Geometry Is Not Robustness: A Trajectory-Level Study of PGD Evaluation
PGD trajectory-level diagnostics (loss evolution, gradient alignment, steps-to-failure) do not uniformly correlate with adversarial robustness strength Mean loss trajectories and gradient alignment patterns are quantitatively similar across adversarially-trained models with substantially different robust accuracies Steps-to-failure distributions provide the clearest separation of robustness regimes, directly reflecting functional resistance to adversarial perturbation Trajectory-level diagnostic
Analysis
TL;DR
- PGD trajectory-level diagnostics (loss evolution, gradient alignment, steps-to-failure) do not uniformly correlate with adversarial robustness strength
- Mean loss trajectories and gradient alignment patterns are quantitatively similar across adversarially-trained models with substantially different robust accuracies
- Steps-to-failure distributions provide the clearest separation of robustness regimes, directly reflecting functional resistance to adversarial perturbation
- Trajectory-level diagnostics describe optimization geometry but cannot independently measure adversarial robustness
- These diagnostics should serve as complementary tools interpreted in context, not replacements for standard robustness measurements
Why It Matters
This research challenges a growing trend in adversarial robustness evaluation where trajectory-level diagnostics are increasingly used as proxies for robustness assessment. For AI practitioners and researchers, it underscores that intuitive geometric interpretations of attack dynamics can be misleading, and robustness claims based solely on trajectory metrics may overstate a model's actual adversarial resilience.
Technical Details
- The study evaluates PGD attacks on convolutional neural networks trained on Fashion-MNIST, comparing clean-trained and adversarially-trained models across multiple robustness regimes
- Rigorous 20-step PGD evaluations with random initialization and multiple restarts were used for robustness measurement, while single-initialization trajectory recording was employed for diagnostics
- Full PGD trajectories were recorded across 3000 clean-correct samples per model, analyzing loss evolution, gradient alignment, and failure timing across attack iterations
- Three trajectory-level metrics were examined: mean loss trajectories, gradient alignment patterns, and steps-to-failure distributions
- The key finding was a dissociation between geometric trajectory properties and actual robustness, with steps-to-failure emerging as the most discriminative metric
Industry Insight
- Researchers should avoid relying on any single trajectory-level diagnostic as a standalone robustness indicator; multi-metric evaluation combined with standard adversarial accuracy remains essential
- The findings suggest that adversarial training regimes producing similar optimization geometry may still yield vastly different robustness outcomes, warranting more nuanced evaluation protocols
- Future work on adversarial robustness diagnostics should prioritize metrics that capture functional resistance (like steps-to-failure) over those describing pure optimization geometry
Disclaimer: The above content is generated by AI and is for reference only.