I wouldn't be surprised if these speech to text models are susceptible to black box attacks in the same way that image classifiers are: https://arxiv.org/abs/1605.07277