not sure how much we can apply this here, but how about specific LLM judges that look for manipulation of I/O?