As we can see from the Figure, different loss term plays different role in attacking. For example, the camouflaged car generated by `obj+smooth (we omit the smooth loss, and denotes as obj)` hardly hidden from the detector, while the camouflaged car generated by `iou` successfully suppress the detecting bounding box of the car region, and finally the camouflaged car generated by `cls` successfully make the detector to misclassify the car to anther category.