{"id":"https://openalex.org/W7160499314","doi":"https://doi.org/10.48550/arxiv.2605.04446","title":"Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMs","display_name":"Misrouter: Exploiting Routing Mechanisms for Input-Only Attacks on Mixture-of-Experts LLMs","publication_year":2026,"publication_date":"2026-05-06","ids":{"openalex":"https://openalex.org/W7160499314","doi":"https://doi.org/10.48550/arxiv.2605.04446"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.04446","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.04446","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.04446","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5039147951","display_name":"Zekun Fei","orcid":"https://orcid.org/0000-0001-6475-685X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Fei, Zekun","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135600024","display_name":"Zihao Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Zihao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135552627","display_name":"Weijie Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Weijie","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135636003","display_name":"Ruiqi He","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"He, Ruiqi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135615522","display_name":"Jianing Geng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Geng, Jianing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5135570463","display_name":"Zheli Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Zheli","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5135599129","display_name":"XiaoFeng Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, XiaoFeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.45649999380111694,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11273","display_name":"Advanced Graph Neural Networks","score":0.45649999380111694,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.18330000340938568,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10064","display_name":"Complex Network Analysis Techniques","score":0.05999999865889549,"subfield":{"id":"https://openalex.org/subfields/3109","display_name":"Statistical and Nonlinear Physics"},"field":{"id":"https://openalex.org/fields/31","display_name":"Physics and Astronomy"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/routing","display_name":"Routing (electronic design automation)","score":0.7149999737739563},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6380000114440918},{"id":"https://openalex.org/keywords/static-routing","display_name":"Static routing","score":0.6137999892234802},{"id":"https://openalex.org/keywords/policy-based-routing","display_name":"Policy-based routing","score":0.5580000281333923},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.4945000112056732},{"id":"https://openalex.org/keywords/multipath-routing","display_name":"Multipath routing","score":0.4756999909877777},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.46380001306533813}],"concepts":[{"id":"https://openalex.org/C74172769","wikidata":"https://www.wikidata.org/wiki/Q1446839","display_name":"Routing (electronic design automation)","level":2,"score":0.7149999737739563},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6834999918937683},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6380000114440918},{"id":"https://openalex.org/C204948658","wikidata":"https://www.wikidata.org/wiki/Q1119410","display_name":"Static routing","level":4,"score":0.6137999892234802},{"id":"https://openalex.org/C196423136","wikidata":"https://www.wikidata.org/wiki/Q7209671","display_name":"Policy-based routing","level":5,"score":0.5580000281333923},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.4945000112056732},{"id":"https://openalex.org/C76522221","wikidata":"https://www.wikidata.org/wiki/Q5035396","display_name":"Multipath routing","level":5,"score":0.4756999909877777},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.46380001306533813},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.39559999108314514},{"id":"https://openalex.org/C31258907","wikidata":"https://www.wikidata.org/wiki/Q1301371","display_name":"Computer network","level":1,"score":0.3749000132083893},{"id":"https://openalex.org/C89305328","wikidata":"https://www.wikidata.org/wiki/Q1755411","display_name":"Link-state routing protocol","level":4,"score":0.37290000915527344},{"id":"https://openalex.org/C9659607","wikidata":"https://www.wikidata.org/wiki/Q1268903","display_name":"Dynamic Source Routing","level":4,"score":0.3276999890804291},{"id":"https://openalex.org/C120314980","wikidata":"https://www.wikidata.org/wiki/Q180634","display_name":"Distributed computing","level":1,"score":0.3165000081062317},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.30559998750686646},{"id":"https://openalex.org/C104954878","wikidata":"https://www.wikidata.org/wiki/Q1648707","display_name":"Routing protocol","level":3,"score":0.2955000102519989},{"id":"https://openalex.org/C94600068","wikidata":"https://www.wikidata.org/wiki/Q7371621","display_name":"Routing domain","level":5,"score":0.26649999618530273},{"id":"https://openalex.org/C87044965","wikidata":"https://www.wikidata.org/wiki/Q1091139","display_name":"Enhanced Interior Gateway Routing Protocol","level":5,"score":0.2630000114440918},{"id":"https://openalex.org/C184896649","wikidata":"https://www.wikidata.org/wiki/Q290066","display_name":"Routing table","level":4,"score":0.25600001215934753},{"id":"https://openalex.org/C115443555","wikidata":"https://www.wikidata.org/wiki/Q5367790","display_name":"Equal-cost multi-path routing","level":5,"score":0.2556999921798706}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.04446","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.04446","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.04446","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.04446","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.5511500835418701}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Mixture-of-Experts":[0],"(MoE)":[1],"architectures":[2],"have":[3],"emerged":[4],"as":[5],"a":[6,22,76,103,151,244],"leading":[7],"paradigm":[8],"for":[9],"scaling":[10],"large":[11],"language":[12],"models":[13,110],"through":[14,71,84,138],"sparse,":[15],"routing-based":[16],"computation.":[17],"However,":[18],"this":[19],"design":[20],"introduces":[21],"new":[23],"attack":[24,169],"surface:":[25],"the":[26,113,122],"routing":[27,41,81,132,141,174,210,223,236,251,259],"mechanism":[28],"that":[29,39,171,184,248],"determines":[30],"which":[31],"experts":[32,183,213,228],"process":[33],"each":[34],"input.":[35],"Prior":[36],"work":[37],"shows":[38],"manipulating":[40],"can":[42,79,133,240],"bypass":[43,154],"safety":[44,153],"alignment,":[45],"but":[46],"existing":[47],"attacks":[48,86,101],"require":[49],"model":[50,124],"modification":[51],"and":[52,68,111,143,149,176,214,237,252],"thus":[53],"apply":[54],"only":[55,70,136],"to":[56,87,99,117,187,208],"locally":[57],"deployed":[58],"models.":[59],"By":[60],"contrast,":[61],"real-world":[62,93],"LLM":[63],"services":[64,120],"are":[65,146,185],"remotely":[66],"hosted":[67],"accessible":[69],"input":[72,139],"queries.":[73],"This":[74,126],"raises":[75],"fundamental":[77],"question:":[78],"MoE":[80,109],"be":[82,134],"exploited":[83],"input-only":[85,168],"induce":[88],"stronger":[89],"unsafe":[90,201],"behaviors":[91],"in":[92,102],"services?":[94],"Our":[95],"key":[96],"insight":[97],"is":[98],"optimize":[100],"white-box":[104],"setting":[105,127],"on":[106],"open-source":[107],"surrogate":[108],"transfer":[112],"resulting":[114],"adversarial":[115,206],"inputs":[116,207],"public":[118],"API":[119],"within":[121],"same":[123],"family.":[125],"presents":[128],"three":[129],"main":[130],"challenges:":[131],"influenced":[135],"indirectly":[137],"perturbations,":[140],"control":[142],"output":[144,238],"generation":[145],"tightly":[147],"coupled,":[148],"even":[150],"successful":[152],"may":[155],"still":[156],"produce":[157,188],"low-quality":[158],"responses.":[159],"To":[160],"address":[161],"these":[162,212],"challenges,":[163],"we":[164],"propose":[165],"Misrouter,":[166],"an":[167],"framework":[170],"jointly":[172],"targets":[173],"behavior":[175],"expert":[177,194],"functionality.":[178],"Misrouter":[179,242],"identifies":[180],"weakly":[181],"aligned":[182,218],"willing":[186],"target":[189],"harmful":[190,197,255],"content":[191],"by":[192],"analyzing":[193],"activations":[195],"under":[196],"queries":[198],"paired":[199],"with":[200],"continuations.":[202],"It":[203,220],"then":[204,253],"optimizes":[205,254],"steer":[209],"toward":[211,224],"away":[215],"from":[216,230],"strongly":[217],"ones.":[219],"further":[221],"biases":[222],"highly":[225],"capable":[226],"general-purpose":[227],"identified":[229],"benign":[231],"question-answering":[232],"tasks.":[233],"Finally,":[234],"because":[235],"objectives":[239],"conflict,":[241],"uses":[243],"two-phase":[245],"optimization":[246],"strategy":[247],"first":[249],"steers":[250],"outputs":[256],"while":[257],"preserving":[258],"stability.":[260]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-08T00:00:00"}