I'd say the second chapter will be something like "the implications of adversarial examples on the theory of learning"

In other-words, making the argument that adversarial examples show it is the properties of the datasets on which algorithms operate rather than the properties of those algs which cause ML to succeed/fail

This is the kind of stuff I had in mind when making the suggestion about sabotage:

https://arxiv.org/abs/2204.06974