I'm curious how the system detects "unusual build patterns". I.e. how would the xz backdoor be identified? Does the system have logic like "the build should no

I'm curious how the system detects "unusual build patterns". I.e. how would the xz backdoor be identified? Does the system have logic like "the build should not us binary bits already in the repo"? Or it's even more specific , like "all build files must come from a single directory? If it's more generic, how does it work?