Across model architectures, we found that one epoch of certifiably robust training takes between 2× and 4× longer than one epoch of standard training.
iBP certificates are much faster to compute at test time than genetic attack accuracy.