mlsanityData to 7 Oct 2026

Life-Cycle Routing Vulnerabilities of LLM Router

arXiv 2503.08704 ↗First posted 9 Mar 2025cs.CR cs.AIcited by 10

On the map: LLM safety and security → Mixture-of-experts routing safety

Abstract (arXiv)

Large language models (LLMs) have achieved remarkable success in natural language processing, yet their performance and computational costs vary significantly. LLM routers play a crucial role in dynamically balancing these trade-offs. While previous studies have primarily focused on routing efficiency, security vulnerabilities throughout the entire LLM router life cycle, from training to inference, remain largely unexplored. In this paper, we present a comprehensive investigation into the life-cycle routing vulnerabilities of LLM routers. We evaluate both white-box and black-box adversarial robustness, as well as backdoor robustness, across several representative routing models under extensive experimental settings. Our experiments uncover several key findings: 1) Mainstream DNN-based routers tend to exhibit the weakest adversarial and backdoor robustness, largely due to their strong feature extraction capabilities that amplify vulnerabilities during both training and inference; 2) Training-free routers demonstrate the strongest robustness across different attack types, benefiting from the absence of learnable parameters that can be manipulated. These findings highlight critical security risks spanning the entire life cycle of LLM routers and provide insights for developing more robust models.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in Mixture-of-experts routing safety, one of 12 directions in LLM safety and security. Builds on 40 of its 49 references that are in the map. First posted on arXiv 9 Mar 2025.

Builds on

40 of 49 references.

References · 40

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2023GPT-4 Technical Reportcited by 18,132
  3. 2022Training language models to follow instructions with human feedbackcited by 15,712
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  9. 2016Adversarial examples in the physical worldcited by 1,762
  10. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  11. 2023PaLM 2 Technical Reportcited by 1,154
  12. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
28 more
  1. 2017Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoningcited by 1,012
  2. 2023FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performancecited by 791
  3. 2018How To Backdoor Federated Learningcited by 745
  4. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  5. 2024RouteLLM: Learning to Route LLMs with Preference Datacited by 633
  6. 2023LLM-Blender: Ensembling Large Language Models with Pairwise Ranking and Generative Fusioncited by 550
  7. 2019Hidden Trigger Backdoor Attackscited by 359
  8. 2024Hybrid LLM: Cost-Efficient and Quality-Aware Query Routingcited by 354
  9. 2018Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifierscited by 341
  10. 2020Invisible Backdoor Attack with Sample-Specific Triggerscited by 338
  11. 2019Label-Consistent Backdoor Attackscited by 285
  12. 2023ToolQA: A Dataset for LLM Question Answering with External Toolscited by 273
  13. 2021Gradient-based Adversarial Attacks against Text Transformerscited by 233
  14. 2024RouterBench: A Benchmark for Multi-LLM Routing Systemcited by 222
  15. 2019A backdoor attack against LSTM-based text classification systemscited by 214
  16. 2021Hidden Killer: Invisible Textual Backdoor Attacks with Syntactic Triggercited by 203
  17. 2024GraphRouter: A Graph-based Router for LLM Selectionscited by 154
  18. 2023Routing to the Expert: Efficient Reward-guided Ensemble of Large Language Modelscited by 141
  19. 2023AutoMix: Automatically Mixing Language Modelscited by 116
  20. 2024RouterDC: Query-Based Router by Dual Contrastive Learning for Assembling Large Language Modelscited by 84
  21. 2024BEEAR: Embedding-based Adversarial Removal of Safety Backdoors in Instruction-tuned Language Modelscited by 50
  22. 2023CLIPSyntel: CLIP and LLM Synergy for Multimodal Question Summarization in Healthcarecited by 43
  23. 2025Exploring and Mitigating Adversarial Manipulation of Voting-Based Leaderboardscited by 19
  24. 2024Read-ME: Refactorizing LLMs as Router-Decoupled Mixture of Experts with System Co-Designcited by 18
  25. 2025Improving Your Model Ranking on Chatbot Arena by Vote Riggingcited by 16
  26. 2024Routing Experts: Learning to Route Dynamic Experts in Multi-modal Large Language Modelscited by 13
  27. 2025Rerouting LLM Routerscited by 11
  28. 2024LLMBind: A Unified Modality-Task Integration Frameworkcited by 6

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 8.

10 papers.

  1. 2025A Survey on Collaborative Mechanisms Between Large and Small Language Modelscited by 12
  2. 2026AdaFuse: Adaptive Ensemble Decoding with Test-Time Scaling for LLMscited by 4
  3. 2026Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimizationcited by 4
  4. 2026From Sampled Outcomes to Capability Distributions: Rethinking Supervision for LLM Routingcited by 3
  5. 2026Linguistic Firewall: Geometry as Defense in Multi-Agent Systems Routingcited by 1
  6. 2026Securing Agentic AI: From Per-Action Checks to Trajectory Assurancecited by 1
  7. 2025Defend LLMs Through Self-Consciousnesscited by 0
  8. 2026When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attackcited by 0
  9. 2026Forced Deferral: Manipulating Routing Decisions in Multimodal LLM Cascadescited by 0
  10. 2026Where Is the Tradeoff in Using Third-Party API Routers for Agentic Software Development?cited by 0