# You Only Attack Once: Single-Step DeepFool Algorithm
## 2 Related Works  
### Adversarial Attacks  
Adversarial attacks can be categorized into distinct types based on various criteria. Segregated by the understanding of the model's internal architecture, they are delineated as white-box attacks and black-box attacks [6]. A white-box attack constitutes an adversarial attack algorithm that requires understanding the model's internal structure and gradients to generate adversarial samples. Conversely, a black-box attack operates without needing knowledge of the internal structure and gradient information of the targeted model. Further classification of adversarial attacks is based on whether the attack algorithm can misclassify the model into a specific class, leading to the distinction between targeted attacks and non-targeted attacks. Targeted attacks aim to misclassify input data into a specific target class by following certain constraints. In contrast, non-targeted attacks focus solely on potentially misclassifying input data without aiming for a specific target class. The defense of adversarial samples has driven the evolution of adversarial sample attacks. Likewise, ensuring the robustness and security of deep learning models requires a more powerful adversarial attack algorithm. A significant breakthrough has been achieved in uncovering vulnerabilities in multiple state-of-the-art deep neural networks (DNNs), signifying notable advancements in the domain of adversarial machine learning. Despite being trained meticulously, DNNs exhibit distinct blind spots and are vulnerable to adversarial attacks. Adversaries exploit these weaknesses to generate adversarial examples, capable of misleading machine learning models through slight alterations to the input data distribution. This intrinsic feature of DNNs is utilized in various adversarial attack algorithms to produce adversarial examples. Figure 1: Disparity between the DeepFool algorithm and the algorithm introduced in this study. Initially, a sample is classified as belonging to the “automobile” class by the classifier. Following the creation of adversarial samples using both the DeepFool and YOAO algorithms, the resulting adversarial sample is misclassified as belonging to the “ship” class by the classifier. The upper subfigure illustrates the necessity for multiple iterations by the DeepFool algorithm to progressively approach the decision boundary and generate adversarial samples. In contrast, the lower subfigure presents the YOAO algorithm introduced in this study, which requires only a single iteration to effectively generate an adversarial sample. Clearly, the YOAO algorithm notably enhances computational efficiency and practical applicability. The Fast Gradient Sign Method (FGSM), proposed by [PERSON] et al. [7], is based on the concept of gradients and can rapidly and effectively generate adversarial examples. However, this method requires the manual selection of a perturbation coefficient, leading to the addition of relatively large perturbations. The Iterative Fast Gradient Sign Method (I-FGSM), proposed by [PERSON] et al. [8], enhances the FGSM by iteratively applying perturbations, typically resulting in smaller perturbations and stronger white-box attack capabilities compared to the FGSM. However, this approach demands more computational resources and time to achieve the iterations. The Trans-IFFT-FGSM (Transformer Inverse Finite Fourier Transform Fast Gradient Sign Method), presented in the work by [PERSON] [9], incorporates multiple modules and retains input noise information, enhancing the attack success rate (ASR) with smaller perturbations, but at the cost of increased algorithm complexity and computational expense. DeepFool, proposed by [PERSON] et al. [5], aims to introduce the minimal perturbation necessary to generate adversarial examples. As a white-box untargeted attack, the fundamental concept of DeepFool involves perturbing the input image in a manner that guides it across the separating boundary.