It depends. But poisoned images fed into a vulnerable training setup will scramble the output and make the model pretty useless.