DeepFool is an adversarial attack that finds the minimum perturbation needed to cross the decision boundary — iteratively linearizing the decision boundary and computing the closest point on it, producing minimal-norm adversarial perturbations.

How DeepFool Works

• Linearize: Approximate the decision boundary as a hyperplane at the current point.
• Project: Compute the minimum-distance projection onto the linearized boundary.
• Step: Move the input to the projected point (crossing the approximate boundary).
• Iterate: Re-linearize and project again until the actual decision boundary is crossed.

Why It Matters

• Minimal Perturbation: DeepFool finds near-minimal adversarial perturbations — quantifies the actual robustness margin.
• Robustness Metric: The average DeepFool perturbation size is a measure of model robustness.
• $L_2$ Focus: Primarily designed for $L_2$ perturbations, extensions exist for other norms.

DeepFool is finding the closest adversarial example — computing the minimum perturbation needed to cross the decision boundary.