human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "intriguing properties of adversarial training"):
  Abstract: Adversarial training is one of the main defenses against adversarial attacks. In this paper, we provide the first rigorous study on diagnosing elements of adversarial training, which reveals two intriguing properties. #R##N#First, we study the role of normalization. Batch normalization (BN) is a crucial element for achieving state-of-the-art performance on many vision tasks, but we show it may prevent networks from obtaining strong robustness in adversarial training. One unexpected observation is that, for models trained with BN, simply removing clean images from training data largely boosts adversarial robustness, i.e., 18.3%. We relate this phenomenon to the hypothesis that clean images and adversarial images are drawn from two different domains. This two-domain hypothesis may explain the issue of BN when training with a mixture of clean and adversarial images, as estimating normalization statistics of this mixture distribution is challenging. Guided by this two-domain hypothesis, we show disentangling the mixture distribution for normalization, i.e., applying separate BNs to clean and adversarial images for statistics estimation, achieves much stronger robustness. Additionally, we find that enforcing BNs to behave consistently at training and testing can further enhance robustness. #R##N#Second, we study the role of network capacity. We find our so-called "deep" networks are still shallow for the task of adversarial learning. Unlike traditional classification tasks where accuracy is only marginally improved by adding more layers to "deep" networks (e.g., ResNet-152), adversarial training exhibits a much stronger demand on deeper networks to achieve higher adversarial robustness. This robustness improvement can be observed substantially and consistently even by pushing the network capacity to an unprecedented scale, i.e., ResNet-638.

Includes members:
  Member "adversarial robustness may be at odds with simplicity":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "triple wins boosting accuracy robustness and efficiency together by enabling input adaptive inference")
  Member "instance adaptive adversarial training improved accuracy tradeoffs in neural nets":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "cat customized adversarial training for improved robustness")
  Member "convergence of adversarial training in overparametrized neural networks":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "cat customized adversarial training for improved robustness")
  Member "using self supervised learning can improve model robustness and uncertainty":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "learning representations by predicting bags of visual words")
  Member "are labels required for improving adversarial robustness":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "overfitting in adversarially robust deep learning")
  Member "defending adversarial attacks by correcting logits":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "enhancing transformation based defenses using a distribution classifier")
  Member "adversarially robust generalization just requires more unlabeled data":
    also connected through other hyperedges:
      - Hyperedge HE-7 (induced by source paper "overfitting in adversarially robust deep learning")
  Member "theoretically principled trade off between robustness and accuracy":
    also connected through other hyperedges:
      - Hyperedge HE-8 (induced by source paper "overfitting in adversarially robust deep learning")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CV(Computer Vision and Pattern Recognition)