Perhaps this is in line with what you had in mind? https://patents.google.com/patent/US12118471

> The input is represented as tokens, wherein the trusted instructions and the untrusted instructions are represented using incompatible token sets.

Yes, exactly!