Poison works by being able to scale its impact dramatically: attacking chemical cornerstone processes, disabling a receptor, etc. ML is, to simplify, a statist

Poison works by being able to scale its impact dramatically: attacking chemical cornerstone processes, disabling a receptor, etc. ML is, to simplify, a statistical process that tries to identify probability distributions. That implies they’d have to purposefully degrade large amounts of images that the system has access to. Unless those images are impossible to distinguish from the others (because, say, they come from the same sites) I’m not sure how they’d do it consistently. They could mark sources, by using an unused combination of keywords and having a unique image attached to it, but poisoning—at scale? I’m not seeing a stable equilibrium where that’s possible.