It works at full resolution, but it's a cat and mouse game. If something like this becomes popular, then all that needs to be done is to start passing images through a filter first (blur, lower resolution, etc.), or just train a new vision model that can pick out both the blurred message as well as the decoy message.