Since the spoofed data is an API, your proposed framework to "recognize spoofed settings" must solve the halting problem -- impossible. The spoofing API actual

Since the spoofed data is an API, your proposed framework to "recognize spoofed settings" must solve the halting problem -- impossible. The spoofing API actually has only one requirement -- keep the app from accessing real data.