Wouldn't that require the programmer to be adversarial? Since all type systems have escape hatches, I don't think they would be resilient at all in adversarial

Wouldn't that require the programmer to be adversarial? Since all type systems have escape hatches, I don't think they would be resilient at all in adversarial settings. This is more geared towards detecting accidental and _subtle_ data leakage.