It could have an attempt at steganographic watermarking trained into the model.