Collision should be done server side, there you go. Besides you could add a crc check on the model files to see if it has been edited. There're ways to solve that "problem" but then again protecting models isn't hard to crack, too.