It just compares expected checksum from rpm database with actual state in the system.

That said, rpm supports package signing, so that it can catch a package which was tampered with and prevent it's installation.