Demo
The video below shows black box attack attack being carried out in presence of background noise with the target phone kept at a distance on 10.1 ft away from the speakers used to play the attack audio.
Note on Priming Effects
The understanding of attack commands by a human listener is subject to priming effects: when we already know the actual message embedded in an obfuscated command, we unconsciously "hear" that message in the noise. This effect is so extreme that we can even "hear" primed messages when no such message actually exists; see, for example, Sounds you can't Unhear.