Could someone trick an AI's traffic cop into sending their request to a weaker model, just by rewording it?

This explores whether rewording a query, with no change to what it asks, can push a router into picking a different model. The corpus has no experiment that tests this exact attack, so the answer is an inference: probably yes, and the surrounding evidence shows why. The closest note names the routing and execution layer as an attack surface in its own right. It sits beneath prompt-level defenses, so an attacker who steers it can send requests to weaker models or make safety measures run against the wrong model identity (Can attackers manipulate which model handles a request?).

The reason rewording could work is that routers decide from the query alone. Systems like RouteLLM and Hybrid-LLM pick a model before any answer exists, by predicting how hard the query is, and they save 40-50% on cost this way (Can routers select the right model before generation happens?). The router never sees whether the answer was good, only how the question looks. Embedding-based routers make the dependence on wording even more direct: they assign each query to a semantic cluster and send it to the model that is best for that cluster (Can routing beat building one better model?). A rephrasing that keeps the meaning but moves the query across a cluster boundary, or makes a hard question look easy, changes which model answers. The corpus reports that routing to the right model beats scaling a single model, which is what makes this decision worth attacking.

Two neighbouring attacks on other systems have the same structure. FLOWSTEER shows that a crafted prompt can bias how a planner-executor system forms its workflow, raising malicious success by up to 55 percent. It works because the contamination enters upstream of the defenses that inspect the workflow (Can prompts alone reshape multi-agent workflows without system access?). A router is another early decision made from the raw prompt, ahead of the checks that come later. ColluSkill adds the refinement loop. Attackers use scanner feedback to adjust each piece until it looks harmless, while the overall meaning stays intact, and this reaches 96% average success (Can attackers evade skill scanners by refining individual skills?). If an attacker can observe which model answered, or how fast or how well, the same tune-the-wording loop would apply to routers.

The practical point is that the attacker needs no access to weights or system internals. A related finding shows the same low bar: harmful plans planted in context are enough to steer a reasoning model past chain-of-thought monitors (Can reasoning models be steered by injected context without detection?). What the corpus doesn't settle is how robust real routers are to paraphrase, and whether routers trained on difficulty labels resist adversarial rewording better than cluster-based ones. That question is still open here.