human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "perception in the loop adversarial examples"):
  Abstract: We present a scalable, black box, perception-in-the-loop technique to find adversarial examples for deep neural network classifiers. Black box means that our procedure only has input-output access to the classifier, and not to the internal structure, parameters, or intermediate confidence values. Perception-in-the-loop means that the notion of proximity between inputs can be directly queried from human participants rather than an arbitrarily chosen metric. Our technique is based on covariance matrix adaptation evolution strategy (CMA-ES), a black box optimization approach. CMA-ES explores the search space iteratively in a black box manner, by generating populations of candidates according to a distribution, choosing the best candidates according to a cost function, and updating the posterior distribution to favor the best candidates. We run CMA-ES using human participants to provide the fitness function, using the insight that the choice of best candidates in CMA-ES can be naturally modeled as a perception task: pick the top $k$ inputs perceptually closest to a fixed input. We empirically demonstrate that finding adversarial examples is feasible using small populations and few iterations. We compare the performance of CMA-ES on the MNIST benchmark with other black-box approaches using $L_p$ norms as a cost function, and show that it performs favorably both in terms of success in finding adversarial examples and in minimizing the distance between the original and the adversarial input. In experiments on the MNIST, CIFAR10, and GTSRB benchmarks, we demonstrate that CMA-ES can find perceptually similar adversarial inputs with a small number of iterations and small population sizes when using perception-in-the-loop. Finally, we show that networks trained specifically to be robust against $L_\infty$ norm can still be susceptible to perceptually similar adversarial examples.

Includes members:
  Member "targeted adversarial examples for black box audio systems":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "g odel s sentence is an adversarial example but unsolvable")
  Member "on the suitability of l_p norms for creating and preventing adversarial examples":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "a differentiable color filter for generating unrestricted adversarial images")
  Member "exploring the space of black box attacks on deep neural networks":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "at gan an adversarial generator model for non constrained adversarial examples")
  Member "genattack practical black box attacks with gradient free optimization":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "one man s trash is another man s treasure resisting adversarial examples by adversarial examples")
  Member "geometric robustness of deep networks analysis and improvement":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "certification of semantic perturbations via randomized smoothing")
  Member "adversarial perturbations against deep neural networks for malware classification":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "on the security of randomized defenses against adversarial samples")
  Member "practical black box attacks against machine learning":
    also connected through other hyperedges:
      - Hyperedge HE-7 (induced by source paper "adversarial ranking attack and defense")
  Member "towards evaluating the robustness of neural networks":
    also connected through other hyperedges:
      - Hyperedge HE-8 (induced by source paper "adversarial ranking attack and defense")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.LG(Machine Learning)