How do we know this is leakage and not just a hallucination of the format the prompt is clearly expecting?