# You Only Attack Once: Single-Step DeepFool Algorithm
## 3 Method
### Algorithm Improvement  
Search for the Sample Point Closest to the Decision Boundary  
The core idea of the DeepFool algorithm is to find the adversarial examples that are closest to the classification boundary. In this work, the proposed algorithmic improvements to the DeepFool algorithm enhance its efficiency in finding adversarial examples and constructing effective universal perturbations. We proposed improvements to the iterative process for finding the sample point closest to the decision boundary. In each iteration step, we calculate the gradient information of the input sample with respect to each class, quantifying the sensitivity of each class to small  
Figure 2: Data space distribution. This figure illustrates the existence of adversarial examples. The red data points represent positive samples, the blue data points represent negative samples, and the green curve represents the decision boundary of the classifier. In the data distribution, the samples above the decision boundary are classified as positive, while those below are classified as negative. Upon examining the figure, we can observe the presence of some negative samples near the decision boundary, indicating samples where data points originally classified as negative are misclassified as positive by the classifier. changes in the input sample. We then compare the gradient differences between different classes to identify the largest one. These large gradient differences typically indicate that the decision boundary for these classes is more sensitive to the input sample. Therefore, searching along the direction of the class with the largest gradient difference can efficiently find the sample point that has a significant impact on the classification decision. Figure 3 illustrates the algorithmic process, wherein we take a three-class classification task as an example. We calculate the gradient differences between other classes and the original sample class, quantifying the sensitivity of each class to small changes in the input sample. Specifically, we determine the distances of the sample point \(x_{0}\) from the class regions where sample points \(x_{1}\) and \(x_{2}\) are located. This allows us to identify the point \(x_{1}\) that has the greatest discrepancy from the current image class. Subsequently, by computing in the direction from the original sample point \(x_{0}\) towards \(x_{1}\), we can rapidly and effectively generate adversarial samples. We improved the process of finding adversarial samples that are closest to the classification boundary in the DeepFool algorithm. In this work, we utilized gradient information by computing the gradients of the input sample with respect to each class, thereby quantifying the sensitivity of each class to small perturbations in the input sample. This information enables the identification of the class most sensitive to variations in the input samples. By comparing the gradient differences among different classes, we can more effectively search for and locate sample points that significantly impact the classification decision, thereby finding points closest to the decision boundary. Having identified sample points closest to the decision boundary, we employ a minimal number of iterations (even potentially just one iteration) to generate adversarial samples, a method referred to as \"You Only Attack Once\" (YOAO). The aim of this approach is to enhance the efficiency of finding effective adversarial samples while reducing the number of iterations required. The gradient difference between classes can be expressed as follows:  
\[\Delta_{c,\hat{c}}(x)=\
abla f_{c}(x)-\
abla f_{\hat{c}}(x) \tag{2}\]  
where \(x\) represents the original image, \(\hat{c}\) represents the current class, \(c\) represents the original class, and \(\
abla f_{\hat{c}}(x)\) represents the gradient information of input \(x\) with respect to the current class \(\hat{c}\).