If you read through the paper this looks like a total nothingburger. They get the training data for the LLM they use for activity classification from the target system. Unless you give advertises labeled activity data from your system, the attack will not be possible as demonstrated.