Out of curiosity why isn't this stuff handled by a secondary "monitor" agent that's specifically trained on what's okay and not okay? I'd think it'd be a pass-no-pass classifier and wouldn't degrade the performance of the main LLM.

Would the concern be that with sophisticated obfuscated input you could try to get ROT13 Klingon instructions on how to build a bomb - and that could fool the monitor?