mlsanityData to 7 Oct 2026

Route to Rome Attack: Directing LLM Routers to Expensive Models via Adversarial Suffix Optimization

arXiv 2604.15022 ↗First posted 16 Apr 2026cs.CR cs.AI cs.CLcited by 4

On the map: LLM safety and security → Mixture-of-experts routing safety

Abstract (arXiv)

Cost-aware routing dynamically dispatches user queries to models of varying capability to balance performance and inference cost. However, the routing strategy introduces a new security concern that adversaries may manipulate the router to consistently select expensive high-capability models. Existing routing attacks depend on either white-box access or heuristic prompts, rendering them ineffective in real-world black-box scenarios. In this work, we propose R2A, which aims to mislead black-box LLM routers to expensive models via adversarial suffix optimization. Specifically, R2A deploys a hybrid ensemble surrogate router to mimic the black-box router. A suffix optimization algorithm is further adapted for the ensemble-based surrogate. Extensive experiments on multiple open-source and commercial routing systems demonstrate that R2A significantly increases the routing rate to expensive models on queries of different distributions. Code and examples: https://github.com/thcxiker/R2A-Attack.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Mixture-of-experts routing safety, one of 12 directions in LLM safety and security. Builds on 27 of its 39 references that are in the map. First posted on arXiv 16 Apr 2026.

Builds on

27 of 39 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025How Robust Are Router-LLMs? Analysis of the Fragility of LLM Routing Capabilities20 Mar
  2. 2025Life-Cycle Routing Vulnerabilities of LLM Router9 Mar

Other references · 25

  1. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  2. 2021Training Verifiers to Solve Math Word Problemscited by 9,743
  3. 2020Measuring Massive Multitask Language Understandingcited by 7,768
  4. 2020Scaling Laws for Neural Language Modelscited by 6,411
  5. 2022Large Language Models are Zero-Shot Reasonerscited by 4,323
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2020MiniLM: Deep Self-Attention Distillation for Task-Agnostic Compression of Pre-Trained Transformerscited by 1,414
  8. 2023FrugalGPT: How to Use Large Language Models While Reducing Cost and Improving Performancecited by 791
  9. 2024RouteLLM: Learning to Route LLMs with Preference Datacited by 633
  10. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  11. 2024From Crowdsourced Data to High-Quality Benchmarks: Arena-Hard and BenchBuilder Pipelinecited by 484
  12. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
13 more
  1. 2024Hybrid LLM: Cost-Efficient and Quality-Aware Query Routingcited by 354
  2. 2024Measuring short-form factuality in large language modelscited by 345
  3. 2024MT-Bench-101: A Fine-Grained Benchmark for Evaluating Large Language Models in Multi-Turn Dialoguescited by 247
  4. 2024GraphRouter: A Graph-based Router for LLM Selectionscited by 154
  5. 2025RouterEval: A Comprehensive Benchmark for Routing LLMs to Explore Model-level Scaling Up in LLMscited by 58
  6. 2024Eagle: Efficient Training-Free Router for Multi-LLM Inferencecited by 34
  7. 2025Beyond GPT-5: Making LLMs Cheaper and Better via Performance-Efficiency Optimized Routingcited by 32
  8. 2024Your Large Language Models Are Leaving Fingerprintscited by 31
  9. 2025ICL-Router: In-Context Learned Model Representations for LLM Routingcited by 26
  10. 2025RouterArena: An Open Platform for Comprehensive Comparison of LLM Routerscited by 19
  11. 2025FusionFactory: Fusing LLM Capabilities with Multi-LLM Log Datacited by 10
  12. 2025DuFFin: A Dual-Level Fingerprinting Framework for LLMs IP Protectioncited by 8
  13. 2025UniZyme: A Unified Protein Cleavage Site Predictor Enhanced with Enzyme Active-Site Knowledgecited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026Securing Agentic AI: From Per-Action Checks to Trajectory Assurancecited by 1
  2. 2026HyDRA: Hybrid Dynamic Routing Architecture for Heterogeneous LLM Poolscited by 0
  3. 2026When Efficiency Backfires: Cascading LLMs Trigger Cascade Failure under Adversarial Attackcited by 0
  4. 2026Where Is the Tradeoff in Using Third-Party API Routers for Agentic Software Development?cited by 0