For the attacks where people get ChatGPT to do disallowed things - couldn't you just have the language model run a second time on the output and prompt, and ask it if the question was inappropriate? Outside of cost considerations is there a reason this wouldn't work to stop it?