# You Only Attack Once: Single-Step DeepFool Algorithm
## 4 Experiments
### Experimental Results  
#### 4.4.1 Experimental Comparison with Classical Algorithms  
As shown in Table 1, we conducted a comparative analysis of various adversarial attack algorithms to assess their efficacy in classification tasks. The algorithms under consideration include PGD (Projected Gradient Descent) [26], FGSM (Fast Gradient Sign Method) [7], BIM (Basic Iterative Method) [27], FFGSM (Fast Fourier Gradient Sign Method) [28], APGD (Adaptive Projected Gradient Descent) [29], SparseFool [30], OnePixel [31], Pixel [32], PIFGSMPP (Patch-based Iterative Fast Gradient Sign Method with Patch Prior) [33], and DeepFool [5]. These algorithms encompass a spectrum of adversarial attack strategies, ranging from gradient-based methods to iterative approaches, as well as techniques leveraging image patches and sparsity. The selection of these algorithms is justified by their distinct attack mechanisms and their significant impact within the academic community, allowing us to challenge and evaluate the robustness of classification models from multiple perspectives. Through these comparative experiments, we aim to gain a comprehensive understanding of the effectiveness of different attack strategies and to provide valuable insights for enhancing model robustness. We trained a classifier with an accuracy rate of 60% on the CIFAR dataset. It can be observed that the performance of various adversarial attack algorithms is high. Our YOAO algorithm ranked second, surpassing the DeepFool algorithm, and was only next to the PIFGSMPP algorithm. On the other hand, we trained a classifier on the MNIST dataset to achieve an accuracy rate of 99%. Interestingly, when the classifier accuracy is high, the success rate of adversarial attack algorithms significantly decreases. However, both the proposed algorithm and the Pixel algorithm maintained high attack success rates on high-accuracy classifiers. Compared to the Pixel algorithm, our method generates each adversarial sample image in just 0.091 s, making it 7.9 times faster. This demonstrates significant progress in both efficiency and attack performance of the proposed algorithm. 4.2 Performance Comparison Between the YOAO (You Only Attack Once) Algorithm and the DeepFool Algorithm  
As shown in Figure 4, based on the data presented in Figure 4,b, it is observed that the proposed algorithm (YOAO) exhibits an increase in the time required to generate a single adversarial sample as the maximum number of iterations increases, relative to the original DeepFool algorithm. Further observation of Figure 4c,d reveals that the algorithm maintains a high attack success rate across different maximum iteration settings. Particularly noteworthy is that, in the case of a single iteration, the algorithm achieves a higher attack success rate compared to the original algorithm, which is one of the reasons why we named the proposed algorithm \"You Only Attack Once (YOAO)\". These data are sourced from the CIFAR-10 dataset, from which 500 images were selected for experimentation, leading to the aforementioned conclusions. These results demonstrate that the YOAO algorithm has more efficient and effective characteristics than the traditional DeepFool algorithm when generating adversarial examples. By dynamically selecting the gradient update direction for each input data and reducing the search space, The YOAO algorithm can quickly find perturbations that cause misclassification to the target class.