# Maximal Jacobian-based Saliency Map Attack

arXiv: https://arxiv.org/abs/1808.07945 · HTML: https://mlsanity.com/paper/1808.07945/

## Key facts

- Cited by 46 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 23 Aug 2018.

## Built on by (most cited first, 30 of 46)

- [Robust Machine Learning Systems: Challenges, Current Trends, Perspectives, and the Road Ahead](https://mlsanity.com/paper/2101.02559/) (2021)
- [Towards Understanding and Boosting Adversarial Transferability from a Distribution Perspective](https://mlsanity.com/paper/2210.04213/) (2022)
- [Class-Aware Robust Adversarial Training for Object Detection](https://mlsanity.com/paper/2103.16148/) (2021)
- [A Survey on Efficient Vision-Language Models](https://mlsanity.com/paper/2504.09724/) (2025)
- [Detecting Adversarial Examples by Input Transformations, Defense Perturbations, and Voting](https://mlsanity.com/paper/2101.11466/) (2021)
- [Adversarial Token Attacks on Vision Transformers](https://mlsanity.com/paper/2110.04337/) (2021)
- [Sparse Adversarial Video Attacks with Spatial Transformations](https://mlsanity.com/paper/2111.05468/) (2021)
- [Adversarial Laser Spot: Robust and Covert Physical-World Attack to DNNs](https://mlsanity.com/paper/2206.01034/) (2022)
- [Adversarial Color Film: Effective Physical-World Attack to DNNs](https://mlsanity.com/paper/2209.02430/) (2022)
- [Launching Adversarial Attacks against Network Intrusion Detection Systems for IoT](https://mlsanity.com/paper/2104.12426/) (2021)
- [Get your Foes Fooled: Proximal Gradient Split Learning for Defense against Model Inversion Attacks on IoMT data](https://mlsanity.com/paper/2201.04569/) (2022)
- [Scale-free and Task-agnostic Attack: Generating Photo-realistic Adversarial Patterns with Patch Quilting Generator](https://mlsanity.com/paper/2208.06222/) (2022)
- [Patch Shortcuts: Interpretable Proxy Models Efficiently Find Black-Box Vulnerabilities](https://mlsanity.com/paper/2104.11691/) (2021)
- [Adversarial Zoom Lens: A Novel Physical-World Attack to DNNs](https://mlsanity.com/paper/2206.12251/) (2022)
- [Red-Teaming Segment Anything Model](https://mlsanity.com/paper/2404.02067/) (2024)
- [Breach in the Shield: Unveiling the Vulnerabilities of Large Language Models](https://mlsanity.com/paper/2504.03714/) (2025)
- [A Tutorial on Adversarial Learning Attacks and Countermeasures](https://mlsanity.com/paper/2202.10377/) (2022)
- [JMA: a General Algorithm to Craft Nearly Optimal Targeted Adversarial Example](https://mlsanity.com/paper/2401.01199/) (2024)
- [Unsupervised Robust Domain Adaptation: Paradigm, Theory and Algorithm](https://mlsanity.com/paper/2511.11009/) (2025)
- [AdvMono3D: Advanced Monocular 3D Object Detection with Depth-Aware Robust Adversarial Training](https://mlsanity.com/paper/2309.01106/) (2023)
- [Self-supervised Adaptive Pre-training of Multilingual Speech Models for Language and Dialect Identification](https://mlsanity.com/paper/2312.07338/) (2023)
- [GenoArmory: A Unified Evaluation Framework for Adversarial Attacks on Genomic Foundation Models](https://mlsanity.com/paper/2505.10983/) (2025)
- [Robustness-via-Synthesis: Robust Training with Generative Adversarial Perturbations](https://mlsanity.com/paper/2108.09713/) (2021)
- [Adversarial Color Projection: A Projector-based Physical Attack to DNNs](https://mlsanity.com/paper/2209.09652/) (2022)
- [Adversarial Catoptric Light: An Effective, Stealthy and Robust Physical-World Attack to DNNs](https://mlsanity.com/paper/2209.11739/) (2022)
- [Imperceptible Adversarial Attack on Deep Neural Networks from Image Boundary](https://mlsanity.com/paper/2308.15344/) (2023)
- [Detecting and Mitigating DDoS Attacks with AI: A Survey](https://mlsanity.com/paper/2503.17867/) (2025)
- [Fast Approximate Spectral Normalization for Robust Deep Neural Networks](https://mlsanity.com/paper/2103.13815/) (2021)
- [Signal Transformer: Complex-valued Attention and Meta-Learning for Signal Recognition](https://mlsanity.com/paper/2106.04392/) (2021)
- [Impact of Scaled Image on Robustness of Deep Neural Networks](https://mlsanity.com/paper/2209.02132/) (2022)

## Abstract (arXiv)

The Jacobian-based Saliency Map Attack is a family of adversarial attack methods for fooling classification models, such as deep neural networks for image classification tasks. By saturating a few pixels in a given image to their maximum or minimum values, JSMA can cause the model to misclassify the resulting adversarial image as a specified erroneous target class. We propose two variants of JSMA, one which removes the requirement to specify a target class, and another that additionally does not need to specify whether to only increase or decrease pixel intensities. Our experiments highlight the competitive speeds and qualities of these variants when applied to datasets of hand-written digits and natural scenes.