human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "strip a defence against trojan attacks on deep neural networks"
  Abstract: Recent trojan attacks on deep neural network (DNN) models are one insidious variant of data poisoning attacks. Trojan attacks exploit an effective backdoor created in a DNN model by leveraging the difficulty in interpretability of the learned model to misclassify any inputs signed with the attacker's chosen trojan trigger input. Trojan attacks are easy to craft; survive even in adverse conditions such as different viewpoints, and lighting conditions on images; and threaten real world applications such as autonomous vehicles and robotics. The trojan trigger is a secret guarded and exploited by the attacker. Therefore, detecting such trojaned inputs is a challenge, especially at run-time when models are in active operation. #R##N#We focus on vision systems and build the STRong Intentional Perturbation (STRIP) based run-time trojan attack detection system. We intentionally perturb the incoming input, for instance by superimposing various image patterns, and observe the randomness of the predicted classes for the perturbed inputs for a given model---malicious or benign---under deployment. A low entropy in the predicted classes violates the input-dependence property of a benign model and implies the presence of a malicious input---a characteristic of a trojaned input. The high efficacy of our method is validated through case studies on two popular and contrasting datasets: MNIST and CIFAR10. We achieve an overall false acceptance rate (FAR) of less than 1%, given a preset false rejection rate (FRR) of 1%, for four different tested trojan trigger types---three triggers are identified in previous attack works and one dedicated trigger is crafted by us to demonstrate the trigger-size insensitivity of the STRIP detection approach. In particular, on the dataset of natural images in CIFAR10, we have empirically achieved the desired result of 0% for both FRR and FAR.

Connected through hyperedge HE-1 (induced by source paper "dynamic backdoor attacks against machine learning models"):
  with members:
    - "memguard defending against black box membership inference attacks via adversarial examples"
    - "under the hood of membership inference attacks on aggregate location time series"
    - "updates leak data set inference and reconstruction attacks in online learning"
    - "exploiting unintended feature leakage in collaborative learning"
    - "knockoff nets stealing functionality of black box models"
    - "tagvisor a privacy advisor for sharing hashtags"
    - "the natural auditor how to tell if someone used your words to train their model"
    - "manipulating machine learning poisoning attacks and countermeasures for regression learning"

Connected through hyperedge HE-2 (induced by source paper "rab provable robustness against backdoor attacks"):
  with members:
    - "dynamic backdoor attacks against machine learning models"
    - "backdoor attacks against transfer learning with pre trained deep learning models"
    - "provable robust learning based on transformation specific smoothing"
    - "on certifying robustness against backdoor attacks via randomized smoothing"
    - "certified robustness to label flipping attacks via randomized smoothing"
    - "certified adversarial robustness via randomized smoothing"
    - "detecting backdoor attacks on deep neural networks by activation clustering"
    - "sentinet detecting physical attacks against deep learning systems"

Connected through hyperedge HE-3 (induced by source paper "februus input purification defense against trojan attacks on deep neural network systems"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "tabor a highly accurate approach to inspecting and restoring trojan backdoors in ai systems"
    - "detecting backdoor attacks on deep neural networks by activation clustering"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "sentinet detecting physical attacks against deep learning systems"
    - "hu fu hardware and software collaborative attack framework against neural networks"
    - "how to backdoor federated learning"
    - "hardware trojan attacks on neural networks"

Connected through hyperedge HE-4 (induced by source paper "nnoculation broad spectrum and targeted treatment of backdoored dnns"):
  with members:
    - "are adversarial perturbations a showstopper for ml based cad a case study on cnn based lithographic hotspot detection"
    - "defending neural backdoors via generative distribution modeling"
    - "wild patterns ten years after the rise of adversarial machine learning"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "generative adversarial networks an overview"
    - "spectral signatures in backdoor attacks"
    - "fastmri an open dataset and benchmarks for accelerated mri"
    - "unpaired image to image translation using cycle consistent adversarial networks"

Connected through hyperedge HE-5 (induced by source paper "on certifying robustness against backdoor attacks via randomized smoothing"):
  with members:
    - "macer attack free and scalable robust training via maximizing certified radius"
    - "certified robustness of community detection against adversarial structural perturbation via randomized smoothing"
    - "tight certificates of adversarial robustness for randomly smoothed classifiers"
    - "certified adversarial robustness via randomized smoothing"
    - "defending neural backdoors via generative distribution modeling"
    - "certified robustness for top k predictions against adversarial perturbations via randomized smoothing"
    - "tabor a highly accurate approach to inspecting and restoring trojan backdoors in ai systems"
    - "detecting backdoor attacks on deep neural networks by activation clustering"

Connected through hyperedge HE-6 (induced by source paper "adversarial learning in statistical classification a comprehensive review of defenses against attacks"):
  with members:
    - "revealing backdoors post training in dnn classifiers via novel inference on optimized perturbations inducing group misclassification"
    - "defensive quantization when efficiency meets robustness"
    - "revealing perceptible backdoors without the training set via the maximum achievable misclassification fraction statistic"
    - "wild patterns ten years after the rise of adversarial machine learning"
    - "detecting backdoor attacks on deep neural networks by activation clustering"
    - "lipschitz margin training scalable certification of perturbation invariance for deep neural networks"
    - "a mixture model based defense for data poisoning attacks against naive bayes spam filters"
    - "backdoor embedding in convolutional neural network models via invisible perturbation"

Connected through hyperedge HE-7 (induced by source paper "quantitative verification of neural networks and its security applications"):
  with members:
    - "phase transition behavior of cardinality and xor constraints"
    - "adversarial examples are a natural consequence of test error in noise"
    - "the curse of concentration in robust learning evasion and poisoning attacks from concentration of measure"
    - "formal security analysis of neural networks using symbolic intervals"
    - "a dual approach to scalable verification of deep networks"
    - "the secret sharer measuring unintended neural network memorization extracting secrets"
    - "adversarial spheres"
    - "reachability analysis of deep neural networks with provable guarantees"

Connected through hyperedge HE-8 (induced by source paper "refit a unified watermark removal framework for deep learning systems with limited data"):
  with members:
    - "robust watermarking of neural network with exponential weighting"
    - "tabor a highly accurate approach to inspecting and restoring trojan backdoors in ai systems"
    - "effectiveness of distillation attack and countermeasure on neural network watermarking"
    - "detecting backdoor attacks on deep neural networks by activation clustering"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "turning your weakness into a strength watermarking deep neural networks by backdooring"
    - "spectral signatures in backdoor attacks"
    - "bert pre training of deep bidirectional transformers for language understanding"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)