Phantom Transfer: Data-level Defences are Insufficient Against Data Poisoning