Why not just distribute the refusal vectors and do it at runtime against the stock model?