/li-2024-crowdsourced-data-high-quality-benchmarks/). In Forty-second International Conference on Machine Learning.
16. Dan Hendrycks, Collin Burns, Steven Basart, Andy Zou, Mantas Mazeika, Dawn Song, and Jacob Steinhardt. 2021. [Measuring massive multitask language understanding](https://md.research.elamur.ai/free/en/papers/hendrycks-2020-measuring-massive-multitask-language-understanding/). Proceedings of the International Conference on Learning Representations (ICLR).
17. Edward J Hu, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, Weizhu Chen, et al. 2022. [Lora: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). In International Conference on Learning Representations (ICLR).
18. Qitian Jason Hu, Jacob Bieker, Xiuyu Li, Nan Jiang, Benjamin Keigwin, Gaurav Ranganath, Kurt Keutzer, and Shriyash Kaustubh Upadhyay. 2024. Routerbench: A benchmark for multi-LLM routing system. In Agentic Markets Workshop at ICML 2024. [find](https://scholar.google.com/scholar?q=Qitian+Jason+Hu%2C+Jacob+Bieker%2C+Xiuyu+Li%2C+Nan+Jiang%2C+Benjamin+Keigwin%2C+Gaurav+Ranganath%2C+Kurt+Keutzer%2C+and+Shriyash+Kaustubh+Upadhyay%2E+2024%2E+Routerbench%3A+A+benchmark+for+multi%2DLLM+routing+system%2E+In+Ag)
19. Yangsibo Huang, Milad Nasr, Anastasios Nikolas Angelopoulos, Nicholas Carlini, Wei-Lin Chiang, Christopher A. Choquette-Choo, Daphne Ippolito, Matthew Jagielski, Katherine Lee, Ken Liu, Ion Stoica, Florian Tramèr, and Chiyuan Zhang. 2025a. Exploring and mitigating adversarial manipulation of voting-… [find](https://scholar.google.com/scholar?q=Yangsibo+Huang%2C+Milad+Nasr%2C+Anastasios+Nikolas+Angelopoulos%2C+Nicholas+Carlini%2C+Wei%2DLin+Chiang%2C+Christopher+A%2E+Choquette%2DChoo%2C+Daphne+Ippolito%2C+Matthew+Jagielski%2C+Katherine+Lee%2C+Ken+Liu%2C+Ion+Stoica%2C+Fl)
20. Zhongzhan Huang, Guoming Ling, Yupei Lin, Yandong Chen, Shanshan Zhong, Hefeng Wu, and Liang Lin. 2025b. RouterEval: A comprehensive benchmark for routing LLMs to explore model-level scaling up in LLMs. In Findings of the Association for Computational Linguistics: EMNLP 2025, pages 3860–3887, Suzhou… [find](https://scholar.google.com/scholar?q=Zhongzhan+Huang%2C+Guoming+Ling%2C+Yupei+Lin%2C+Yandong+Chen%2C+Shanshan+Zhong%2C+Hefeng+Wu%2C+and+Liang+Lin%2E+2025b%2E+RouterEval%3A+A+comprehensive+benchmark+for+routing+LLMs+to+explore+model%2Dlevel+scaling+up+in+LLM)
21. Dongfu Jiang, Xiang Ren, and Bill Yuchen Lin. 2023. Llm-blender: Ensembling large language models with pairwise comparison and generative fusion. In Proceedings of the 61th Annual Meeting of the Association for Computational Linguistics (ACL 2023). [find](https://scholar.google.com/scholar?q=Dongfu+Jiang%2C+Xiang+Ren%2C+and+Bill+Yuchen+Lin%2E+2023%2E+Llm%2Dblender%3A+Ensembling+large+language+models+with+pairwise+comparison+and+generative+fusion%2E+In+Proceedings+of+the+61th+Annual+Meeting+of+the+Assoc)
22. Jared Kaplan, Sam McCandlish, Tom Henighan, Tom B Brown, Benjamin Chess, Rewon Child, Scott Gray, Alec Radford, Jeffrey Wu, and Dario Amodei. 2020. [Scaling laws for neural language models](https://md.research.elamur.ai/free/en/papers/kaplan-2020-scaling-laws-neural-language-models/). arXiv preprint arXiv:2001.08361.
23. Aly M Kassem, Bernhard Schölkopf, and Zhijing Jin. 2025. How robust are router-llms? analysis of the fragility of llm routing capabilities. arXiv preprint arXiv:2504.07113. [find](https://scholar.google.com/scholar?q=Aly+M+Kassem%2C+Bernhard+Sch%C3%B6lkopf%2C+and+Zhijing+Jin%2E+2025%2E+How+robust+are+router%2Dllms%3F+analysis+of+the+fragility+of+llm+routing+capabilities%2E+arXiv+preprint+arXiv%3A2504%2E07113%2E)
24. Takeshi Kojima, Shixiang Shane Gu, Machel Reid, Yutaka Matsuo, and Yusuke Iwasawa. 2022. [Large language models are zero-shot reasoners](https://md.research.elamur.ai/free/en/papers/kojima-2022-large-language-models-zero-shot/). Advances in neural information processing systems (NeurIPS).
25. Minhua Lin, Enyan Dai, Junjie Xu, Jinyuan Jia, Xiang Zhang, and Suhang Wang. 2025a. Stealing training graphs from graph neural networks. In Proceedings of the 31st ACM SIGKDD Conference on Knowledge Discovery and Data Mining V. 1, pages 777–788. [find](https://scholar.google.com/scholar?q=Minhua+Lin%2C+Enyan+Dai%2C+Junjie+Xu%2C+Jinyuan+Jia%2C+Xiang+Zhang%2C+and+Suhang+Wang%2E+2025a%2E+Stealing+training+graphs+from+graph+neural+networks%2E+In+Proceedings+of+the+31st+ACM+SIGKDD+Conference+on+Knowledge+D)
26. Qiqi Lin, Xiaoyang Ji, Shengfang Zhai, Qingni Shen, Zhi Zhang, Yuejian Fang, and Yansong Gao. 2025b. Life-cycle routing vulnerabilities of llm router. arXiv preprint arXiv:2503.08704. — [arXiv:2503.08704](https://arxiv.org/abs/2503.08704) [find](https://scholar.google.com/scholar?q=Qiqi+Lin%2C+Xiaoyang+Ji%2C+Shengfang+Zhai%2C+Qingni+Shen%2C+Zhi+Zhang%2C+Yuejian+Fang%2C+and+Yansong+Gao%2E+2025b%2E+Life%2Dcycle+routing+vulnerabilities+of+llm+router%2E+arXiv+preprint+arXiv%3A2503%2E08704%2E+%E2%80%94+%5BarXiv%3A2503%2E08)
27. Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. 2017. Delving into transferable adversarial examples and black-box attacks. In International Conference on Learning Representations (ICLR). [find](https://scholar.google.com/scholar?q=Yanpei+Liu%2C+Xinyun+Chen%2C+Chang+Liu%2C+and+Dawn+Song%2E+2017%2E+Delving+into+transferable+adversarial+examples+and+black%2Dbox+attacks%2E+In+International+Conference+on+Learning+Representations+%28ICLR%29%2E)
28. Keming Lu, Hongyi Yuan, Runji Lin, Junyang Lin, Zheng Yuan, Chang Zhou, and Jingren Zhou. 2024. Routing to the expert: Efficient reward-guided ensemble of large language models. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Huma… [find](https://scholar.google.com/scholar?q=Keming+Lu%2C+Hongyi+Yuan%2C+Runji+Lin%2C+Junyang+Lin%2C+Zheng+Yuan%2C+Chang+Zhou%2C+and+Jingren+Zhou%2E+2024%2E+Routing+to+the+expert%3A+Efficient+reward%2Dguided+ensemble+of+large+language+models%2E+In+Proceedings+of+the+)
29. Yifan Lu, Rixin Liu, Jiayi Yuan, Xingqi Cui, Shenrun Zhang, Hongyi Liu, and Jiarong Xing. 2025. Routerarena: An open platform for comprehensive comparison of llm routers. Preprint, arXiv:2510.00202. — [arXiv:2510.00202](https://arxiv.org/abs/2510.00202) [find](https://scholar.google.com/scholar?q=Yifan+Lu%2C+Rixin+Liu%2C+Jiayi+Yuan%2C+Xingqi+Cui%2C+Shenrun+Zhang%2C+Hongyi+Liu%2C+and+Jiarong+Xing%2E+2025%2E+Routerarena%3A+An+open+platform+for+comprehensive+comparison+of+llm+routers%2E+Preprint%2C+arXiv%3A2510%2E00202%2E+%E2%80%94)
30. Hope McGovern, Rickard Stureborg, Yoshi Suhara, and Dimitris Alikaniotis. 2025. Your large language models are leaving fingerprints. In Proceedings of the 1stWorkshop on GenAI Content Detection (GenAIDetect), pages 85–95, Abu Dhabi, UAE. International Conference on Computational Linguistics. [find](https://scholar.google.com/scholar?q=Hope+McGovern%2C+Rickard+Stureborg%2C+Yoshi+Suhara%2C+and+Dimitris+Alikaniotis%2E+2025%2E+Your+large+language+models+are+leaving+fingerprints%2E+In+Proceedings+of+the+1stWorkshop+on+GenAI+Content+Detection+%28GenAI)
31. Isaac Ong, Amjad Almahairi, Vincent Wu, Wei-Lin Chiang, Tianhao Wu, Joseph E. Gonzalez, M Waleed Kadous, and Ion Stoica. 2025. RouteLLM: Learning to route LLMs from preference data. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Isaac+Ong%2C+Amjad+Almahairi%2C+Vincent+Wu%2C+Wei%2DLin+Chiang%2C+Tianhao+Wu%2C+Joseph+E%2E+Gonzalez%2C+M+Waleed+Kadous%2C+and+Ion+Stoica%2E+2025%2E+RouteLLM%3A+Learning+to+route+LLMs+from+preference+data%2E+In+The+Thirteenth+)
32. Alexander Robey, Eric Wong, Hamed Hassani, and George J. Pappas. 2025. [Smoothllm: Defending large language models against jailbreaking attacks](https://md.research.elamur.ai/free/en/papers/robey-2023-smoothllm-defending-large-language-models/).
33. Trans. Mach. Learn. Res., 2025. [find](https://scholar.google.com/scholar?q=Trans%2E+Mach%2E+Learn%2E+Res%2E%2C+2025%2E)
34. Avital Shafran, Roei Schuster, Tom Ristenpart, and Vitaly Shmatikov. 2025. Rerouting LLM routers. In Conference on Language Modeling (COLM). 44342 10 [find](https://scholar.google.com/scholar?q=Avital+Shafran%2C+Roei+Schuster%2C+Tom+Ristenpart%2C+and+Vitaly+Shmatikov%2E+2025%2E+Rerouting+LLM+routers%2E+In+Conference+on+Language+Modeling+%28COLM%29%2E+44342+10)
35. Chenxu Wang, Hao Li, Yiqun Zhang, Linyao Chen, Jianhao Chen, Ping Jian, Peng Ye, Qiaosheng Zhang, and Shuyue Hu. 2025. Icl-router: In-context learned model representations for llm routing. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI). Poster. [find](https://scholar.google.com/scholar?q=Chenxu+Wang%2C+Hao+Li%2C+Yiqun+Zhang%2C+Linyao+Chen%2C+Jianhao+Chen%2C+Ping+Jian%2C+Peng+Ye%2C+Qiaosheng+Zhang%2C+and+Shuyue+Hu%2E+2025%2E+Icl%2Drouter%3A+In%2Dcontext+learned+model+representations+for+llm+routing%2E+In+Proceedi)
36. Wenhui Wang, Furu Wei, Li Dong, Hangbo Bao, Nan Yang, and Ming Zhou. 2020. Minilm: deep self-attention distillation for task-agnostic compression of pre-trained transformers. In Proceedings of the 34th International Conference on Neural Information Processing Systems, NIPS ’20, Red Hook, NY, USA. Cu… [find](https://scholar.google.com/scholar?q=Wenhui+Wang%2C+Furu+Wei%2C+Li+Dong%2C+Hangbo+Bao%2C+Nan+Yang%2C+and+Ming+Zhou%2E+2020%2E+Minilm%3A+deep+self%2Dattention+distillation+for+task%2Dagnostic+compression+of+pre%2Dtrained+transformers%2E+In+Proceedings+of+the+34t)
37. Jason Wei, Nguyen Karina, Hyung Won Chung, Yunxin Joy Jiao, Spencer Papay, Amelia Glaese, John Schulman, and William Fedus. 2024. [Measuring short-form factuality in large language models](https://md.research.elamur.ai/free/en/papers/wei-2024-measuring-short-form-factuality-large/). Preprint, arXiv:2411.04368.
38. Yuliang Yan, Haochun Tang, Shuo Yan, and Enyan Dai. 2025. [Duffin: A dual-level fingerprinting framework for llms ip protection](https://md.research.elamur.ai/free/en/papers/yan-2026-duffin-dual-level-fingerprinting-framework/). arXiv preprint arXiv:2505.16530.
39. Yiqun Zhang, Hao Li, Jianhao Chen, Hangfan Zhang, Peng Ye, Lei Bai, and Shuyue Hu. 2025. Beyond gpt-5: Making llms cheaper and better via performance-efficiency optimized routing. In Proceedings of the 2025 7th International Conference on Distributed Artificial Intelligence, DAI ’25, page 122–129, N… [find](https://scholar.google.com/scholar?q=Yiqun+Zhang%2C+Hao+Li%2C+Jianhao+Chen%2C+Hangfan+Zhang%2C+Peng+Ye%2C+Lei+Bai%2C+and+Shuyue+Hu%2E+2025%2E+Beyond+gpt%2D5%3A+Making+llms+cheaper+and+better+via+performance%2Defficiency+optimized+routing%2E+In+Proceedings+of+th)
40. Zesen Zhao, Shuowei Jin, and Z. Morley Mao. 2024. Eagle: Efficient training-free router for multi-llm inference. Preprint, arXiv:2409.15518. — [arXiv:2409.15518](https://arxiv.org/abs/2409.15518) [find](https://scholar.google.com/scholar?q=Zesen+Zhao%2C+Shuowei+Jin%2C+and+Z%2E+Morley+Mao%2E+2024%2E+Eagle%3A+Efficient+training%2Dfree+router+for+multi%2Dllm+inference%2E+Preprint%2C+arXiv%3A2409%2E15518%2E+%E2%80%94+%5BarXiv%3A2409%2E15518%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2409%2E15518%29)
41. Richard Zhuang, Tianhao Wu, Zhaojin Wen, Andrew Li, Jiantao Jiao, and Kannan Ramchandran. 2025. EmbedLLM: Learning compact representations of large language models. In The Thirteenth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Richard+Zhuang%2C+Tianhao+Wu%2C+Zhaojin+Wen%2C+Andrew+Li%2C+Jiantao+Jiao%2C+and+Kannan+Ramchandran%2E+2025%2E+EmbedLLM%3A+Learning+compact+representations+of+large+language+models%2E+In+The+Thirteenth+International+Con)
42. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). Preprint, arXiv:2307.15043. 44343 11

*Updated 1 November 2026*