human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "dynamic backdoor attacks against machine learning models"):
  Abstract: Machine learning (ML) has made tremendous progress during the past decade and is being adopted in various critical real-world applications. However, recent research has shown that ML models are vulnerable to multiple security and privacy attacks. In particular, backdoor attacks against ML models that have recently raised a lot of awareness. A successful backdoor attack can cause severe consequences, such as allowing an adversary to bypass critical authentication systems. #R##N#Current backdooring techniques rely on adding static triggers (with fixed patterns and locations) on ML model inputs. In this paper, we propose the first class of dynamic backdooring techniques: Random Backdoor, Backdoor Generating Network (BaN), and conditional Backdoor Generating Network (c-BaN). Triggers generated by our techniques can have random patterns and locations, which reduce the efficacy of the current backdoor detection mechanisms. In particular, BaN and c-BaN are the first two schemes that algorithmically generate triggers, which rely on a novel generative network. Moreover, c-BaN is the first conditional backdooring technique, that given a target label, it can generate a target-specific trigger. Both BaN and c-BaN are essentially a general framework which renders the adversary the flexibility for further customizing backdoor attacks. #R##N#We extensively evaluate our techniques on three benchmark datasets: MNIST, CelebA, and CIFAR-10. Our techniques achieve almost perfect attack performance on backdoored data with a negligible utility loss. We further show that our techniques can bypass current state-of-the-art defense mechanisms against backdoor attacks, including Neural Cleanse, ABS, and STRIP.

Includes members:
  Member "memguard defending against black box membership inference attacks via adversarial examples":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "privacy for all demystify vulnerability disparity of differential privacy against membership inference attack")
  Member "strip a defence against trojan attacks on deep neural networks":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "rab provable robustness against backdoor attacks")
  Member "under the hood of membership inference attacks on aggregate location time series":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "memguard defending against black box membership inference attacks via adversarial examples")
  Member "updates leak data set inference and reconstruction attacks in online learning":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "memguard defending against black box membership inference attacks via adversarial examples")
  Member "exploiting unintended feature leakage in collaborative learning":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "on the convergence of artificial intelligence and distributed ledger technology a scoping review and future research agenda")
  Member "knockoff nets stealing functionality of black box models":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "entangled watermarks as a defense against model extraction")
  Member "tagvisor a privacy advisor for sharing hashtags":
    also connected through other hyperedges:
      - Hyperedge HE-7 (induced by source paper "everything about you a multimodal approach towards friendship inference in online social networks")
  Member "the natural auditor how to tell if someone used your words to train their model":
    also connected through other hyperedges:
      - Hyperedge HE-8 (induced by source paper "privacy for all demystify vulnerability disparity of differential privacy against membership inference attack")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)