> Does this somehow smuggle the training dataset back into the VM?

Turns out you were right about this: http://www.tesio.it/2021/09/01/a_decompiler_for_artificial_n...

Obviously I was not aware of this, so the whole decompilation process was a waste of computation time, but it doesn't prove nor disprove anything about the "model"'s relation with the source dataset.