The classifier is separate from the model and it's not capable of any of that nuance, it's just tuned to reject anything looking like a CoT jailbreak and not care about false positives. (which is funny because there still are easy ways to leak the raw CoT and train on it to your heart's content)