This sort of technology only works for a particular training of a particular neural net. Text recognition of a fixed font is easy enough that I'm sure there ar

This sort of technology only works for a particular training of a particular neural net. Text recognition of a fixed font is easy enough that I'm sure there are several different competing readers. Defeating even one of them requires having access to its inference results. Defeating all of them simultaneously is almost certainly infeasible, even if you did have its inference results available.