> It’s at the very least harder to hide things like that if all the source is available.

[1] https://www.pure.ed.ac.uk/ws/portalfiles/portal/256761768/Ma...

You can get all the source to validate training and weights and still end up with adversarial behavior in the model.