No, it wouldn’t, and the paper shows no such thing. Nightshade isn’t “Gaussian blur + sharpen.” It’s based on the use of a different diffusion model to perturb an image (with bounded difference in perceptual similarity) to minimize the distance of the embedding from that of an unrelated concept. It is mathematically optimized and highly specific to the prompt. The clever thing is that you don’t need access to the actual original text-to-image feature extractor because of the transferability between models, and the surprising thing is how few poisoned samples are required to break a model.