human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "there are no bit parts for sign bits in black box attacks"
  Abstract: We present a black-box adversarial attack algorithm which sets new state-of-the-art model evasion rates for query efficiency in the $\ell_\infty$ and $\ell_2$ metrics, where only loss-oracle access to the model is available. On two public black-box attack challenges, the algorithm achieves the highest evasion rate, surpassing all of the submitted attacks. Similar performance is observed on a model that is secure against substitute-model attacks. For standard models trained on the MNIST, CIFAR10, and IMAGENET datasets, averaged over the datasets and metrics, the algorithm is 3.8x less failure-prone, and spends in total 2.5x fewer queries than the current state-of-the-art attacks combined given a budget of 10, 000 queries per attack attempt. Notably, it requires no hyperparameter tuning or any data/time-dependent prior. The algorithm exploits a new approach, namely sign-based rather than magnitude-based gradient estimation. This shifts the estimation from continuous to binary black-box optimization. With three properties of the directional derivative, we examine three approaches to adversarial attacks. This yields a superior algorithm breaking a standard MNIST model using just 12 queries on average!

Connected through hyperedge HE-1 (induced by source paper "square attack a query efficient black box adversarial attack via random search"):
  with members:
    - "adversarial training and robustness for multiple perturbations"
    - "one pixel attack for fooling deep neural networks"
    - "sparse and imperceivable adversarial attacks"
    - "black box adversarial attacks with bayesian optimization"
    - "certified adversarial robustness via randomized smoothing"
    - "hopskipjumpattack a query efficient decision based attack"
    - "yet another but more efficient black box adversarial attack tiling and evolution strategies"
    - "hybrid batch attacks finding black box adversarial examples with limited queries"

Connected through hyperedge HE-2 (induced by source paper "yet another but more efficient black box adversarial attack tiling and evolution strategies"):
  with members:
    - "robust neural networks using randomized adversarial training"
    - "certified adversarial robustness via randomized smoothing"
    - "theoretical evidence for adversarial robustness through randomization the case of the exponential family"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "defense gan protecting classifiers against adversarial attacks using generative models"
    - "black box adversarial attacks with limited queries and information"
    - "magnet a two pronged defense against adversarial examples"
    - "neural optimizer search with reinforcement learning"

Connected through hyperedge HE-3 (induced by source paper "hybrid batch attacks finding black box adversarial examples with limited queries"):
  with members:
    - "hopskipjumpattack a query efficient decision based attack"
    - "simple black box adversarial attacks"
    - "stateful detection of black box adversarial attacks"
    - "evading defenses to transferable adversarial examples by translation invariant attacks"
    - "improving black box adversarial attacks with a transfer based prior"
    - "nattack learning the distributions of adversarial examples for an improved black box attack on deep neural networks"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "targeted adversarial examples for black box audio systems"

Connected through hyperedge HE-4 (induced by source paper "sign opt a query efficient hard label adversarial attack"):
  with members:
    - "hopskipjumpattack a query efficient decision based attack"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "zeroth order stochastic variance reduction for nonconvex optimization"
    - "signsgd compressed optimisation for non convex problems"
    - "black box adversarial attacks with limited queries and information"
    - "obfuscated gradients give a false sense of security circumventing defenses to adversarial examples"
    - "practical black box attacks against machine learning"
    - "towards evaluating the robustness of neural networks"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.LG(Machine Learning)