deepfool

**DeepFool** is an **adversarial attack that finds the minimum perturbation needed to cross the decision boundary** — iteratively linearizing the decision boundary and computing the closest point on it, producing minimal-norm adversarial perturbations. **How DeepFool Works** - **Linearize**: Approximate the decision boundary as a hyperplane at the current point. - **Project**: Compute the minimum-distance projection onto the linearized boundary. - **Step**: Move the input to the projected point (crossing the approximate boundary). - **Iterate**: Re-linearize and project again until the actual decision boundary is crossed. **Why It Matters** - **Minimal Perturbation**: DeepFool finds near-minimal adversarial perturbations — quantifies the actual robustness margin. - **Robustness Metric**: The average DeepFool perturbation size is a measure of model robustness. - **$L_2$ Focus**: Primarily designed for $L_2$ perturbations, extensions exist for other norms. **DeepFool** is **finding the closest adversarial example** — computing the minimum perturbation needed to cross the decision boundary.