I think it's unlikely that the noise will generally have any relation to the target class. I can't find anywhere they say exactly which attack method they use,

I think it's unlikely that the noise will generally have any relation to the target class. I can't find anywhere they say exactly which attack method they use, so it's hard to say for certain, but all of the attacks I'm aware of don't generate noise that has any human-interpretable structure. See for example Figure 1 in the seminal paper on adversarial attacks: https://arxiv.org/pdf/1412.6572.pdf https://arxiv.org/pdf/1412.6572.pdf