The technique you describe here seems like it’s very vulnerable to the decoder model colluding with the policy
Yes, I was claiming that this was likely, not that it was desirable.
Yes, I was claiming that this was likely, not that it was desirable.