It's gotta be a bit more than that, otherwise it would fail if you trimmed even one token off the start of the whole session, let alone removing the prompt enti

It's gotta be a bit more than that, otherwise it would fail if you trimmed even one token off the start of the whole session, let alone removing the prompt entirely. (One approach that's been described is creating a bias in certain token pairs or short sequences: by hashing the previous n tokens, potentially with a secret seed, you create a list of essentially random allowed and disallowed next tokens, then bias the token selection to prefer allowed tokens, so long as they are plausible enough. Then you can check any long-enough subset of the output, if it deviates significantly enough from random chance on following this rule, it was almost certainly generated from a system following these rules.)