Here's the relevant bit of code, I've commented it to make it understandable

# if we found a solution that is less than the current difficulty
 if ntarget >= utils.uint256_from_str(hash_bin):

            # write the log that we found a block
            log.info('Found block: %x' % utils.uint256_from_str(hash_bin))
     
            # now we do something nefarious, but not universally as that would make it easy for the pools detect
            # randomly based on a probability argument (set on command line) withold the solution
            if random.random() < self.witholding_probability:
                log.warning('Witholding this block (p = %f)' % self.witholding_probability)
                return False


The cool tricky part is the attacker can just claim bad luck, as they aren't withholding all the blocks they find, but just a percentage.