It does take longer to synthesize robust adversarial examples - how much longer depends on the distribution of transformations. The rotation example in this blo

It does take longer to synthesize robust adversarial examples - how much longer depends on the distribution of transformations. The rotation example in this blog post was pretty quick to create, maybe a minute or two on a Titan X. The printed-out version in the OpenAI blog post took something like 20 minutes on a Titan X.