In the linked paper [0], they actually tested that point: after applying Gaussian noise to samples, the model could still recognize them half the time[1], despite being nearly unreadable (to me).

[0] http://cs.nyu.edu/~zaremba/docs/understanding.pdf [1] http://puu.sh/9B4eG/1e9f7eb56b.png