It would be interesting if there is a way to detect Silverfish (e.g. by recognizing some specific HTTP requests being made). Because that would allow the MitM to only run a MitM on devices that you know are vulnerable and thus decrease the changes of discovery immensely.

If you combine that with configuring your proxy not to MitM any of the sites that browsers have certificate-pinning for (e.g. Google sites with Chrome) you can probably have this running for a very long time without anybody noticing.