human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "mitigating large adversarial perturbations on x mas x minus moving averaged samples"):
  Abstract: We propose the scheme that mitigates the adversarial perturbation $\epsilon$ on the adversarial example $X_{adv}$ ($=$ $X$ $\pm$ $\epsilon$, $X$ is a benign sample) by subtracting the estimated perturbation $\hat{\epsilon}$ from $X$ $+$ $\epsilon$ and adding $\hat{\epsilon}$ to $X$ $-$ $\epsilon$. The estimated perturbation $\hat{\epsilon}$ comes from the difference between $X_{adv}$ and its moving-averaged outcome $W_{avg}*X_{adv}$ where $W_{avg}$ is $N \times N$ moving average kernel that all the coefficients are one. Usually, the adjacent samples of an image are close to each other such that we can let $X$ $\approx$ $W_{avg}*X$ (naming this relation after X-MAS[X minus Moving Averaged Samples]). By doing that, we can make the estimated perturbation $\hat{\epsilon}$ falls within the range of $\epsilon$. The scheme is also extended to do the multi-level mitigation by configuring the mitigated adversarial example $X_{adv}$ $\pm$ $\hat{\epsilon}$ as a new adversarial example to be mitigated. The multi-level mitigation gets $X_{adv}$ closer to $X$ with a smaller (i.e. mitigated) perturbation than original unmitigated perturbation by setting the moving averaged adversarial sample $W_{avg} * X_{adv}$ (which has the smaller perturbation than $X_{adv}$ if $X$ $\approx$ $W_{avg}*X$) as the boundary condition that the multi-level mitigation cannot cross over (i.e. decreasing $\epsilon$ cannot go below and increasing $\epsilon$ cannot go beyond). With the multi-level mitigation, we can get high prediction accuracies even in the adversarial example having a large perturbation (i.e. $\epsilon$ $>$ $16$). The proposed scheme is evaluated with adversarial examples crafted by the FGSM (Fast Gradient Sign Method) based attacks on ResNet-50 trained with ImageNet dataset.

Includes members:
  Member "on the effectiveness of low frequency perturbations":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "frequency tuned universal adversarial attacks")
  Member "deflecting adversarial attacks with pixel deflection":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "adversarial ranking attack and defense")
  Member "low frequency adversarial perturbation":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "a survey of black box adversarial attacks on computer vision models")
  Member "countering adversarial images using input transformations":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "adversarial ranking attack and defense")
  Member "towards evaluating the robustness of neural networks":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "adversarial ranking attack and defense")
  Member "adversarial examples in the physical world":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "adversarial ranking attack and defense")
  Member "a study of the effect of jpg compression on adversarial images":
    also connected through other hyperedges:
      - Hyperedge HE-7 (induced by source paper "category wise attack transferable adversarial examples for anchor free object detection")
  Member "adversarial machine learning at scale":
    also connected through other hyperedges:
      - Hyperedge HE-8 (induced by source paper "adversarial ranking attack and defense")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CV(Computer Vision and Pattern Recognition)