jsma

**JSMA** (Jacobian-based Saliency Map Attack) is a **targeted $L_0$ adversarial attack that greedily selects the most effective pixels to modify** — using the Jacobian matrix of the network to compute a saliency map that ranks features by their impact on changing the classification. **How JSMA Works** - **Jacobian**: Compute $J = partial f / partial x$ — the Jacobian of the output with respect to the input. - **Saliency Map**: For each feature, compute how much it increases the target class AND decreases other classes. - **Greedy Selection**: Select the feature pair with the highest saliency score. - **Modify**: Increase the selected features to their maximum value. Repeat until the target class is predicted. **Why It Matters** - **Targeted**: JSMA produces targeted adversarial examples (changes prediction to a specific class). - **Sparse**: Modifies very few features — producing minimal $L_0$ perturbations. - **Interpretable**: The saliency map shows exactly which features are most vulnerable to manipulation. **JSMA** is **surgical pixel modification** — using the Jacobian saliency map to identify and modify the minimum number of pixels for a targeted misclassification.