Route to Rome Attack: Adversarial Suffixes Force Black-Box LLM Routers to Always Select Expensive Models

arXiv·high signal

Researchers introduce R²A (arXiv 2604.15022), the first black-box attack on cost-aware LLM routers that appends adversarial suffixes to queries, forcing routers to consistently dispatch to expensive high-capability models regardless of query complexity. Prior attacks required white-box access or heuristic prompts; R²A works against production black-box routers. For teams using cost-aware routing (OpenRouter, Martian, custom routers), this is a concrete cost-escalation attack vector that needs adversarial robustness testing.