How the hell would a model training run "defend against" this approach? What would that even mean?