JSMA (Jacobian-based Saliency Map Attack) is a targeted $L_0$ adversarial attack that greedily selects the most effective pixels to modify — using the Jacobian matrix of the network to compute a saliency map that ranks features by their impact on changing the classification.

How JSMA Works

• Jacobian: Compute $J = partial f / partial x$ — the Jacobian of the output with respect to the input.
• Saliency Map: For each feature, compute how much it increases the target class AND decreases other classes.
• Greedy Selection: Select the feature pair with the highest saliency score.
• Modify: Increase the selected features to their maximum value. Repeat until the target class is predicted.

Why It Matters

• Targeted: JSMA produces targeted adversarial examples (changes prediction to a specific class).
• Sparse: Modifies very few features — producing minimal $L_0$ perturbations.
• Interpretable: The saliency map shows exactly which features are most vulnerable to manipulation.

JSMA is surgical pixel modification — using the Jacobian saliency map to identify and modify the minimum number of pixels for a targeted misclassification.