Why not have a second model that reads every response looking for something nefarious?

Sounds like a SIEM to me

lazide 3 hours ago | parent | prev [-]

Who watches the watcher?

	▲	foo12bar 2 hours ago \| parent [-]
		Well you could use a model created from a completely unrelated entity. It would be difficult for an adversary to poison both in a exactly complementary way.