The results are listed in Table 1 , where "Baseline" refers to the plain end-toend speech recognition framework as described in Sec. 2.3, "+LM" refers to the shallow fusion decoding with a separately trained RNN language model (RNN-LM)<cite> [13,</cite> 20] and "+AT" refers to the adversarial training proposed here.