The harmful completions are not published: a model that complies with 81 percent of harmful requests produces actionable content, and publishing it would demonstrate the attack rather than the defense.
Reviewers can request them. The public manifest lists the SHA-256 of every file, including the withheld ones, so whatever you receive can be checked against it.
curl https://tomscot-keel.hf.space/manifest.json
Requests are logged with a timestamp and an id. Approved reviewers receive a bundle with generic file names, checkable against the public manifest.