This is basically unsolvable except by secure containerisation because of the fact that the models themselves are very much a black box. You can’t protect what you can’t understand, except by putting it in an impenetrable cage.