The differences between the attackers in the definitions of IND-ATK and NM-ATK I read the definitions of IND-ATK and NM-ATK in a paper. Let $\Pi = \left( Gen, Enc, Dec \right)$ be a public key scheme. And let $A = \left( A_{1}, A_{2} \right)$ be an adversary attacking $\Pi$ in the sense of IND-ATK. Let $B = \left(B_{1}, B_{2} \right)$ be an adversary attacking $\Pi$ in the sense of NM-ATK.

The inputs of $A_{1}$ and $B_{1}$ are both the public key $pk$. The output of $A_{1}$ is $(x_{0}, x_{1}, s_{A} )$ but the one of $B_{1}$ is $(M, s_{B})$.

What makes the outputs different? Why not the output of $B_{1}$ just includes two messages instead of a set of messages?

Actually, $A_{2}$ and $B_{2}$ are both used to compare two messages in some sense.
You say:


  Actually, $A_2$ and $B_2$ are both used to decide which one of two
  messages are encrypted for the challenge.


However, this is not true. The definition of the IND and NM games are different. This difference is summarized in this paragraph from the very same paper [Section 2.3]:


  The goal of the adversary, given a ciphertext y, is not (as with
  indistinguishability) to learn something about its plaintext $x$, but
  only to output a vector $\mathbf y$ of ciphertexts whose decryption $\mathbf x$ is
  “meaningfully related” to $x$, meaning that $R(\mathbf x, x)$ holds for some
  relation $R$.