Geometry Is Not Robustness: A Trajectory-Level Study of PGD Evaluation | RISE Research

This paper investigates whether trajectory-level diagnostics of Projected Gradient Descent (PGD) adversarial attacks, beyond just final adversarial accuracy, reliably indicate a deep learning model's true robustness. The authors train a compact CNN on Fashion-MNIST under three regimes (clean training, and adversarial training at perturbation budgets epsilon = 0.1 and epsilon = 0.2), then record complete 20-step PGD attack trajectories across 3,000 clean-correct samples per model, analyzing loss evolution, gradient cosine-similarity (directional stability), and steps-to-failure (the iteration at which a model's prediction first flips). The clean-trained model collapses immediately under attack (0% robust accuracy), while the two adversarially trained models diverge sharply in robust accuracy at epsilon = 0.2 (8.35% vs. 68.24%) despite showing nearly identical mean loss trajectories and, in one case, counterintuitively lower early-step gradient alignment for the more robust model. This finding reveals that smooth, stable-looking optimization geometry, as captured by loss curves and gradient alignment, does not reliably track functional robustness strength. By contrast, steps-to-failure distributions clearly separated the three robustness regimes, since they directly measure how long a model resists perturbation rather than describing the smoothness of the attack path. The paper concludes that trajectory-level diagnostics offer valuable descriptive insight into adversarial optimization dynamics but should not replace, and can actively mislead if substituted for, standard robust-accuracy evaluation; researchers should treat trajectory metrics as a complementary, multi-metric diagnostic tool rather than a standalone robustness proxy. The study is limited to a single dataset and compact architecture, and suggests future work incorporate stronger ensemble attacks like AutoAttack for further validation.