Comment by foo12bar

Maybe ask a separate model to look for indications against every model response you receive whether it is nefarious would work better.