This obviously stops working as soon as you don't have the entire context. To reliably detect a subset of the LLM's output you need to do something more sophisticated but also more invasive.