A trained network should be considered compiled code. It's almost literally a circuit wiring diagram, the lowest level of all code representations.
Arguably the "source" in this case is the dataset used to train the model, along with the learning algorithm. If the data are released, so that you can inspect them and replicate the network weights yourself with an off-the-shelf learner, that's a reasonably good sign that nothing nefarious is going on inside the system. (though not strictly a guarantee: you could imagine someone searching very hard to find an innocuous-looking training set that somehow encodes malicious behavior)
Arguably the "source" in this case is the dataset used to train the model, along with the learning algorithm. If the data are released, so that you can inspect them and replicate the network weights yourself with an off-the-shelf learner, that's a reasonably good sign that nothing nefarious is going on inside the system. (though not strictly a guarantee: you could imagine someone searching very hard to find an innocuous-looking training set that somehow encodes malicious behavior)