Why fast adversarial training suddenly fails, and how to fix it

Fast adversarial training—training on one-step attacks to save time—mysteriously loses robustness against multi-step attacks. The team identified that fixed perturbation magnitudes cause this collapse, then built SORA, which adapts perturbations based on loss surface shape. On CIFAR-10, ImageNet, and other datasets, SORA matches the robustness of slower methods while keeping training speed and improving clean accuracy, using the same hyperparameters across architectures.