I think it works by labelling something like half the images, but doesn't tell you which is which. At least that's how the older text recaptcha stuff worked - you could easily identify the pre-labelled text by the kind of distortions they used and just enter any old gibberish for the rest. So actually the training stuff is extra work beyond just classifying you as human

By showing the same images to thousands of other people and going with the consensus, I imagine. For any given label, if you pick a photo that few other people picked, it presumably considers that to be "wrong."

And would it be possible to sabotage via a botnet that submits all-incorrect responses?