Well, you can at least check if there is network traffic to AWS or something similar.

But wouldn't that look the same as actually querying the model? Or am I missing the joke?

There’s always ways to mitigate malicious behaviour once it’s already happening.