And they won't be in the near future. We don't have a good understanding of how to stop them.

Maybe compare the output to the expected format and see if it looks like it has been manipulated?