It comes down to which backdoored models you trust.