

I… have my doubts. I do not doubt that a wider variety of poisoned data can improve training, by implementing new ways to filter out unusable training data. In itself, this would, indeed, improve the model.
But in many cases, the point of poisoning is not to poison the data, but to deny the crawlers access to the real work (and provide an opportunity to poison their URL queue, which is something I can demonstrate as working). If poison is served instead of the real content, that will hurt the model, because even if it filters out the junk, it will have access to less new data to train on.

It was the night of December 24th, 1996. I turned on the family PC, then running Win95, and found my D:\ drive corrupted. Windows had no tools nor docs how to resurrect a corrupted filesystem. I cried, and two days later installed SuSE on a spare disk.
Some 20 years later, I restored about half of the disk lost in 1996, because Linux had the tools, and the docs, and encouraged me to learn.