The client could in theory see the javascript running and detect this.