Supplementary material for "GAMA: Generative Adversarial Multi-Object Scene Attacks "

We also demonstrate GAMA's transfer attack strength in comparison to prior methods under difficult black-box transfer attacks including in different multi-label distribution, object detection, and robustness of This can be seen in above embedding visualizations where GAMA's Surrogate and victim models are given in parenthesis. As can be seen in Table 3 and Table 4 (ensemble denoted as All), we do not observe any significant advantage in results when using multiple surrogates. GAMA is better than prior methods even when the victim pre-processes the perturbed image. We evaluated CLIP (as a "zero-shot prediction" model) on the perturbed images from Pascal-VOC and computed the top two associated labels in Figure 2 using CLIP's image-text aligning property. Pascal-VOC and computed the top-2 associated labels both for clean and perturbed images.