---
title: 'YOPO: One-Pass Methods in AI Research'
url: https://www.emergentmind.com/topics/yopo
type: topic
---

# YOPO: One-Pass Methods in AI Research

YOPO is an overloaded research acronym rather than a single method. In the literature considered here, its earliest and most extensively analyzed meaning is **“You Only Propagate Once,”** an adversarial-training acceleration method that casts adversarial training as a discrete time differential game and uses the Pontryagin’s Maximum Principle to justify restricting most adversary-update computation to the first layer of the network [1905.00877]. Later work reuses the acronym for technically unrelated systems, including **“You Only Plan Once”** in learning-based planning, **“You Only Prompt Once”** in black-box LLM ensembling, **“You Only Pass Once”** in visual navigation from one-pass videos, and **“You Only Pose Once”** in monocular category-level 9D pose estimation [2605.02301] [2503.10881] [2512.09903] [2508.14965].

## 1. Polysemy and nomenclature

The acronym has acquired several domain-specific expansions. The shared surface form is therefore potentially misleading unless the surrounding literature makes the intended expansion explicit.

| Expansion of YOPO | Domain | Representative source |
|---|---|---|
| You Only Propagate Once | Adversarial training | [1905.00877] |
| You Only Plan Once | Learning-based planning | [2605.02301], [2505.18714] |
| You Only Prompt Once | Black-box LLM ensembling | [2503.10881] |
| You Only Pass Once | Visual navigation | [2512.09903] |
| You Only Pose Once | Monocular 9D pose estimation | [2508.14965] |

The adversarial-training usage is the one for which the acronym itself is original in the supplied material. The later homonyms retain the “one-shot” naming pattern but correspond to independent technical programs rather than extensions of the 2019 robustness method. This suggests a broader naming convention in which “YOPO” marks an attempt to replace a repeated inner loop, multi-stage pipeline, or quadratic comparison pattern with a single-pass or amortized alternative.

## 2. “You Only Propagate Once” in adversarial training

In its original sense, YOPO is an acceleration method for adversarial training. The underlying robust optimization problem is the standard min-max objective
$$
\min_{\theta} \mathbb{E}_{(x,y)\sim \mathcal{D}} \left[\max_{\delta \in \mathcal{S}} L(f_\theta(x+\delta), y)\right],
$$
where the inner maximization is commonly approximated by multi-step PGD [1905.00877]. The computational bottleneck is that each PGD step requires a full forward and backward pass through the network to evaluate the perturbation gradient.

The central theoretical move in YOPO is to write the network as layer-wise dynamics and to analyze adversarial training as a discrete time differential game. In the layer-wise formulation, the perturbation enters only through the first transition,
$$
x_{i,1}=f_0(x_{i,0}+\eta_i;\theta_0), \qquad
x_{i,t+1}=f_t(x_{i,t},\theta_t),
$$
and the corresponding Hamiltonian is
$$
H_t(x,p,\theta_t)=p\cdot f_t(x,\theta_t)-\frac{1}{N}R_t(x,\theta_t).
$$
The costate variables are the backward-propagated gradients. The practical consequence is that the adversary update is only coupled with the parameters of the first layer of the network, which motivates restricting most of the forward and back propagation during adversary updates to that first layer [1905.00877].

Operationally, the network is decomposed as
$$
f_\theta = g_{\tilde\theta}\circ f_0,
$$
so that the perturbation gradient factorizes as
$$
\nabla_\eta L(f_\theta(x+\eta),y)
=
\nabla_{f_0} L(g_{\tilde\theta}(f_0(x+\eta)),y)\cdot \nabla_\eta f_0(x+\eta,\theta_0).
$$
YOPO computes the upstream gradient signal at the first-layer interface once with a full propagation, then reuses it for several cheap perturbation updates that differentiate only through the first layer. This is the literal meaning of “you only propagate once” [1905.00877].

The original paper reports that YOPO can achieve comparable defense accuracy with approximately **1/5 ~ 1/4 GPU time** of PGD. On MNIST, **YOPO-5-10** attains clean accuracy **99.46%**, PGD-40 robust accuracy **96.27%**, and CW accuracy **93.56%**, compared with **99.49%**, **96.56%**, and **93.52%** for PGD-40. On CIFAR-10 with PreAct-Res18, **YOPO-5-3** reports clean accuracy **83.99%**, PGD-20 robust accuracy **44.72%**, and CW accuracy **59.77%**, compared with **84.82%**, **41.61%**, and **58.88%** for PGD-10 under the reported evaluation [1905.00877].

## 3. Later adversarial-training interpretations and extensions

Subsequent robustness literature places YOPO in the family of **efficient adversarial training** methods. The survey “Recent Advances in Adversarial Training for Adversarial Robustness” categorizes YOPO under that heading and reiterates its optimization view: from the perspective of Pontryagin’s Maximum Principle, adversarial gradients update is only related to the first layer of neural networks, so adversary computation can focus on the first layer while other layers are frozen, thereby significantly reducing the numbers of forward and backward propagation. The same survey reports a **Wide ResNet** result of **47.98%** adversarial accuracy on **CIFAR-10** under **PGD\(_{20}\)** with \(\epsilon=8/255\), and notes the YOPO authors’ claim that **Free-AT is a particular case of YOPO** [2102.01356].

Other papers treat YOPO as a modular acceleration primitive rather than a complete endpoint. “Amata: An Annealing Mechanism for Adversarial Training Acceleration” describes YOPO as estimating the gradient on the input by only propagating the first layer, and positions Amata as orthogonal to it: YOPO reduces the cost per inner update, whereas Amata anneals the strength of the inner maximization over training time. In the reported MNIST experiment, **Amata+YOPO** with \(K_{\min}=2\) and \(K_{\max}=5\) reaches **94% adversarial accuracy in 294 seconds**, around half of the time consumed by baseline YOPO, and is also reported to achieve better adversarial accuracy when converged [2012.08112].

Theoretical comparison papers also single out YOPO because of its stationarity guarantees. “Semi-Implicit Hybrid Gradient Methods with Application to Adversarial Robustness” states that, to the authors’ knowledge, only **DAT** and **YOPO** guarantee convergence to a stationary point of the adversarial-training minimax problem. In that account, YOPO belongs to the MGDA family and is credited with an \(O(1/K^{1/2})\) convergence rate for the squared saddle subdifferential norm under smoothness, local strong concavity, and bounded-variance assumptions. The same paper contrasts this with an \(O(1/K)\) rate for its proposed SI-HG method and reports that MSI-HG exceeds YOPO in robust accuracy on MNIST, SVHN, and CIFAR-10, while noting that YOPO can have higher natural accuracy [2202.10523].

The YOPO mechanism has also been transplanted outside adversarial robustness. “JEM++: Improved Techniques for Training JEM” treats approximate maximum-likelihood training of an energy-based model as a multi-step differential game and extends the YOPO framework to avoid redundant calculations during backpropagation in multi-step SGLD sampling. Its accelerated sampler, **PYLD-\(M\)-\(N\)**, freezes a slack variable derived from the post-first-layer network and reuses it across several cheap inner sample updates. On CIFAR-10, the paper reports runtime per epoch of **30.1 min** for JEM, versus **12.5 min** for JEM++ with \(M=5,N=5\) and **20.1 min** for \(M=10,N=5\) [2109.09032].

## 4. YOPO as a comparison baseline in robustness studies

Not every paper that mentions YOPO is actually about YOPO. “Towards Natural Robustness Against Adversarial Examples” uses YOPO only as a comparison point among adversarial training methods when arguing that Neural ODEs possess “natural robustness” [2012.02452]. In that paper, YOPO is described as **Zhang et al., 2019, “You Only Propagate Once: Accelerating Adversarial Training via Maximal Principle”**, and the only descriptive statement about it is that the method casts adversarial training as a discrete time differential game.

The empirical comparison is narrow but explicit. On **CIFAR-10**, the table labeled as the comparison between Neural ODEs and adversarially trained **PreAct-Res18** models reports **YOPO-5-3** with clean accuracy **83.99%** and PGD-20 robustness **44.72%**, while the non-adversarially-trained **Neural ODEs** row reports clean accuracy **69.94%** and PGD-20 robustness **59.06%**. The paper therefore claims that Neural ODEs outperform PGD, TRADES, and YOPO on the reported robust metric without adversarial training [2012.02452].

The same source also makes the limitations of that comparison visible. The comparison is **not architecture-matched**, since YOPO is evaluated on **PreAct-Res18** whereas the proposed model is a **Neural ODE** with different structure and training recipe. It also involves a substantial clean-accuracy tradeoff: YOPO’s clean accuracy is **83.99%**, whereas the Neural ODE row reports **69.94%**. In this usage, YOPO is therefore best understood as a strong adversarial-training baseline rather than a theoretical object of the paper.

## 5. “You Only Plan Once” and the planning lineage

In robotics planning, YOPO denotes a different family. SAGA describes YOPO as a **learning-based one-stage planner** that integrates perception, local search, and trajectory optimization into a single network by regressing primitive-wise trajectory refinements and scores directly from depth observations. Within that paper, YOPO is the **primary learning baseline** and is characterized more specifically as a **one-stage anchor-based learning planner** [2605.02301].

SAGA’s comparison makes clear what that baseline means empirically. In cluttered randomized pillar-map environments, YOPO’s success rate declines from **90.91%** at **2.0 m/s** to **83.33%** at **3.0 m/s** and **62.50%** at **4.0 m/s**, while SAGA reports **100.00%** at all three speeds. At **4.0 m/s**, the paper reports YOPO with **Time Consumption 40.4631 s**, **Traj. Length 85.4210 m**, **Avg. Safety 1.9843 m**, **Min. Safety 0.4390 m**, **Smoothness 112.0421**, and **Success Rate 62.50%**. The discussion frames the limitation of the one-stage anchor paradigm not as the anchor representation itself but as the lack of structured global interaction among anchor candidates, implying that YOPO-style candidate evaluation is more independent [2605.02301].

YOPO-Rally extends this planning lineage to off-road forest navigation. It is described as a sim-to-real, off-road version of the YOPO end-to-end navigation framework, retaining the single-stage anchor-based structure while explicitly incorporating Terrain Traversability Analysis into supervision. The planner takes a **depth image**, **current velocity**, and **goal direction vector**, and for each primitive anchor predicts an end-state offset, end velocity, and cost. The end position is parameterized as
$$
\bm{p}_e^i =p_n^i \left[\cos \left(\theta_i + p_\theta^i\right), \sin \left(\theta_i + p_\theta^i\right)\right]^{\mathrm{T}},
$$
and the resulting local trajectory is represented as a non-uniform cubic Hermite curve [2505.18714].

The expert supervision in YOPO-Rally is generated from a traversability-aware optimization problem over a continuous cost map. The safety and terrain terms are
$$
C_{safety} = e^{(d_0 - D_t) / k},
$$
and
$$
C_{map}
=
\lambda_r \frac{G_r}{G_{r_{max}}}
+ \lambda_s \frac{G_s}{G_{s_{max}}}
+ \lambda_{c} C_{safety},
$$
while the expert trajectory objective is
$$
J_t(\bm{p}_e, \bm{v}_e)
=
\int_{0}^{t_e} \widetilde{C}_{map}(\bm{p}(t)) + \left\lVert \bm{v}(t)\right\rVert ^2 \, \mathrm{d}t + \left\lVert \bm{p}_e - \bm{g}\right\rVert ^2.
$$
The neural planner is trained by behavior cloning with
$$
\mathcal{L} = \frac{1}{N} \sum_{n = 0}^{N} \left\lVert \bm{y}_n - \bm{y}_n^*\right\rVert ^2.
$$
In simulation, the reported total latency is **11.58 ms** for the proposed planner-plus-controller stack, versus **2661.95 ms** for GP-Nav. In real-world experiments on the DIABLO robot, the paper reports **24.5 ms** neural inference, **20.4 ms** local control, and **44.9 ms** total runtime, with deployment performed **without fine-tuning** [2505.18714].

## 6. Later homonyms: prompting, passing, and posing once

A separate reuse appears in black-box LLM ensembling. In SCE, **YOPO means “You Only Prompt Once.”** The setting begins with \(M=N\times R\) candidate responses and a semantic-equivalence score between answers conditioned on the same query. Exhaustive pairwise prompting requires
$$
\frac{M\times(M-1)}{2}
$$
comparisons. YOPO replaces this by putting all QA pairs into a single prompt and asking the judge model to return, for each candidate, how many other QA pairs are semantically equivalent to it, which the paper summarizes as reducing complexity from \(\mathcal{O}(N^2)\) to \(\mathcal{O}(1)\) in prompt count [2503.10881].

The core output of that procedure is a vote vector
$$
\mathbb{V} = \{ \mathcal{V}_i,\dots,\mathcal{V}_M \},
$$
from which the most-consistent set \(\mathbb{Y}^{mc}\) and least-consistent set \(\mathbb{Y}^{lc}\) are formed. On the WikiBio hallucination benchmark, **Sce-Check (Yopo)** reports **NonFact AUC-PR 91.43**, **Factual AUC-PR 66.13**, and **Ranking PCC 76.61**, which is essentially on par with **Pairwise-Prompt** at **91.29**, **65.87**, and **76.64**. The scalability analysis claims **two orders of magnitude** reduction in computational overhead relative to pairwise prompting, while noting that actual inference time scales linearly with prompt length [2503.10881].

In visual navigation, **YOPO-Nav** expands the acronym as **“You Only Pass Once.”** The method is built for navigation when one-pass exploration videos are available and the task is to retrace demonstrated trajectories without relying on a dense global metric map. The environment is encoded as a graph of local 3D Gaussian Splatting models; across **35 trajectories**, the paper reports **547 3DGS models**, total compressed size **17.8 GB**, and metadata totaling **30 MB**. For image-goal navigation on a physical robot, YOPO-Nav reports success rates of **1.0**, **0.94**, **0.81**, and **0.75** at path lengths of **1.5 m**, **3 m**, **7 m**, and **12 m**, respectively [2512.09903].

In monocular pose estimation, **YOPO means “You Only Pose Once.”** Here the model is a single-stage, query-based framework for monocular RGB category-level multi-object 9D pose estimation. Given an RGB image \(I\) and camera intrinsics \(K\), it predicts
$$
\hat{y}_i = (c_i, \mathbf{R}_i, \mathbf{t}_i, \mathbf{s}_i),
$$
where \(c_i\) is category, \(\mathbf{R}_i \in SO(3)\) is rotation, \(\mathbf{t}_i \in \mathbb{R}^3\) is translation, and \(\mathbf{s}_i \in \mathbb{R}_{>0}^3\) is anisotropic metric size. Translation is reconstructed from predicted 2D center \(\mathbf{u}_i\) and depth \(z_i\) by
$$
\mathbf{t}_i = z_i\, K^{-1} \begin{bmatrix} \mathbf{u}_i \\ 1 \end{bmatrix}.
$$
The paper reports that on **REAL275**, **YOPO Swin-L\(^*\)** reaches **79.6% \(\mathrm{IoU}_{50}\)** and **54.1%** under the **\(10^\circ 10\text{cm}\)** metric, while **YOPO R50** runs at **21.3 FPS** and **YOPO Swin-L** at **7.7 FPS** on an NVIDIA A6000 [2508.14965].

## 7. Recurring design logic and disambiguation

Across these distinct literatures, the acronym marks a family resemblance in engineering style rather than a shared technical core. In adversarial training, YOPO amortizes repeated inner PGD-style backpropagation by caching a first-layer gradient signal [1905.00877]. In planning, the name marks single-stage prediction of anchor-conditioned trajectories and costs instead of an online stack of traversability analysis, search, and optimization [2505.18714]. In SCE, it collapses a quadratic number of semantic-equivalence prompts into one prompt [2503.10881]. In the later navigation and pose works, it denotes one-pass spatial encoding or one-stage query-based prediction [2512.09903] [2508.14965]. This suggests a recurring naming logic centered on replacing repeated or multi-stage computation with a single amortized pass.

A common misconception is that every mention of YOPO concerns the 2019 adversarial-training method. The supplied literature shows otherwise. In “Towards Natural Robustness Against Adversarial Examples,” YOPO is only an adversarial-training baseline [2012.02452]. In SAGA, YOPO is a one-stage anchor-based learning planner used as the primary learning baseline [2605.02301]. In SI-HG, it is one of the few theory-backed adversarial-training baselines, but not the proposed method [2202.10523]. In Amata, it is an acceleration method that the new annealing mechanism is designed to complement rather than replace [2012.08112].

Accordingly, precise disambiguation is essential. In robustness work from 2019 onward, unqualified “YOPO” usually refers to **You Only Propagate Once** [1905.00877]. In robotics planning, it usually refers to **You Only Plan Once**, including descendants such as YOPO-Rally [2505.18714]. In 2025 literature on LLM ensembling, visual navigation, and category-level pose estimation, the same acronym is reused for **You Only Prompt Once**, **You Only Pass Once**, and **You Only Pose Once** [2503.10881] [2512.09903] [2508.14965]. The acronym therefore has encyclopedic significance not as a single canonical algorithm, but as a notable example of recurrent, domain-specific renaming around the “one-shot” design motif.

Source: https://www.emergentmind.com/topics/yopo