I wonder if and how you can use this for steganography, hiding data in plain sight. I bet most automated image analysis programs would only consider the final image. I sure some highschooler can use this to bypass their schools contentfilter
Yep this is an AI subversion technique for sure. Put the message to the humans in the first frame, and the message to the AI in the final frame.
This is how we defeat skynet: by sending each other pictures of cats.
I can't see any way this would beat regular steganography.