Comment by eru

Interesting, you could defeat this one by making the subverted model talk in code (eg hiding information in capitalisation or punctuation), with things spread out enough that you need a long context window to catch on.