[computably]

LLM output is non-deterministic. Even if the attack fails 50% or even 99.9% of the time, at YT's scale it's a pretty huge issue.