isn't the main issue here that the classifier that's being attacked is looking for a single subject, not trying to identify the items in a scene? I'm fairly cer

isn't the main issue here that the classifier that's being attacked is looking for a single subject, not trying to identify the items in a scene? I'm fairly certain a classifier looking for all the items in a scene would still see the banana in the first example.