human: Given a hyperedge-centered hypergraph: <hypergraph>, where the center hyperedge is induced by one source paper and its member nodes are the cited papers.

Details of the hypergraph:
Center hyperedge (induced by source paper "query free attacks on industry grade face recognition systems under resource constraints"):
  Abstract: To attack a deep neural network (DNN) based Face Recognition (FR) system, one needs to build \textit{substitute} models to simulate the target, so the adversarial examples discovered could also mislead the target. Such \textit{transferability} is achieved in recent studies through querying the target to obtain data for training the substitutes. A real-world target, likes the FR system of law enforcement, however, is less accessible to the adversary. To attack such a system, a substitute with similar quality as the target is needed to identify their common defects. This is hard since the adversary often does not have the enough resources to train such a model (hundreds of millions of images for training a commercial FR system). #R##N#We found in our research, however, that a resource-constrained adversary could still effectively approximate the target's capability to recognize \textit{specific} individuals, by training \textit{biased} substitutes on additional images of those who want to evade recognition (the subject) or the victims to be impersonated (called Point of Interest, or PoI). This is made possible by a new property we discovered, called \textit{Nearly Local Linearity} (NLL), which models the observation that an ideal DNN model produces the image representations whose distances among themselves truthfully describe the differences in the input images seen by human. By simulating this property around the PoIs using the additional subject or victim data, we significantly improve the transferability of black-box impersonation attacks by nearly 50\%. Particularly, we successfully attacked a commercial system trained over 20 million images, using 4 million images and 1/5 of the training time but achieving 60\% transferability in an impersonation attack and 89\% in a dodging attack.

Includes members:
  Member "feature squeezing detecting adversarial examples in deep neural networks":
    also connected through other hyperedges:
      - Hyperedge HE-1 (induced by source paper "secure and robust machine learning for healthcare a survey")
  Member "adversarial attacks on neural network policies":
    also connected through other hyperedges:
      - Hyperedge HE-2 (induced by source paper "challenges and countermeasures for adversarial attacks on deep reinforcement learning")
  Member "adversarial examples are not easily detected bypassing ten detection methods":
    also connected through other hyperedges:
      - Hyperedge HE-3 (induced by source paper "secure and robust machine learning for healthcare a survey")
  Member "upset and angri breaking high performance image classifiers":
    also connected through other hyperedges:
      - Hyperedge HE-4 (induced by source paper "neural network model extraction attacks in edge devices by hearing architectural hints")
  Member "mixup beyond empirical risk minimization":
    also connected through other hyperedges:
      - Hyperedge HE-5 (induced by source paper "on feature normalization and data augmentation")
  Member "practical black box attacks against machine learning":
    also connected through other hyperedges:
      - Hyperedge HE-6 (induced by source paper "adversarial ranking attack and defense")
  Member "transferability in machine learning from phenomena to black box attacks using adversarial samples":
    also connected through other hyperedges:
      - Hyperedge HE-7 (induced by source paper "adversarial ranking attack and defense")
  Member "delving into transferable adversarial examples and black box attacks":
    also connected through other hyperedges:
      - Hyperedge HE-8 (induced by source paper "adversarial ranking attack and defense")

Question: Please tell me which class the source paper belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.LG(Machine Learning)