what the judge sees is all public record, and can be appealed up the chain, and ultimately overridden by a pardon.

for a model, we would need all the training data, training method, fine tuning, etc to all be public record, along with all of the operations at inference time.

Indeed they can but they are in some ways like an individual model per judge, albeit with a sub-optimal interface and very slow, but at least they are hard to game in mass.