PGD Trajectory Metrics Don't Directly Measure Adversarial Robustness

Researchers conducted a detailed trajectory-level study of Projected Gradient Descent (PGD) attacks, a common method for evaluating adversarial robustness in neural networks. The goal was to determine if diagnostics like loss evolution, gradient alignment, and steps-to-failure, which provide deeper insights into adversarial optimization dynamics, reliably indicate a model's robustness strength. The study compared clean-trained and adversarially-trained convolutional neural networks on Fashion-MNIST across various robustness regimes. The findings revealed a clear hierarchy of robustness among the models. However, the trajectory metrics did not contribute equally to identifying this hierarchy. Specifically, mean loss trajectories and gradient alignment patterns appeared quantitatively similar across adversarially-trained models that actually possessed substantially different robust accuracies. In contrast, the distribution of "steps-to-failure" provided a much clearer distinction between robustness regimes, directly reflecting how resistant a model was to adversarial perturbations. This suggests that while trajectory-level diagnostics describe the optimization geometry, they should be interpreted as complementary tools within a multi-metric evaluation, rather than standalone measures of adversarial robustness.