YOPO: One-Pass Methods in AI Research

• YOPO is an acronym signifying one-pass computational strategies designed to reduce redundant processing in adversarial training, learning-based planning, LLM ensembling, visual navigation, and pose estimation.
• It replaces multi-stage, repeated inner loops with a single propagation or pass, thereby significantly lowering computation time while maintaining competitive accuracy.
• Different YOPO variants adapt the one-pass concept to domain-specific challenges, offering efficient alternatives in robust optimization, trajectory prediction, and spatial encoding.

YOPO is an overloaded research acronym rather than a single method. In the literature considered here, its earliest and most extensively analyzed meaning is “You Only Propagate Once,” an adversarial-training acceleration method that casts adversarial training as a discrete time differential game and uses the Pontryagin’s Maximum Principle to justify restricting most adversary-update computation to the first layer of the network (Zhang et al., 2019). Later work reuses the acronym for technically unrelated systems, including “You Only Plan Once” in learning-based planning, “You Only Prompt Once” in black-box LLM ensembling, “You Only Pass Once” in visual navigation from one-pass videos, and “You Only Pose Once” in monocular category-level 9D pose estimation (Wei et al., 4 May 2026, Zhang et al., 13 Mar 2025, Meegan et al., 10 Dec 2025, Lee et al., 20 Aug 2025).

1. Polysemy and nomenclature

The acronym has acquired several domain-specific expansions. The shared surface form is therefore potentially misleading unless the surrounding literature makes the intended expansion explicit.

Expansion of YOPO	Domain	Representative source
You Only Propagate Once	Adversarial training	(Zhang et al., 2019)
You Only Plan Once	Learning-based planning	(Wei et al., 4 May 2026, Cao et al., 24 May 2025)
You Only Prompt Once	Black-box LLM ensembling	(Zhang et al., 13 Mar 2025)
You Only Pass Once	Visual navigation	(Meegan et al., 10 Dec 2025)
You Only Pose Once	Monocular 9D pose estimation	(Lee et al., 20 Aug 2025)

The adversarial-training usage is the one for which the acronym itself is original in the supplied material. The later homonyms retain the “one-shot” naming pattern but correspond to independent technical programs rather than extensions of the 2019 robustness method. This suggests a broader naming convention in which “YOPO” marks an attempt to replace a repeated inner loop, multi-stage pipeline, or quadratic comparison pattern with a single-pass or amortized alternative.

2. “You Only Propagate Once” in adversarial training

In its original sense, YOPO is an acceleration method for adversarial training. The underlying robust optimization problem is the standard min-max objective

$$\min_{\theta} \mathbb{E}_{(x,y)\sim \mathcal{D}} \left[\max_{\delta \in \mathcal{S}} L(f_\theta(x+\delta), y)\right],$$

where the inner maximization is commonly approximated by multi-step PGD (Zhang et al., 2019). The computational bottleneck is that each PGD step requires a full forward and backward pass through the network to evaluate the perturbation gradient.

The central theoretical move in YOPO is to write the network as layer-wise dynamics and to analyze adversarial training as a discrete time differential game. In the layer-wise formulation, the perturbation enters only through the first transition,

$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$

and the corresponding Hamiltonian is

$$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$

The costate variables are the backward-propagated gradients. The practical consequence is that the adversary update is only coupled with the parameters of the first layer of the network, which motivates restricting most of the forward and back propagation during adversary updates to that first layer (Zhang et al., 2019).

Operationally, the network is decomposed as

$f_\theta = g_{\tilde\theta}\circ f_0,$

so that the perturbation gradient factorizes as

$$\nabla_\eta L(f_\theta(x+\eta),y) = \nabla_{f_0} L(g_{\tilde\theta}(f_0(x+\eta)),y)\cdot \nabla_\eta f_0(x+\eta,\theta_0).$$

YOPO computes the upstream gradient signal at the first-layer interface once with a full propagation, then reuses it for several cheap perturbation updates that differentiate only through the first layer. This is the literal meaning of “you only propagate once” (Zhang et al., 2019).

The original paper reports that YOPO can achieve comparable defense accuracy with approximately 1/5 ~ 1/4 GPU time of PGD. On MNIST, YOPO-5-10 attains clean accuracy 99.46%, PGD-40 robust accuracy 96.27%, and CW accuracy 93.56%, compared with 99.49%, 96.56%, and 93.52% for PGD-40. On CIFAR-10 with PreAct-Res18, YOPO-5-3 reports clean accuracy 83.99%, PGD-20 robust accuracy 44.72%, and CW accuracy 59.77%, compared with 84.82%, 41.61%, and 58.88% for PGD-10 under the reported evaluation (Zhang et al., 2019).

3. Later adversarial-training interpretations and extensions

Subsequent robustness literature places YOPO in the family of efficient adversarial training methods. The survey “Recent Advances in Adversarial Training for Adversarial Robustness” categorizes YOPO under that heading and reiterates its optimization view: from the perspective of Pontryagin’s Maximum Principle, adversarial gradients update is only related to the first layer of neural networks, so adversary computation can focus on the first layer while other layers are frozen, thereby significantly reducing the numbers of forward and backward propagation. The same survey reports a Wide ResNet result of 47.98% adversarial accuracy on CIFAR-10 under PGD$_{20}$ with $\epsilon=8/255$, and notes the YOPO authors’ claim that Free-AT is a particular case of YOPO (Bai et al., 2021).

Other papers treat YOPO as a modular acceleration primitive rather than a complete endpoint. “Amata: An Annealing Mechanism for Adversarial Training Acceleration” describes YOPO as estimating the gradient on the input by only propagating the first layer, and positions Amata as orthogonal to it: YOPO reduces the cost per inner update, whereas Amata anneals the strength of the inner maximization over training time. In the reported MNIST experiment, Amata+YOPO with $K_{\min}=2$ and $K_{\max}=5$ reaches 94% adversarial accuracy in 294 seconds, around half of the time consumed by baseline YOPO, and is also reported to achieve better adversarial accuracy when converged (Ye et al., 2020).

Theoretical comparison papers also single out YOPO because of its stationarity guarantees. “Semi-Implicit Hybrid Gradient Methods with Application to Adversarial Robustness” states that, to the authors’ knowledge, only DAT and YOPO guarantee convergence to a stationary point of the adversarial-training minimax problem. In that account, YOPO belongs to the MGDA family and is credited with an $O(1/K^{1/2})$ convergence rate for the squared saddle subdifferential norm under smoothness, local strong concavity, and bounded-variance assumptions. The same paper contrasts this with an $$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$0 rate for its proposed SI-HG method and reports that MSI-HG exceeds YOPO in robust accuracy on MNIST, SVHN, and CIFAR-10, while noting that YOPO can have higher natural accuracy (Kim et al., 2022).

The YOPO mechanism has also been transplanted outside adversarial robustness. “JEM++: Improved Techniques for Training JEM” treats approximate maximum-likelihood training of an energy-based model as a multi-step differential game and extends the YOPO framework to avoid redundant calculations during backpropagation in multi-step SGLD sampling. Its accelerated sampler, PYLD-$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$1-$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$2, freezes a slack variable derived from the post-first-layer network and reuses it across several cheap inner sample updates. On CIFAR-10, the paper reports runtime per epoch of 30.1 min for JEM, versus 12.5 min for JEM++ with $$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$3 and 20.1 min for $$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$4 (Yang et al., 2021).

4. YOPO as a comparison baseline in robustness studies

Not every paper that mentions YOPO is actually about YOPO. “Towards Natural Robustness Against Adversarial Examples” uses YOPO only as a comparison point among adversarial training methods when arguing that Neural ODEs possess “natural robustness” (Chu et al., 2020). In that paper, YOPO is described as Zhang et al., 2019, “You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle”, and the only descriptive statement about it is that the method casts adversarial training as a discrete time differential game.

The empirical comparison is narrow but explicit. On CIFAR-10, the table labeled as the comparison between Neural ODEs and adversarially trained PreAct-Res18 models reports YOPO-5-3 with clean accuracy 83.99% and PGD-20 robustness 44.72%, while the non-adversarially-trained Neural ODEs row reports clean accuracy 69.94% and PGD-20 robustness 59.06%. The paper therefore claims that Neural ODEs outperform PGD, TRADES, and YOPO on the reported robust metric without adversarial training (Chu et al., 2020).

The same source also makes the limitations of that comparison visible. The comparison is not architecture-matched, since YOPO is evaluated on PreAct-Res18 whereas the proposed model is a Neural ODE with different structure and training recipe. It also involves a substantial clean-accuracy tradeoff: YOPO’s clean accuracy is 83.99%, whereas the Neural ODE row reports 69.94%. In this usage, YOPO is therefore best understood as a strong adversarial-training baseline rather than a theoretical object of the paper.

5. “You Only Plan Once” and the planning lineage

In robotics planning, YOPO denotes a different family. SAGA describes YOPO as a learning-based one-stage planner that integrates perception, local search, and trajectory optimization into a single network by regressing primitive-wise trajectory refinements and scores directly from depth observations. Within that paper, YOPO is the primary learning baseline and is characterized more specifically as a one-stage anchor-based learning planner (Wei et al., 4 May 2026).

SAGA’s comparison makes clear what that baseline means empirically. In cluttered randomized pillar-map environments, YOPO’s success rate declines from 90.91% at 2.0 m/s to 83.33% at 3.0 m/s and 62.50% at 4.0 m/s, while SAGA reports 100.00% at all three speeds. At 4.0 m/s, the paper reports YOPO with Time Consumption 40.4631 s, Traj. Length 85.4210 m, Avg. Safety 1.9843 m, Min. Safety 0.4390 m, Smoothness 112.0421, and Success Rate 62.50%. The discussion frames the limitation of the one-stage anchor paradigm not as the anchor representation itself but as the lack of structured global interaction among anchor candidates, implying that YOPO-style candidate evaluation is more independent (Wei et al., 4 May 2026).

YOPO-Rally extends this planning lineage to off-road forest navigation. It is described as a sim-to-real, off-road version of the YOPO end-to-end navigation framework, retaining the single-stage anchor-based structure while explicitly incorporating Terrain Traversability Analysis into supervision. The planner takes a depth image, current velocity, and goal direction vector, and for each primitive anchor predicts an end-state offset, end velocity, and cost. The end position is parameterized as

$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$5

and the resulting local trajectory is represented as a non-uniform cubic Hermite curve (Cao et al., 24 May 2025).

The expert supervision in YOPO-Rally is generated from a traversability-aware optimization problem over a continuous cost map. The safety and terrain terms are

$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$6

and

$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$7

while the expert trajectory objective is

$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$8

The neural planner is trained by behavior cloning with

$$x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad x_{i,t+1}=f_t(x_{i,t},\theta_t),$$9

In simulation, the reported total latency is 11.58 ms for the proposed planner-plus-controller stack, versus 2661.95 ms for GP-Nav. In real-world experiments on the DIABLO robot, the paper reports 24.5 ms neural inference, 20.4 ms local control, and 44.9 ms total runtime, with deployment performed without fine-tuning (Cao et al., 24 May 2025).

6. Later homonyms: prompting, passing, and posing once

A separate reuse appears in black-box LLM ensembling. In SCE, YOPO means “You Only Prompt Once.” The setting begins with $$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$0 candidate responses and a semantic-equivalence score between answers conditioned on the same query. Exhaustive pairwise prompting requires

$$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$1

comparisons. YOPO replaces this by putting all QA pairs into a single prompt and asking the judge model to return, for each candidate, how many other QA pairs are semantically equivalent to it, which the paper summarizes as reducing complexity from $$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$2 to $$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$3 in prompt count (Zhang et al., 13 Mar 2025).

The core output of that procedure is a vote vector

$$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$4

from which the most-consistent set $$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$5 and least-consistent set $$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$6 are formed. On the WikiBio hallucination benchmark, Sce-Check (Yopo) reports NonFact AUC-PR 91.43, Factual AUC-PR 66.13, and Ranking PCC 76.61, which is essentially on par with Pairwise-Prompt at 91.29, 65.87, and 76.64. The scalability analysis claims two orders of magnitude reduction in computational overhead relative to pairwise prompting, while noting that actual inference time scales linearly with prompt length (Zhang et al., 13 Mar 2025).

In visual navigation, YOPO-Nav expands the acronym as “You Only Pass Once.” The method is built for navigation when one-pass exploration videos are available and the task is to retrace demonstrated trajectories without relying on a dense global metric map. The environment is encoded as a graph of local 3D Gaussian Splatting models; across 35 trajectories, the paper reports 547 3DGS models, total compressed size 17.8 GB, and metadata totaling 30 MB. For image-goal navigation on a physical robot, YOPO-Nav reports success rates of 1.0, 0.94, 0.81, and 0.75 at path lengths of 1.5 m, 3 m, 7 m, and 12 m, respectively (Meegan et al., 10 Dec 2025).

In monocular pose estimation, YOPO means “You Only Pose Once.” Here the model is a single-stage, query-based framework for monocular RGB category-level multi-object 9D pose estimation. Given an RGB image $$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$7 and camera intrinsics $$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$8, it predicts

$$H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).$$9

where $f_\theta = g_{\tilde\theta}\circ f_0,$0 is category, $f_\theta = g_{\tilde\theta}\circ f_0,$1 is rotation, $f_\theta = g_{\tilde\theta}\circ f_0,$2 is translation, and $f_\theta = g_{\tilde\theta}\circ f_0,$3 is anisotropic metric size. Translation is reconstructed from predicted 2D center $f_\theta = g_{\tilde\theta}\circ f_0,$4 and depth $f_\theta = g_{\tilde\theta}\circ f_0,$5 by

$f_\theta = g_{\tilde\theta}\circ f_0,$6

The paper reports that on REAL275, YOPO Swin-L$f_\theta = g_{\tilde\theta}\circ f_0,$7 reaches 79.6% $f_\theta = g_{\tilde\theta}\circ f_0,$8 and 54.1% under the $f_\theta = g_{\tilde\theta}\circ f_0,$9 metric, while YOPO R50 runs at 21.3 FPS and YOPO Swin-L at 7.7 FPS on an NVIDIA A6000 (Lee et al., 20 Aug 2025).

7. Recurring design logic and disambiguation

Across these distinct literatures, the acronym marks a family resemblance in engineering style rather than a shared technical core. In adversarial training, YOPO amortizes repeated inner PGD-style backpropagation by caching a first-layer gradient signal (Zhang et al., 2019). In planning, the name marks single-stage prediction of anchor-conditioned trajectories and costs instead of an online stack of traversability analysis, search, and optimization (Cao et al., 24 May 2025). In SCE, it collapses a quadratic number of semantic-equivalence prompts into one prompt (Zhang et al., 13 Mar 2025). In the later navigation and pose works, it denotes one-pass spatial encoding or one-stage query-based prediction (Meegan et al., 10 Dec 2025, Lee et al., 20 Aug 2025). This suggests a recurring naming logic centered on replacing repeated or multi-stage computation with a single amortized pass.

A common misconception is that every mention of YOPO concerns the 2019 adversarial-training method. The supplied literature shows otherwise. In “Towards Natural Robustness Against Adversarial Examples,” YOPO is only an adversarial-training baseline (Chu et al., 2020). In SAGA, YOPO is a one-stage anchor-based learning planner used as the primary learning baseline (Wei et al., 4 May 2026). In SI-HG, it is one of the few theory-backed adversarial-training baselines, but not the proposed method (Kim et al., 2022). In Amata, it is an acceleration method that the new annealing mechanism is designed to complement rather than replace (Ye et al., 2020).

Accordingly, precise disambiguation is essential. In robustness work from 2019 onward, unqualified “YOPO” usually refers to You Only Propagate Once (Zhang et al., 2019). In robotics planning, it usually refers to You Only Plan Once, including descendants such as YOPO-Rally (Cao et al., 24 May 2025). In 2025 literature on LLM ensembling, visual navigation, and category-level pose estimation, the same acronym is reused for You Only Prompt Once, You Only Pass Once, and You Only Pose Once (Zhang et al., 13 Mar 2025, Meegan et al., 10 Dec 2025, Lee et al., 20 Aug 2025). The acronym therefore has encyclopedic significance not as a single canonical algorithm, but as a notable example of recurrent, domain-specific renaming around the “one-shot” design motif.