The model supply chain.
Vetting what you import.

Start with the honest boundary, because a framework that promises more than it delivers is worse than none. For frontier-class models you cannot audit training data — open or closed, of any origin. A handful of fully open research models publish their data; none of the frontier models do. Anyone offering that assurance for a frontier model is describing something that does not exist. If your threat model genuinely requires provenance of training data, no current model satisfies it and the conversation is about whether to deploy at all.

What you can do is substantial and is what a defensible assessment consists of: pin a specific artefact and verify its hash; know who produced it and under what licence; test its behaviour against your own material including the cases you are worried about; control where it runs and what it can reach; and detect if any of that changes. That is a real assurance posture and it is typically achievable in a couple of weeks.

This usually arrives about models of Chinese origin and it deserves a structured answer rather than either dismissal or alarm. Separate it into three, because they have different answers.

Data transfer — closed completely by self-hosting. Weights are a file; they transmit nothing, and on an isolated network they could not — provided you also review any code shipped alongside them. This is the question people most often mean and the one most easily resolved.

Behaviour — testable on your own material, and workload-dependent. Every model from every jurisdiction has been aligned by someone with a view; the differences are measurable and for most business tasks immaterial. Test rather than assume, in either direction.

The artefact itself — partially assurable, as set out above, and no more or less so than for any other model. This is where the honest answer is uncomfortable and where it is identical regardless of origin.

And where an organisation has a standing policy on model origin, that policy is the answer. It is a governance decision owned by people who own the risk, and our job is to build within it rather than to argue against it.