Distillation attacks. The weights are just a proof-of-work hash