# The differences between the attackers in the definitions of IND-ATK and NM-ATK

I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in the sense of IND-ATK. Let $B = \left(B_{1}, B_{2} \right)$ be an adversary attacking $\Pi$ in the sense of NM-ATK.

The inputs of $A_{1}$ and $B_{1}$ are both the public key $pk$. The output of $A_{1}$ is $(x_{0}, x_{1}, s_{A} )$ but the one of $B_{1}$ is $(M, s_{B})$.

What makes the outputs different? Why not the output of $B_{1}$ just includes two messages instead of a set of messages?

Actually, $A_{2}$ and $B_{2}$ are both used to compare two messages in some sense.

Actually, $A_2$ and $B_2$ are both used to decide which one of two messages are encrypted for the challenge.
The goal of the adversary, given a ciphertext y, is not (as with indistinguishability) to learn something about its plaintext $x$, but only to output a vector $\mathbf y$ of ciphertexts whose decryption $\mathbf x$ is “meaningfully related” to $x$, meaning that $R(\mathbf x, x)$ holds for some relation $R$.
• emm, it seems that I express wrong, I mean $A_2$ is used to decide which one of two is encrypted, and $B_2$ is used to decide which one of two is related. It is enough to give $B_2$ two message, instead of a set $M$. Commented Nov 10, 2017 at 2:43