# You Only Attack Once: Single-Step DeepFool Algorithm
## 3 Method
### Algorithm Improvement
Figure 3: In this process, \(x_{0}\) denotes the original sample point, with the blue region representing the original class and the pink region indicating other classes. Sample poiSts \(x_{1}\) and \(x_{2}\) are situated in regions corresponding to classes other than the original sample class, and they represent samples from distinct classes. By identifying the decision boundary closest to the sample point as the direction for the proposed algorithmic iteration, we aim to expedite the generation of adversarial samples. The perturbation direction is computed using the following formula:  
\[sign(\Delta_{c,\hat{c}}(x))=\frac{\Delta_{c,\hat{c}}(x)}{\parallel\Delta_{c,\hat {c}}(x)\parallel} \tag{3}\]  
where \(\Delta_{c,\hat{c}}(x)\) represents the difference in the gradient between the current class \(\hat{c}\) and the original class \(c\) for input \(x\), and \(\parallel\Delta_{c,\hat{c}}(x)\parallel\) denotes its norm. The formula for determining the direction of perturbation in the adversarial optimization process is as follows:  
\[r_{i}=r_{i\text{-}1}\times sign(\Delta_{c,\hat{c}}(x)) \tag{4}\]  
In Equation (4), the variable \(r_{i}\) signifies the perturbation at the the \(i\)-th iteration, while \(r_{i\text{-}1}\) represents the perturbation at the \((i-1)\)-th iteration. We can restate the optimization problem as follows:  
\[ \begin{split}\text{minimize}&\|r\|_{2}\\ \text{subject to}& f(x+r)\
eq f(x)\\ \|r\|_{2}\leq\epsilon\\ r=-\alpha\cdot\text{sign}(\Delta_{c,\hat{c}}(x))\end{split}  \tag{5}\]  
where \(\|r\|_{2}\) represents the Euclidean norm (L2 norm) of the perturbation \(r\), which indicates the magnitude of the perturbation. \(f(x+r)\
eq f(x)\) is a constraint that ensures the perturbed sample has a different classification result from the original sample. \(\|r\|_{2}\leq\epsilon\) is another constraint that ensures the magnitude of the perturbation \(r\) is within a pre-defined threshold \(\epsilon\), which defines the \"smallness\" of the perturbation. In Equation (2), \(\Delta_{c,\hat{c}}(x)\) represents the difference between the gradients of the original class \(c\) and the current class \(\hat{c}\). \(\alpha\) is a scalar that controls the step size or magnitude of the perturbation. In Equation (3), \(\text{sign}(\Delta_{c,\hat{c}}(x))\) ensures that the direction of the perturbation is aligned with the gradient difference direction. As shown in Algorithms 1 and 2, by introducing a single-step iterative generation scheme, we successfully eliminated the cumbersome loop structure in the algorithm. Specifically, we streamlined the loop condition in line 5 and the loop in line 6 of the original DeepFool algorithm, no longer tediously calculating gradient information for the top \(n\) non-target classes with the highest probabilities. Instead, we directly compute gradients for the class that exhibits the maximum gradient difference from the original class, thereby significantly reducing the time complexity. This step is crucial as it provides us with the most sensitive class information regarding the input sample. Subsequently, we utilize the gradient information \(w\) and confidence information \(f\) of this class to perform iterative calculations. This process not only enhances the efficiency of the algorithm but also ensures that we can accurately pinpoint the sample points that have the most significant impact on classification decisions. This enhancement has endowed the proposed algorithm with the ability to rapidly and efficiently obtain adversarial samples, even when limiting the maximum number of iterations to 1. ```
1:procedureDeepFool(\(x,f\))
2:Input: Image \(x\), classifier \(f\). 3:Output: Perturbation \(\hat{r}\). 4:Initialize:\(x_{0}\gets x,i\gets 0\).