Why not just distribute the refusal vectors and do it at runtime against the stock model?
you may not have your own H200's to run it on?