They work because they trick the model into thinking the object of the image is something that it's actually not. They do this by exploiting the fact that image classification models output the "most likely" object, and blurring the image removes features that are true to the real object.
spam fails_task lang_mismatch pii not_appropriate hate_speech sexual_content quality toxicity humor helpfulness creativity violence