From my understanding of the article, it's more about associating misleading terms with images to confuse the associations learned by the model. I didn't see anything in the article about some sneaky way of tainting images themselves unless it means a server is serving bogus images when a client fails the "are you a robot" test.

Curious to learn if anyone knows more about what it's actually doing.