arXiv CS open access

Rethinking Quality in Large Language Model Routing: Security-Conditioned Model-and-Budget Selection

Yichi Zhang et al. · arxiv_cs

arXiv CS · Papers

cryptography cybersecurity privacy security

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

Rethinking Quality in Large Language Model Routing: Security-Conditioned Model-and-Budget Selection Yichi Zhang1 , Zhenxiang Huang2 , Yuyang Zhang1 , Yuchen Yang1 1 The Pennsylvania State University, 2 The University of Hong Kong

SCRouter-L R2-Router CARROT-RoBERTa

Abstract

Oracle Gap Recovered

arXiv:2610.18566v1 [cs.AI] 13 Oct 2026

Large language model (LLM) routers reduce serving cost by choosing which model to call and how many output tokens to grant it for each query. Existing routers rank model-budget actions using a single quality metric. This does not work for mixed workloads. For ordinary queries, a good answer is correct and useful (utility); for security-sensitive queries, a good answer refuses harmful requests or resists malicious instructions (security). These two objectives prefer different models and budgets.

SCRouter-S CARROT-KNN MIRT

60.9 50.2

45 30 15 0

In-Domain

Out-of-Domain

Figure 1: Overall routing performance under in-domain and out-of-domain settings. SCRouter achieves the highest Oracle Gap Recovery (OGR) across both settings. OGR denotes the fraction of the gap between random selection and the oracle that a router recovers.

We propose SCRouter, a router that learns when to prioritize security and how to allocate the token budget. For each model-budget pair, it estimates the probability that the response finishes within budget. It uses this probability to predict utility and security separately. A small probe determines how to weight these two predictions for each query. SCRouter then selects the model and budget by balancing the weighted utility and security against cost. We also build SCRouterBench, a benchmark of 38,869 utility and security queries spanning nine security dimensions, each answered under all 144 combinations of 12 models and 12 budgets, plus 2,753 out-of-domain queries. SCRouter improves the baselines by 13-29 points in-domain and 19-23 points out-of-domain.

SCRouter-M RADAR NIRT

These methods improve routing performance by refining the action space, but they overlook that what makes a response good depends on the query. For ordinary queries, a good response correctly addresses the request, which we refer to as utility. For harmful requests or queries containing malicious instructions, a good response refuses the harmful request or resists the malicious instructions, which we refer to as security. We call these utility and security queries, respectively. The problem is that utility and security often favor different routing actions, both in model selection and token budget allocation. Figure 2 ranks 12 LLMs at their best budgets and shows that their utility and security rankings differ substantially. For example, Foundation-Sec-8B ranks 1st in security but 9th in utility, while Qwen3.5-27B ranks 4th in utility but 9th in security. Figure 3 shows the same mismatch across token budgets. For Qwen3Coder-30B, utility rises from 10.4% to 79.4% as the budget grows to about 4,000 tokens. In contrast, its security performance peaks at only 120 tokens, where utility remains at 40.5%. These observations show that models and budgets that improve utility

Introduction

LLM routers are widely used in modern LLM infrastructure (Yu et al., 2022; Kwon et al., 2023; Lu et al., 2026). They reduce serving cost by selecting a suitable model configuration for each query. Most existing routers use a model-only action space: the router selects only which model should answer each query, as in RouterBench (Hu et al., 2024), RouteLLM (Ong et al., 2025), CARROT (Somerstep et al., 2025), and UniRoute (Jitkrittum et al., 2026). R2-Router (Xue et al., 2026) extends the action space to model-budget pairs: it picks both the model and its output token budget for each query. 1

Security Rank

81.0

Foundation-Sec-8B Qwen3-Coder-30B Phi-4-mini Llama-3.1-8B Llama-3.1-70B DS-R1-Qwen3-8B Qwen3.5-0.8B Gemma-3-1B Qwen3.5-27B Mistral-7B-v0.3 Qwen3.5-9B Qwen3.5-4B

79.4

80 Mean Score

Utility Rank Qwen3-Coder-30B Llama-3.1-70B Phi-4-mini Qwen3.5-27B Llama-3.1-8B DS-R1-Qwen3-8B Qwen3.5-9B Qwen3.5-4B Foundation-Sec-8B Qwen3.5-0.8B Mistral-7B-v0.3 Gemma-3-1B

60 40 20 0

Figure 2: Model rankings differ between utility and security: strong utility need not imply strong security.

Utility Security 10

100 1k Token Budget

def.

Figure 3: Utility and security of Qwen3-Coder-30B under different token budgets. Utility and security peak at different token budgets.

need not improve security. A router that ignores this distinction may send security queries to models with strong utility but weak security, or allocate larger budgets without a security benefit. We propose SCRouter, the first SecurityConditioned model-budget Router. First, a small probe estimates the probability that a query is security-sensitive. Second, for each model-budget pair, a shared budget model predicts the probability of finishing within budget and the expected token use. Two quality predictors use this completion probability to account for truncated responses when estimating utility and security separately. This lets the two objectives favor different models and budgets while sharing the same completion estimate. Third, SCRouter uses the probe’s estimate to weight the two quality scores, then selects the model-budget pair that best balances the combined score against the cost estimated from token use. The predictors share parameters across actions, avoiding a separate predictor for each pair. We also build SCRouterBench, a routing benchmark with mixed utility and security workloads. It has 38,869 queries, covering utility tasks and nine security dimensions, plus an out-of-domain test set of 2,753 queries. We run all 144 actions per query, yielding about 6 million labeled responses. On SCRouterBench, SCRouter recovers 60.9% of the gap between random selection and the perquery oracle, compared with 48.0% for the best baseline, R2-Router, a gain of 12.9 percentage points. As shown in Figure 1, all three encoder variants of SCRouter beat every baseline, even the smallest one, which has a 4M-parameter encoder and 0.25M trainable parameters. SCRouter-M also leads out-of-domain with 50.2% OGR. Our contributions are as follows: (a) we find a utility-security asymmetry in LLM routing across

both model choice and budget allocation; (b) we propose SCRouter, a security-conditioned modelbudget router that adapts its routing objective to each query; (c) we release SCRouterBench to evaluate model and budget selection on mixed utility and security workloads; and (d) we demonstrate gains over existing routers in both settings.

Related Work

LLM Routing. LLM routers direct queries to candidate models to balance response quality and inference cost. Cascade routers try a small model first and move to larger ones if the answer is poor (Chen et al., 2024a; Aggarwal et al., 2024). Predictive routers pick a model before generation from query features, preference data, or learned embeddings (Ding et al., 2024; Ong et al., 2025; Chen et al., 2024b; Feng et al., 2025; Song et al., 2025; Somerstep et al., 2025; Jitkrittum et al., 2026). Benchmarks such as RouterBench (Hu et al., 2024) and RouterArena (Lu et al., 2026) have standardized model routing evaluation. R2-Router (Xue et al., 2026) and RADAR (Fernandez et al., 2026) extend routing to choose both the model and the token budget. Unlike these routers, which use one quality metric and ignore security, SCRouter predicts utility and security separately for each modelbudget action. We also build SCRouterBench to evaluate routers under mixed workloads. Attacks on LLMs. Despite safety alignment, LLMs remain vulnerable to adversarial inputs such as jailbreaks (Wei et al., 2023; Zou et al., 2023; Chao et al., 2025) and prompt injections (Perez and Ribeiro, 2022; Greshake et al., 2023; Schulhoff et al., 2023). Safety benchmarks (Mazeika et al., 2024; Chao et al., 2024; Wang et al., 2023) show 2

\(w(x)\)

Query \(x\)

\(Q_U\)

Surface Fusion \((1-w)Q_U+wQ_S\)

\(Q_S\)

Frozen Text Encoder 4M-0.6B params Utility Predictor

\(\pi(x, a)\)

\(Q\)

Security Predictor

Security Emphasis \(w(x)\)

Query Embedding \(z(x)\)

\(\mu\)

Cost-Aware Action Scoring \((1-\mu)Q-\mu E[\text{cost}]\)

Linear Probe \(z(x)\)

Cost Preference \(\mu\)

\(z(x)\)

Budget Model Action \((m^*, b^*)\) \(z(x)\)

Figure 4: Overview of the SCRouter pipeline. (1) A frozen text encoder and linear probe estimate the query’s security weight w(x). (2) A shared budget model predicts the probability π(x, a) that the response finishes within budget, and two quality models predict the utility and security surfaces Q̂U and Q̂S for all actions. (3) The two surfaces are combined with weight w(x) and traded off against cost with the cost coefficient µ. SCRouter-L R2-Router CARROT-RoBERTa

that robustness differs a lot across models. Existing defenses make a single model more robust (Inan et al., 2023; Chen et al., 2025; Du et al., 2024) or protect the router itself from attacks (Shafran et al., 2025; Zhang et al., 2026). SCRouter treats security queries as part of the routing workload. It uses differences in model robustness and budget sensitivity to send security queries to safe configurations and utility queries to high-utility ones.

Security-Conditioned Router

3.1

Overview

Oracle Gap Recovered

In-Domain

Out-of-Domain

20 0

#Encoder Params 10M 100M 1B 101 102 103 104 #Router Params (M)

SCRouter-S CARROT-KNN MIRT

20 0

101 102 103 104 #Router Params (M)

Figure 5: Efficiency versus performance across routers. SCRouter gets higher OGR with fewer parameters and lower TTFT. The x-axis denotes router size, and circle size denotes text encoder size.

Let x denote a query and A = M × B be the action space, where each action a = (m, b) specifies a generation model m with an output token budget b. For every action, U (x, a) ∈ [0, 1] denotes the utility of the response and S(x, a) ∈ [0, 1] its security. SCRouter predicts the surfaces U and S separately for all actions and combines them with a query-specific security weight. Figure 4 summarizes the pipeline. First, a frozen text encoder represents the query, and a linear probe on this representation estimates a query-specific security weight w(x) (Section 3.2). Second, a shared budget model predicts, for every action, the completion probability π(x, a), which is the probability that the response finishes within its budget. Two quality models then use π to predict the utility and security surfaces Q̂U (x, a) and Q̂S (x, a) (Section 3.3). Third, the two quality surfaces are fused with security weight w(x) and traded off against the expected cost using a cost coefficient µ set by the operator (Section 3.4). 3.2

SCRouter-M RADAR NIRT

Query Representation z(x). A frozen encoder maps each query x to a representation z(x), which is used by the security probe, budget model, and quality predictors. Security Weight w(x). A logistic-regression probe on the query representation z(x) gives the security weight directly: w(x) = σ v ⊤ z(x) + v0 . (1) We train the probe on binary labels (0 for utility, 1 for security), so w(x) is the predicted probability that a query is a security query. Its regularization strength is selected by minimizing validation logloss. Figure 6 shows that the probe separates utility and security queries in-domain and generalizes to unseen sources. Encoder Variants. Prior work (Xue et al., 2026) uses large encoders such as Qwen3-Embedding0.6B (Zhang et al., 2025). These encoders

Query Conditioning 3

Utility

In-Domain 99.6%

Security

Fitted π

Out-of-Domain

99.6%

86.7%

74.2%

Observed finish rate

Qwen3.5-0.8B

Gemma-3-1B

Phi-4-mini

0.10

−20 −10 0 10 logit w(x)

P(finish)

Density

1 0.05

Qwen3.5-4B MAE 0.005

Llama-3.1-8B

are already close in size to the smallest candidate LLMs and add to the time to first token (TTFT). We use smaller encoders to keep routing cheap. We design three variants: SCRouterL (Qwen3-Embedding-0.6B, 1024-d), SCRouterM (all-MiniLM-L6-v2, 384-d), and SCRouterS (BERT-tiny, 128-d). SCRouter-S uses a 4M encoder and 0.25M trainable parameters. Figure 5 compares efficiency and performance across routers; Section 5.2 reports the results.

MAE 0.022 DS-R1-Qwen3-8B MAE 0.009

MAE 0.014 Foundation-Sec-8B

MAE 0.019

100

Qwen3.5-9B MAE 0.007

MAE 0.026

Qwen3.5-27B 1 MAE 0.010

Figure 6: Performance of the security probe. The probe separates utility and security queries well in-domain and generalizes to unseen sources.

Qwen3-Coder-30B

Llama-3.1-70B

MAE 0.021 100 1k 10 Token Budget

MAE 0.033 100 1k

Figure 7: Budget model calibration across models and budgets. Lines denote the fitted completion probability π from the shared budget model, while markers represent observed completion rates. The predicted π increases with b even though we do not force it to.

A tower uL (x), a two-layer MLP, maps the query to a low-dimensional demand vector, and (3) log B ∗ ∼ N λ, s2 , L λ = ⟨uL (x), AL m ⟩ + cm + gm,b ,

Budget-Conditioned Quality Surfaces

(4)

L where AL m and cm describe how many tokens model m needs, gm,b how strongly the instruction b compresses this need, and s = sm,b is a learned spread per action. The default budget carries no instruction, is capped at b = 4,000 tokens, and keeps its own column of g and s. With ζ = (log b − λ)/s, the completion probability is

A response may score low for two reasons. It may finish but give a weak answer, or it may reach the token limit before it finishes. We call the second case budget-induced truncation. For each objective t ∈ {U, S}, we model the two cases separately and mix them by the completion probability π, Q̂t = πFt + (1 − π) Tt ,

Mistral-7B-v0.3

3.3

MAE 0.037

MAE 0.016

(2)

π = P (B ∗ ≤ b) = Φ(ζ).

where Ft and Tt are the predicted qualities of completed and truncated responses. A shared budget model gives π and the expected number of generated tokens. Two quality models, one for utility and one for security, give Ft and Tt . In SCRouterBench and many other benchmarks, completion rates rise almost monotonically with b for all models. We therefore derive π from the number of tokens each response needs.

(5)

A completed response stops after B ∗ tokens and a truncated one stops at b, so the model generates min(B ∗ , b) tokens, whose expectation is 2

Ê[tok] = eλ+s /2 Φ(ζ − s) + b (1 − π).

(6)

This one distribution gives both the completion probability and the expected cost. Figure 7 shows that the predicted π follows the observed completion rates as the budget grows.

Shared Budget Model. Let B ∗ (x, m, b) be the smallest number of output tokens with which model m, instructed with budget b, completes its answer to x. The response is truncated exactly when B ∗ > b. Because a model writes shorter answers when told a budget, B ∗ depends on b. The budget changes the answer itself, not only where it stops.

Completion/Truncation Quality Models. Following multidimensional item response theory, for each objective t ∈ {U, S} a tower ut (x) maps the query to a demand vector, and each model has an ability vector in the same space. With the logit ϕt = ⟨ut , At,m ⟩ + ct,m + βt,m,b + ⟨ut , Ct,b ⟩, (7) 4

Trainable Parameters

+0.30M per action

100M

43.7M

SCRouter-L R2-Router

10M 1.63M 1M

log-normal likelihood, plus a binary cross-entropy loss between π and whether the response actually completed, which we read from its stop reason. Ft is fitted on the completed cells and Tt on the truncated cells of objective-t queries, and an end-to-end binary cross-entropy aligns Q̂t with the observed score on all cells of objective-t queries. As a result, the utility model sees only utility queries and the security model sees only security queries. No query needs both labels. All terms are summed with unit weights and optimized with AdamW with early stopping based on the validation loss.

700M

144

+14 per action

1.66M

400 784 1296 #Action Space

1936

Figure 8: Parameter scaling across action spaces. Trainable parameters on a log scale for n models and n budgets excluding the frozen encoder, with our 12 × 12 setting dashed. R2-Router grows quadratically, from 43.7M to 700M parameters, while SCRouter stays at about 1.6M because its towers are shared.

3.4

Surface Fusion and Cost-Aware Decision

We then combine the two surfaces with the query’s security weight. For every action a, Q̂(x, a) = (1 − w) Q̂U + w Q̂S .

the predicted qualities of completed and truncated responses are given by Ft = σ(ϕt ),

Setting w = 0 gives utility-only routing and w = 1 gives security-only routing. Values in between mix the two without retraining. The cost of an action is estimated before generation from the known input length nin , the expected number of generated tokens (Eq. 6), and the perout token prices pin m and pm of model m:

(8)

Tt = σ ϕ′t + κt,m (log b − λ̄) ,

(10)

(9)

where ϕ′t has the form of Eq. 7 with its own pa′ . Here A rameters A′t,m , c′t,m , ρt,m,b , and Ct,b t,m is model m’s ability for objective t, βt,m,b and ρt,m,b capture how the budget instruction itself changes quality, ⟨ut , Ct,b ⟩ lets the budget sensitivity depend on the query, and κt,m gives partial credit according to how close the budget came to being sufficient. The shift λ̄ is λ from Eq. 4 with its gradient stopped, so the quality loss does not change the budget model. Eq. 2 then mixes Ft and Tt by π. Each tower is a two-layer MLP of width 512 with a 32-dimensional output. Because the towers are shared across actions and the model and budget parameters are lookup tables, one forward pass gives the full |M| × |B| surface for each objective. SCRouter therefore needs no per-action predictor, and its size grows much more slowly than R2-Router’s, as shown in Figure 8.

Ĉ(x, a) =

out nin pin m + Ê[tok] pm , Cref

(11)

where Cref is the largest nominal cost over all training queries and actions. This nominal cost takes the output length to be the token budget, or the model’s mean training output length for the default budget. Given the operator’s cost coefficient µ ∈ [0, 1], SCRouter selects a∗ = arg max (1 − µ) Q̂(x, a) − µ Ĉ(x, a). (12) a∈A

All |M||B| actions are scored without invoking any candidate generation model, and only a∗ is executed. In short, w(x) decides what counts as a good answer, and µ decides how much quality to give up for lower cost.

Training. We call one (query, action) result a cell, and train each part only on the cells that tell us something about it. A cell either gives B ∗ exactly or gives only a lower bound. Specifically, with the budget instruction fixed, a completed response of length ℓ gives an observed B ∗ = ℓ, whereas a truncated response gives only the lower bound B ∗ > b. This observation does not imply completion under a different budget instruction. We therefore fit the budget model on all training cells with a censored

SCRouterBench

SCRouterBench evaluates routers on mixed utility and security queries under cost constraints. As summarized in Table 1, utility queries come from six datasets in SPROUT (Somerstep et al., 2025); security queries cover nine dimensions from DecodingTrust (Wang et al., 2023), SALAD-Bench (Li et al., 2024), and HackAPrompt (Schulhoff et al., 2023). See Appendix A for details. 5

In-domain Dimension

OOD

Source

#Q Source

SPROUT

19,882 MixEval

998

Toxicity DecodingTrust Stereotype DecodingTrust Adv. demo. DecodingTrust Privacy DecodingTrust Ethics DecodingTrust Fairness DecodingTrust Harmful req. SALAD-Bench Cyber risk SALAD-Bench Jailbreak/PI HackAPrompt

2,000 ToxiGen 1,994 CrowS-Pairs 1,996 BadChain 2,000 Synthetic 2,000 ETHICS 1,997 BBQ 4,732 HarmBench 768 HarmBench 1,500 Tensor Trust

200 200 200 200 200 300 188 67 200

Total

38,869

†

Utility

Experiments

5.1

Experimental Setup

Router Baselines. We compare with seven baselines, each re-run with its original encoder, architecture, training objective, and decision rule. R2-Router (Xue et al., 2026) trains one MLP per model-budget action on Qwen3-Embedding0.6B. RADAR (Fernandez et al., 2026) fits a twoparameter IRT model over all actions on Qwen3Embedding-8B, and we report both its Chebyshev rule and a linear rule. MIRT and NIRT (Song et al., 2025) use BERT-base. CARROT (Somerstep et al., 2025) has KNN, RoBERTa, and Linear variants. R2-Router and RADAR choose among the same 144 actions as SCRouter. MIRT, NIRT, and the CARROT variants choose among the 12 models at the default budget, as in their original form.

2,753

Table 1: Overview of SCRouterBench. In-domain queries are split 70/10/20 into train/val/test; out-ofdomain queries are used for evaluation only. Every query is scored under all 144 actions. † Six datasets: MMLU-Pro, GPQA, MuSR, MATH, OpenHermes, RAGBench. PI: prompt injection.

Cost. Every router makes its decision using a cost estimate available before generation. The estimate uses the input tokens and the router’s own prediction of output tokens, priced with a fixed per-model price table and normalized by the largest nominal training cost Cref defined in Section 3.4. Evaluation uses the realized cost of the chosen response, which reflects its actual input and output tokens at the same per-model prices.

Action Grid and Setup. Each query is evaluated across all |A| = 144 actions formed by 12 openweight models from 0.8B to 70B parameters and 12 token budgets B. The token budgets include 11 instructed budgets from 10 to 4,000 tokens plus a default budget with no budget instruction. Each response gets a score in [0, 1] for its own objective: exact match for closed-form utility questions, gptoss-120b as a judge for open-ended ones, and the original benchmark protocol for security queries. Missing final answers receive a score of zero.

Metric. Sweeping the cost coefficient µ traces the router’s performance-cost frontier R(c). We summarize it with Oracle Gap Recovery (OGR): the area between the router and a random baseline, divided by the area between the oracle and the random baseline, over log cost:

Data Splits and Label Verification. The benchmark contains 38,869 queries split 70/10/20 into train, validation, and test sets. We stratify splits by dimension and group them by template to avoid leakage. For out-of-domain evaluation, 2,753 additional queries are gathered from nine unseen sources. To ensure label quality, we compare utility labels with gold answers (97.7% agreement) and security labels with Qwen3Guard (Cohen’s κ ≥ 0.76). We drop queries whose labels cannot be decided, so every query has all 144 action labels.

R R(c) − Rnd(c) d log c OGR = 100 · R , (13) O(c) − Rnd(c) d log c where O(c) is the oracle frontier and Rnd(c) is a label-free baseline that uniformly samples from fixed actions with mean cost at most c. The integral runs from the cost of the cheapest fixed action to that of the highest-scoring one. If a router cannot reach a cost c, we set R(c) = Rnd(c). By definition, OGR is 0 for random selection and 100 for the oracle. We report OGR on all queries and on the two subsets, averaged over three seeds.

Routing Headroom. Per-query routing has a lot of room to improve on this data. In every dimension, the best fixed action is well below the perquery oracle, and the oracle’s model choices are spread out, with an entropy of 2.5-3.4 bits. This equals spreading the choices evenly over 6 to 11 of the 12 models. No single model is best for most queries, so the router must choose per query.

5.2

Main Results

Table 2 reports OGR in-domain and out-of-domain, and Figure 9 shows the performance-cost curves. 6

SCRouter-L CARROT-RoBERTa

Overall

100 Oracle Gap Recovered

SCRouter-M CARROT-Linear

SCRouter-S NIRT

Utility

100

R2-Router MIRT 100

10−5 Cost per Query (USD)

10−4

10−5 10−4 Cost per Query (USD)

RADAR

CARROT-KNN

Security

10−5 Cost per Query (USD)

Figure 9: Performance-cost trade-offs on in-domain evaluation. Each curve shows performance against log cost as µ varies. Random selection and the oracle are the lower and upper bounds. SCRouter is on top at most costs, with the largest gap on security and at low cost, where model-only baselines have no available action.

In-Domain

Out-of-Domain

Router

All Util. Sec.

All Util.

SCRouter-L SCRouter-M SCRouter-S

60.9 52.9 72.0 48.1 49.6 47.3 60.5 52.9 70.9 50.2 50.7 49.8 59.9 53.9 66.6 46.9 48.4 46.1

R2-Router 48.0 RADAR (linear) 39.2 RADAR (Chebyshev) 36.7 CARROT-KNN 42.1 CARROT-RoBERTa 35.9 CARROT-Linear 37.7 NIRT 32.6 MIRT 32.0

49.4 39.1 15.6 44.9 27.4 27.7 41.3 30.0 27.4 39.0 38.8 23.7 33.2 32.1 14.7 34.8 30.4 14.8 32.8 17.1 9.6 32.4 17.6 7.3

rity, where its OGR drops to 27.4. On utility, all curves meet at high cost, where a strong model with a large budget answers most queries well. The routers differ mainly when the cost is tight. On security, SCRouter leads even at the lowest costs. A safe answer to a harmful request is often a short refusal, and Figure 3 shows that security peaks at only 120 tokens. Model-only baselines cannot lower the budget to use this.

Sec.

32.5 0.3 38.3 19.9 37.0 15.8 34.1 1.2 31.8 -5.8 27.1 -9.1 26.9 -14.3 25.8 -15.4

Utility versus Security. Every baseline in Table 2 scores lower on security than on utility indomain. RADAR (linear) loses 17.5 points, and NIRT and MIRT lose about 15. SCRouter shows the opposite pattern, with all three variants higher on security. Compared with R2-Router, SCRouter gains at most 4.5 points on utility but 27.5 to 32.9 points on security. Most of its overall gain thus comes from security queries. A larger action space alone does not explain this. CARROT-KNN chooses among only 12 models but reaches 38.8 on security, close to the 39.1 of R2-Router with all 144 actions. SCRouter uses the same 144 actions as R2-Router and reaches 72.0, so the gain comes from its quality metric.

Table 2: OGR on SCRouterBench, in-domain and outof-domain, for all queries (All) and for the utility (Util.) and security (Sec.) subsets. SCRouter variants beat all baselines in both settings.

In-Domain. SCRouter-L has the highest overall OGR, 12.9 points above the best baseline, R2Router, with the same encoder and action space. It is better on both objectives, with gains of 32.9 points on security and 3.5 points on utility. As shown in Figure 5, the gains hold with smaller encoders. SCRouter-M, with a 23M MiniLM encoder, is still 12.5 points ahead. SCRouter-S, with a 4M encoder, is 11.9 points ahead and has the best utility OGR of 53.9. It is behind the two larger variants only on the security subset.

Out-of-Domain. All routers do worse on the nine unseen sources, most of all on security. On security, R2-Router drops to a near-random 0.3, CARROTKNN gets 1.2, and the other CARROT and IRT routers fall below random. RADAR is the strongest baseline under domain shift, reaching an overall score of 27.7. Its two-parameter IRT model is simple and likely has less room to overfit the training sources. RADAR (linear) loses 11.5 points overall from in-domain to out-of-domain, while R2-Router, which trains one MLP per action, loses

Figure 9 shows where the gains come from. SCRouter scores higher than R2-Router at most costs, especially low ones. Model-only baselines such as MIRT, NIRT, and CARROT cannot go below the cost of the cheapest model at its default budget. RADAR uses a single ability scale, which ranks actions well for utility but poorly for secu7

Component

In-Domain Out-of-Domain

SCRouter-L (full) w/o Query-specific w(x) w/o Budget terms w/o Success/failure split w/o Separate quality models

60.9 54.0 (-6.9) 58.3 (-2.6) 55.0 (-5.9) 49.9 (-11.0)

SCRouter-L R2-Router CARROT-RoBERTa

48.1 40.7 (-7.4) 43.0 (-5.1) 42.4 (-5.7) 37.3 (-10.8)

Oracle Gap Recovered

Table 3: Ablation results. We report the overall OGR after removing each component from the full model.

SCRouter-S CARROT-KNN MIRT

54.9

45 30 15 0

32.4. All SCRouter variants still beat it on every metric. SCRouter-M has the best overall OGR of 50.2. It is 22.5 points above RADAR overall, 12.4 points on utility, and 29.9 points on security. SCRouter still does worse out-of-domain than in-domain. SCRouter-L drops from 60.9 to 48.1 overall, mainly because its security OGR falls from 72.0 to 47.3. Figure 6 explains much of this drop. The probe classifies 99.6% of security queries correctly in-domain but only 74.2% on unseen sources, compared with 86.7% for utility queries. About a quarter of unseen security queries thus get a low w(x) and are routed like utility queries. The probe still separates most queries, which helps SCRouter keep a large lead over the baselines. 5.3

SCRouter-M RADAR NIRT

Figure 10: Leave-one-source-out evaluation across 15 training sources. We report the average held-out OGR for each method. All SCRouter variants beat the baselines on held-out sources.

Separate Quality Models. Using separate utility and security models matters most. Merging them into one model gives the largest drops, with OGR falling by 11.0 points to 49.9 in-domain and by 10.8 points to 37.3 out-of-domain. A single model tends to fit the more common utility labels and does worse on security. 5.4

Ablation Study

Robustness under Domain Shift

To test robustness to domain shift, we hold out each of the 15 training sources in turn and report the results in Figure 10. SCRouter variants attain 50.5-54.9 average held-out OGR, whereas baselines RADAR, R2-Router, and CARROT-KNN reach only 34.7, 22.0, and 9.5 respectively. This 16–20 point gain over the best baseline matches our out-of-domain results in Table 2. Smaller encoders transfer better. SCRouter-S has the best held-out OGR of 54.9, and SCRouter-M has the best out-ofdomain OGR in Table 2. SCRouter-L is best only in-domain. A larger encoder may fit the training sources too closely. A small encoder is thus a good default when the test workload is unknown.

To measure what each part adds, we remove one part at a time from SCRouter-L and test in-domain and out-of-domain. Table 3 shows the results. Query-Specific Weight. Replacing w(x) with a fixed weight lowers OGR by 6.9 points indomain and 7.4 points out-of-domain, so a perquery weight matters. A fixed weight applies the same trade-off to every query. It either undervalues security on harmful requests or undervalues utility on ordinary ones. Budget Modeling. Removing budget terms, such as the per-model compression table, querydependent budget sensitivity, partial credit for failed responses, and auxiliary losses, reduces OGR by 2.6 points in-domain and 5.1 points out-ofdomain. Modeling the budget helps in both settings, especially out-of-domain.

Conclusion

We present SCRouter, a router that picks both the model and token budget. It predicts utility and security separately, weights them per query with a security probe, and uses a shared budget model to estimate success probability and cost. On SCRouterBench, SCRouter recovers 60.9% of the oracle gap in-domain and beats all baselines out-of-domain. These results demonstrate that routing mixed workloads requires a per-query quality metric, not just a larger action space.

Success/Failure Split. Predicting quality separately for successful and failed responses helps in both settings. Omitting this split reduces OGR by 5.9 points in-domain and 5.7 points out-of-domain. Failed utility responses are rarely useful, but failed security responses are often still safe, so the two cases need separate predictions. 8

Limitations

Lingjiao Chen, Matei Zaharia, and James Zou. 2024a. FrugalGPT: How to use large language models while reducing cost and improving performance. Transactions on Machine Learning Research.

Following prior routing benchmarks (Hu et al., 2024; Somerstep et al., 2025), our evaluation focuses on single-turn text queries and a pool of 12 open-weight models. Multi-turn and multimodal workloads are left for future evaluation. Cost comparisons use actual token consumption and a fixed per-model price table shared by all routers. This provides a consistent comparison, but does not account for time-varying prices or load-dependent serving costs.

Shuhao Chen, Weisen Jiang, Baijiong Lin, James Kwok, and Yu Zhang. 2024b. RouterDC: Query-based router by dual contrastive learning for assembling large language models. In Advances in Neural Information Processing Systems. Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. 2025. StruQ: Defending against prompt injection with structured queries. In 34th USENIX Security Symposium.

Ethical Considerations

Dujian Ding, Ankur Mallick, Chi Wang, Robert Sim, Subhabrata Mukherjee, Victor Rühle, Laks V. S. Lakshmanan, and Ahmed Hassan Awadallah. 2024. Hybrid LLM: Cost-efficient and quality-aware query routing. In The Twelfth International Conference on Learning Representations.

SCRouterBench is built entirely from publicly available benchmarks, used under their original licenses, and no new human data was collected. Its security queries and the corresponding model responses contain toxic, biased, and harmful content, including jailbreak and prompt-injection attacks, which we use solely to evaluate routing and release only for research purposes. The per-model security results could also reveal which configurations are easiest to attack. We think the benefit of securityaware routing outweighs this risk. SCRouter is a cost-aware routing layer, not a safety guarantee. We used AI assistants to check grammar.

Yanrui Du, Sendong Zhao, Danyang Zhao, Ming Ma, Yuhan Chen, Liangyu Huo, Qing Yang, Dongliang Xu, and Bing Qin. 2024. MoGU: A framework for enhancing safety of LLMs while preserving their usability. In Advances in Neural Information Processing Systems. Tao Feng, Yanzhen Shen, and Jiaxuan You. 2025. GraphRouter: A graph-based router for LLM selections. In The Thirteenth International Conference on Learning Representations. Nigel Fernandez, Branislav Kveton, Ryan A. Rossi, Andrew S. Lan, and Zichao Wang. 2026. RADAR: Reasoning-ability and difficulty-aware routing for reasoning LLMs. In The Fourteenth International Conference on Learning Representations.

References Abdelrahman Abouelenin, Atabak Ashfaq, Adam Atkinson, Hany Awadalla, Nguyen Bach, et al. 2025. Phi-4-Mini technical report: Compact yet powerful multimodal language models via mixture-of-LoRAs. arXiv preprint arXiv:2503.01743.

Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, et al. 2025. Gemma 3 technical report. arXiv preprint arXiv:2503.19786.

Pranjal Aggarwal, Aman Madaan, Ankit Anand, Srividya Pranavi Potharaju, Swaroop Mishra, Pei Zhou, Aditya Gupta, Dheeraj Rajagopal, Karthik Kappaganthu, Yiming Yang, Shyam Upadhyay, Manaal Faruqui, and Mausam. 2024. AutoMix: Automatically mixing language models. In Advances in Neural Information Processing Systems.

Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, et al. 2024. The Llama 3 herd of models. arXiv preprint arXiv:2407.21783. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you’ve signed up for: Compromising real-world LLM-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security.

Patrick Chao, Edoardo Debenedetti, Alexander Robey, Maksym Andriushchenko, Francesco Croce, Vikash Sehwag, Edgar Dobriban, Nicolas Flammarion, George J. Pappas, Florian Tramèr, Hamed Hassani, and Eric Wong. 2024. JailbreakBench: An open robustness benchmark for jailbreaking large language models. In Advances in Neural Information Processing Systems.

Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Peiyi Wang, et al. 2025. DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning. Nature.

Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J. Pappas, and Eric Wong. 2025. Jailbreaking black box large language models in twenty queries. In 2025 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML).

Dan Hendrycks, Collin Burns, Steven Basart, Andrew Critch, Jerry Li, Dawn Song, and Jacob Steinhardt. 2021. Aligning AI with shared human values. In International Conference on Learning Representations.

Qitian Jason Hu, Jacob Bieker, Xiuyu Li, Nan Jiang, Benjamin Keigwin, Gaurav Ranganath, Kurt Keutzer, and Shriyash Kaustubh Upadhyay. 2024. Routerbench: A benchmark for multi-LLM routing system. In Agentic Markets Workshop at ICML 2024.

Sander Schulhoff, Jeremy Pinto, Anaum Khan, LouisFrançois Bouchard, Chenglei Si, Svetlina Anati, Valen Tagliabue, Anson Kost, Christopher Carnahan, and Jordan Boyd-Graber. 2023. Ignore this title and HackAPrompt: Exposing systemic vulnerabilities of LLMs through a global prompt hacking competition. In Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing.

Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, and Madian Khabsa. 2023. Llama guard: LLMbased input-output safeguard for human-AI conversations. arXiv preprint arXiv:2312.06674.

Avital Shafran, Roei Schuster, Tom Ristenpart, and Vitaly Shmatikov. 2025. Rerouting LLM routers. In Second Conference on Language Modeling.

Wittawat Jitkrittum, Harikrishna Narasimhan, Ankit Singh Rawat, Jeevesh Juneja, Congchao Wang, Zifeng Wang, Alec Go, Chen-Yu Lee, Pradeep Shenoy, Rina Panigrahy, Aditya Krishna Menon, and Sanjiv Kumar. 2026. Universal model routing for efficient LLM inference. In The Fourteenth International Conference on Learning Representations.

Seamus Somerstep, Felipe Maia Polo, Allysson Flavio Melo de Oliveira, Prattyush Mangal, Mírian Silva, Onkar Bhardwaj, Mikhail Yurochkin, and Subha Maity. 2025. CARROT: A cost aware rate optimal router. In ICLR 2025 Workshop on Foundation Models in the Wild. Wei Song, Zhenya Huang, Cheng Cheng, Weibo Gao, Bihan Xu, GuanHao Zhao, Fei Wang, and Runze Wu. 2025. IRT-router: Effective and interpretable multi-LLM routing via item response theory. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

Woosuk Kwon, Zhuohan Li, Siyuan Zhuang, Ying Sheng, Lianmin Zheng, Cody Hao Yu, Joseph Gonzalez, Hao Zhang, and Ion Stoica. 2023. Efficient memory management for large language model serving with PagedAttention. In Proceedings of the 29th Symposium on Operating Systems Principles.

Sam Toyer, Olivia Watkins, Ethan Adrian Mendes, Justin Svegliato, Luke Bailey, Tiffany Wang, Isaac Ong, Karim Elmaaroufi, Pieter Abbeel, Trevor Darrell, Alan Ritter, and Stuart Russell. 2024. Tensor trust: Interpretable prompt injection attacks from an online game. In The Twelfth International Conference on Learning Representations.

Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. SALAD-bench: A hierarchical and comprehensive safety benchmark for large language models. In Findings of the Association for Computational Linguistics: ACL 2024. Yifan Lu, Rixin Liu, Jiayi Yuan, Xingqi Cui, Shenrun Zhang, Hongyi Liu, and Jiarong Xing. 2026. Routerarena: An open platform for comprehensive comparison of LLM routers. In The Fourteenth International Conference on Learning Representations.

Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ritik Dutta, Rylan Schaeffer, Sang Truong, Simran Arora, Mantas Mazeika, Dan Hendrycks, Zinan Lin, Yu Cheng, Sanmi Koyejo, Dawn Song, and Bo Li. 2023. DecodingTrust: A comprehensive assessment of trustworthiness in GPT models. In Advances in Neural Information Processing Systems.

Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. In Forty-first International Conference on Machine Learning.

Sajana Weerawardhena, Paul Kassianik, Blaine Nelson, Baturay Saglam, Anu Vellore, Aman Priyanshu, Supriti Vijay, Massimo Aufiero, Arthur Goldblatt, Fraser Burch, Ed Li, Jianliang He, Dhruv Kedia, Kojin Oshiba, Zhouran Yang, Yaron Singer, and Amin Karbasi. 2025. Llama-3.1-FoundationAISecurityLLM-8B-Instruct technical report. arXiv preprint arXiv:2508.01059.

Isaac Ong, Amjad Almahairi, Vincent Wu, Wei-Lin Chiang, Tianhao Wu, Joseph E. Gonzalez, M Waleed Kadous, and Ion Stoica. 2025. RouteLLM: Learning to route LLMs from preference data. In The Thirteenth International Conference on Learning Representations.

Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does LLM safety training fail? In Advances in Neural Information Processing Systems.

Alicia Parrish, Angelica Chen, Nikita Nangia, Vishakh Padmakumar, Jason Phang, Jana Thompson, Phu Mon Htut, and Samuel R. Bowman. 2022. BBQ: A hand-built bias benchmark for question answering. In Findings of the Association for Computational Linguistics: ACL 2022.

Jiaqi Xue, Qian Lou, Jiarong Xing, and Heng Huang. 2026. R2-router: A new paradigm for LLM routing with reasoning. In Forty-third International Conference on Machine Learning.

Fábio Perez and Ian Ribeiro. 2022. Ignore previous prompt: Attack techniques for language models. In NeurIPS ML Safety Workshop.

An Yang, Anfeng Li, Baosong Yang, Beichen Zhang, Binyuan Hui, et al. 2025. Qwen3 technical report. arXiv preprint arXiv:2505.09388.

Gyeong-In Yu, Joo Seong Jeong, Geon-Woo Kim, Soojeong Kim, and Byung-Gon Chun. 2022. Orca: A distributed serving system for Transformer-Based generative models. In 16th USENIX Symposium on Operating Systems Design and Implementation (OSDI 22). Wenhui Zhang, Huiyu Xu, Zhibo Wang, Zhichao Li, Zeqing He, Xuelin Wei, and Kui Ren. 2026. Rerouteguard: Understanding and mitigating adversarial risks for llm routing. arXiv preprint arXiv:2601.21380. Yanzhao Zhang, Mingxin Li, Dingkun Long, Xin Zhang, Huan Lin, Baosong Yang, Pengjun Xie, An Yang, Dayiheng Liu, Junyang Lin, Fei Huang, and Jingren Zhou. 2025. Qwen3 embedding: Advancing text embedding and reranking through foundation models. arXiv preprint arXiv:2506.05176. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.

SCRouterBench Details

Table 5 lists the sources, dimensions, scoring criteria, and split sizes of SCRouterBench, including the out-of-domain evaluation set. Table 4 lists the 12 models in the action space.

Tier

Model

Developer

Params

Focus

Small

Qwen3.5-0.8B Gemma-3-1B-it (Gemma Team et al., 2025) Phi-4-mini-instruct (Abouelenin et al., 2025) Qwen3.5-4B

Qwen Google Microsoft Qwen

0.8B 1B 3.8B 4B

General General General General

Medium

Mistral-7B-Instruct-v0.3 DeepSeek-R1-0528-Qwen3-8B (Guo et al., 2025) Llama-3.1-8B-Instruct (Grattafiori et al., 2024) Foundation-Sec-8B-Instruct (Weerawardhena et al., 2025) Qwen3.5-9B

Mistral AI DeepSeek Meta Cisco Qwen

7B 8B 8B 8B 9B

General Reasoning General Security General

Large

Qwen3.5-27B Qwen3-Coder-30B-A3B-Instruct (Yang et al., 2025) Llama-3.1-70B-Instruct (Grattafiori et al., 2024)

Qwen Qwen Meta

27B 30B (3B active) 70B

General Coding General

Table 4: Model pool of SCRouterBench: 12 open-weight LLMs from 0.8B to 70B parameters, covering generalpurpose instruction following, reasoning, coding, and security specialization. Each model is paired with 12 token budgets, giving |A| = 144 actions.

Source

Dimension

Outcome (score 1 if . . . )

Train

Val

Utility (SPROUT) MMLU-Pro Knowledge GPQA Expert QA MuSR Multi-step reasoning MATH Mathematics OpenHermes Instruction following RAGBench Retrieval-grounded QA

extracted final answer matches the reference extracted final answer matches the reference extracted final answer matches the reference extracted final answer matches the reference independent judge (gpt-oss-120b) score independent judge (gpt-oss-120b) score

3,734 168 234 3,069 6,139 572

534 1,067 24 48 34 67 439 877 876 1,753 83 164

Security DecodingTrust DecodingTrust DecodingTrust DecodingTrust DecodingTrust DecodingTrust SALAD-Bench SALAD-Bench HackAPrompt

1− max Detoxify toxicity over the full response does not agree with the stereotype does not output the attacker’s target label does not leak the target personal information correct wrong / not-wrong judgment correct income prediction (Adult) MD-Judge rates the response safe MD-Judge rates the response safe does not output the attacker’s target string

1,400 1,395 1,397 1,400 1,400 1,397 3,311 537 1,050

200 200 200 200 200 200 474 77 150

Toxicity Stereotype bias Adv. demonstration Privacy Machine ethics Fairness Harmful requests Cyber risk Jailbreak / prompt injection

Total (38,869 queries) Out-of-domain MixEval ToxiGen CrowS-Pairs BadChain Synthetic ETHICS BBQ HarmBench HarmBench Tensor Trust

Test

400 399 399 400 400 400 947 154 300

27,203 3,891 7,775

Utility

exact answer match (640 multiple-choice) or independent judge (358 open) Toxicity 1− max Detoxify toxicity over the full response Stereotype bias chooses the less stereotypical option Adv. demonstration answer matches the StrategyQA reference despite backdoored demonstrations Privacy does not leak the planted secret Machine ethics correct commonsense-morality label Fairness answers “unknown” in an ambiguous context Harmful requests HarmBench classifier: attack unsuccessful Cyber risk HarmBench classifier: attack unsuccessful Jailbreak / prompt injection no hijacking or access-code extraction (official rules)

Total

OOD 998 200 200 200 200 200 300 188 67 200 2,753

Table 5: Composition of SCRouterBench. Every query is answered under 12 models × 12 budgets and scored in [0, 1] for its own objective only (higher is better; for security, safer); a response without a visible final answer scores 0. Counts are queries with all 144 outcomes. Splits are grouped by prompt template and near-duplicate text and stratified by dimension. The out-of-domain sources, including ETHICS (Hendrycks et al., 2021), BBQ (Parrish et al., 2022), HarmBench (Mazeika et al., 2024), and Tensor Trust (Toyer et al., 2024), share no data with the training sources and are scored with their released criteria.

Rethinking Quality in Large Language Model Routing: Security-Conditioned Model-and-Budget Selection

Analyze & explore related research in Conceptio

Related documents