All the attacker will do is to create is own byteball network fork that everybody will ignore.
With social engineering (sockpuppeting on BTT, for example) "everybody" will be changed to "some".
That's what I think. And the main chain will follow the 'fork' because of the number of units inside (and then the honestly posted units - with good witnesses - will no longer be selected on the subsequent main chain)
This is definetly an issue to be cleared,
Such an event already happened on the network, isnt anyone else looking at the db/network? It was too expensive, as expected, and costs would increase to maintain the attack for longer. Nobody even noticed "the attack".
Read the whitepaper, witnesses cant be replaced just by flooding.
Its similar to CfBs, "hurr durr Im gonna flood your db with messages hurr".