The paper's abstract itself says that behavior can be encrypted such that it remains opaque even with full access to model weights.
dataset != model weights