human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "exploiting excessive invariance caused by norm bounded adversarial robustness"
  Abstract: Adversarial examples are malicious inputs crafted to cause a model to misclassify them. Their most common instantiation, "perturbation-based" adversarial examples introduce changes to the input that leave its true label unchanged, yet result in a different model prediction. Conversely, "invariance-based" adversarial examples insert changes to the input that leave the model's prediction unaffected despite the underlying input's label having changed. #R##N#In this paper, we demonstrate that robustness to perturbation-based adversarial examples is not only insufficient for general robustness, but worse, it can also increase vulnerability of the model to invariance-based adversarial examples. In addition to analytical constructions, we empirically study vision classifiers with state-of-the-art robustness to perturbation-based adversaries constrained by an $\ell_p$ norm. We mount attacks that exploit excessive model invariance in directions relevant to the task, which are able to find adversarial examples within the $\ell_p$ ball. In fact, we find that classifiers trained to be $\ell_p$-norm robust are more vulnerable to invariance-based adversarial examples than their undefended counterparts. #R##N#Excessive invariance is not limited to models trained to be robust to perturbation-based $\ell_p$-norm adversaries. In fact, we argue that the term adversarial example is used to capture a series of model limitations, some of which may not have been discovered yet. Accordingly, we call for a set of precise definitions that taxonomize and address each of these shortcomings in learning.

Connected through hyperedge HE-1 (induced by source paper "on adaptive attacks to adversarial example defenses"):
  with members:
    - "adversarial training and robustness for multiple perturbations"
    - "adversarial example detection and classification with asymmetrical adversarial training"
    - "an alternative surrogate loss for pgd based adversarial testing"
    - "mixup inference better exploiting mixup to defend adversarial attacks"
    - "improving adversarial robustness via promoting ensemble diversity"
    - "a new defense against adversarial images turning a weakness into a strength"
    - "resisting adversarial attacks by k winners take all"
    - "rethinking softmax cross entropy loss for adversarial robustness"

Connected through hyperedge HE-2 (induced by source paper "provable robust learning based on transformation specific smoothing"):
  with members:
    - "breaking certified defenses semantic adversarial examples with spoofed robustness certificates"
    - "certified adversarial robustness via randomized smoothing"
    - "a convex relaxation barrier to tight robustness verification of neural networks"
    - "scaling provable adversarial defenses"
    - "spatially transformed adversarial examples"
    - "on the effectiveness of interval bound propagation for training verifiably robust models"
    - "characterizing adversarial subspaces using local intrinsic dimensionality"
    - "semidefinite relaxations for certifying robustness to adversarial examples"

Connected through hyperedge HE-3 (induced by source paper "end to end robustness for sensing reasoning machine learning pipelines"):
  with members:
    - "certified adversarial robustness via randomized smoothing"
    - "joint inference of reward machines and policies for reinforcement learning"
    - "improving adversarial robustness via promoting ensemble diversity"
    - "characterizing adversarial examples based on spatial consistency information for semantic segmentation"
    - "evaluating robustness of neural networks with mixed integer programming"
    - "provable defenses against adversarial examples via the convex outer adversarial polytope"
    - "compositional falsification of cyber physical systems with machine learning components"
    - "joint inference of multiple label types in large networks"

Connected through hyperedge HE-4 (induced by source paper "rearchitecting classification frameworks for increased robustness"):
  with members:
    - "adversarial sensor attack on lidar based perception in autonomous driving"
    - "extending adversarial attacks and defenses to deep 3d point cloud classifiers"
    - "certified adversarial robustness via randomized smoothing"
    - "a stratified approach to robustness for randomly smoothed classifiers"
    - "humans can decipher adversarial images"
    - "on evaluating adversarial robustness"
    - "stochastic activation pruning for robust adversarial defense"
    - "deep k nearest neighbors towards confident interpretable and robust deep learning"

Connected through hyperedge HE-5 (induced by source paper "confidence calibrated adversarial training generalizing to unseen attacks"):
  with members:
    - "adversarial training and robustness for multiple perturbations"
    - "mnist c a robustness benchmark for computer vision"
    - "theoretically principled trade off between robustness and accuracy"
    - "benchmarking neural network robustness to common corruptions and perturbations"
    - "square attack a query efficient black box adversarial attack via random search"
    - "adversarial robustness against the union of multiple perturbation models"
    - "wild patterns ten years after the rise of adversarial machine learning"
    - "playing the game of universal adversarial perturbations"

Connected through hyperedge HE-6 (induced by source paper "adversarial training and robustness for multiple perturbations"):
  with members:
    - "transfer of adversarial robustness between perturbation types"
    - "adversarial perceptual ad blocking meets adversarial machine learning"
    - "benchmarking neural network robustness to common corruptions and perturbations"
    - "adversarial training for free"
    - "the curse of concentration in robust learning evasion and poisoning attacks from concentration of measure"
    - "on the geometry of adversarial examples"
    - "towards the first adversarially robust neural network model on mnist"
    - "adversarial spheres"

Connected through hyperedge HE-7 (induced by source paper "batch normalization is a cause of adversarial vulnerability"):
  with members:
    - "adversarial examples are a natural consequence of test error in noise"
    - "approximating cnns with bag of local features models works surprisingly well on imagenet"
    - "a mean field theory of batch normalization"
    - "benchmarking neural network robustness to common corruptions and perturbations"
    - "advertorch v0 1 an adversarial robustness toolbox based on pytorch"
    - "adversarial training versus weight decay"
    - "imagenet trained cnns are biased towards texture increasing shape bias improves accuracy and robustness"
    - "towards the first adversarially robust neural network model on mnist"

Connected through hyperedge HE-8 (induced by source paper "testing robustness against unforeseen adversaries"):
  with members:
    - "adversarial training and robustness for multiple perturbations"
    - "adversarial examples are a natural consequence of test error in noise"
    - "natural adversarial examples"
    - "benchmarking neural network robustness to common corruptions and perturbations"
    - "interpreting adversarially trained convolutional neural networks"
    - "sensitivity of deep convolutional networks to gabor noise"
    - "spatially transformed adversarial examples"
    - "benchmarking neural network robustness to common corruptions and surface variations"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.LG(Machine Learning)