> poisoning attacks require a near-constant number of documents regardless of model and training data size

I fear this takeaway could be misinterpreted by non-experts.

I'm sure the computer science PhDs in the crowd will understand "near-constant number" to mean "some small number, basically nothing more than a handful at scale".

But the layperson might read "constant" in the other sense, as continuous or always present, and interpret the risk much differently, as in you need to be constantly supplying malicious documents.

I would urge them to use different terminology.