Clean data, dirty model: behaviors don't respect your dataset boundaries

The uncomfortable part of red-teaming isn't finding the bad behavior. It's grepping every document...