You're putting a lot of trust in uncorrupted, untrusted, unknown models (potentially).