An attacker controls the majority of the hashing power and wants to double spend without arousing suspicion. If they mirror the public chain's activity while generating the private fork and the fork is short (say 10 blocks), can you only detect the double spend by verifying the block hashes haven't changed or noticing the double spend transaction directly?