Test it against innocent data sets, then in prod swap it for the opaque gov db of nasty stuff and hope the gov was honest about what is in it :)

They don't need to train a model to detect the actual data set. They need to train a model to follow a pre-defined algo