human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "targeted backdoor attacks on deep learning systems using data poisoning"
  Abstract: Deep learning models have achieved high performance on many tasks, and thus have been applied to many security-critical scenarios. For example, deep learning-based face recognition systems have been used to authenticate users to access many security-sensitive applications like payment apps. Such usages of deep learning systems provide the adversaries with sufficient incentives to perform attacks against these systems for their adversarial purposes. In this work, we consider a new type of attacks, called backdoor attacks, where the attacker's goal is to create a backdoor into a learning-based authentication system, so that he can easily circumvent the system by leveraging the backdoor. Specifically, the adversary aims at creating backdoor instances, so that the victim learning system will be misled to classify the backdoor instances as a target label specified by the adversary. In particular, we study backdoor poisoning attacks, which achieve backdoor attacks using poisoning strategies. Different from all existing work, our studied poisoning strategies can apply under a very weak threat model: (1) the adversary has no knowledge of the model and the training set used by the victim system; (2) the attacker is allowed to inject only a small amount of poisoning samples; (3) the backdoor key is hard to notice even by human beings to achieve stealthiness. We conduct evaluation to demonstrate that a backdoor adversary can inject only around 50 poisoning samples, while achieving an attack success rate of above 90%. We are also the first work to show that a data poisoning attack can create physically implementable backdoors without touching the training process. Our work demonstrates that backdoor poisoning attacks pose real threats to a learning system, and thus highlights the importance of further investigation and proposing defense strategies against them.

Connected through hyperedge HE-1 (induced by source paper "vulnerabilities of connectionist ai applications evaluation and defence"):
  with members:
    - "towards ground truth evaluation of visual explanations"
    - "continual lifelong learning with neural networks a review"
    - "programmable neural network trojan for pre trained feature extractor"
    - "hidden trigger backdoor attacks"
    - "adversarial attacks and defenses in images graphs and text a review"
    - "on evaluating adversarial robustness"
    - "explainable ai for trees from local explanations to global understanding"
    - "wild patterns ten years after the rise of adversarial machine learning"

Connected through hyperedge HE-2 (induced by source paper "humpty dumpty controlling word meanings via corpus poisoning"):
  with members:
    - "towards a robust deep neural network in text domain a survey"
    - "universal adversarial triggers for attacking and analyzing nlp"
    - "cross lingual alignment of contextual word embeddings with applications to zero shot dependency parsing"
    - "understanding the origins of bias in word embeddings"
    - "adversarial attacks on node embeddings via graph poisoning"
    - "black box generation of adversarial text sequences to evade deep learning classifiers"
    - "deep text classification can be fooled"
    - "towards understanding linear word analogies"

Connected through hyperedge HE-3 (induced by source paper "certified robustness to label flipping attacks via randomized smoothing"):
  with members:
    - "tight certificates of adversarial robustness for randomly smoothed classifiers"
    - "on defending against label flipping attacks on malware detection systems"
    - "certified adversarial robustness via randomized smoothing"
    - "provably robust deep learning via adversarially trained smoothed classifiers"
    - "compressed sensing with adversarial sparse noise via l1 regression"
    - "learning with bad training data via iterative trimmed loss minimization"
    - "efficient algorithms and lower bounds for robust linear regression"
    - "representer point selection for explaining deep neural networks"

Connected through hyperedge HE-4 (induced by source paper "rab provable robustness against backdoor attacks"):
  with members:
    - "dynamic backdoor attacks against machine learning models"
    - "backdoor attacks against transfer learning with pre trained deep learning models"
    - "provable robust learning based on transformation specific smoothing"
    - "on certifying robustness against backdoor attacks via randomized smoothing"
    - "certified robustness to label flipping attacks via randomized smoothing"
    - "certified adversarial robustness via randomized smoothing"
    - "strip a defence against trojan attacks on deep neural networks"
    - "detecting backdoor attacks on deep neural networks by activation clustering"

Connected through hyperedge HE-5 (induced by source paper "februus input purification defense against trojan attacks on deep neural network systems"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "strip a defence against trojan attacks on deep neural networks"
    - "tabor a highly accurate approach to inspecting and restoring trojan backdoors in ai systems"
    - "detecting backdoor attacks on deep neural networks by activation clustering"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "sentinet detecting physical attacks against deep learning systems"
    - "hu fu hardware and software collaborative attack framework against neural networks"
    - "how to backdoor federated learning"

Connected through hyperedge HE-6 (induced by source paper "towards probabilistic verification of machine unlearning"):
  with members:
    - "formalizing data deletion in the context of the right to be forgotten"
    - "nnoculation broad spectrum and targeted treatment of backdoored dnns"
    - "machine unlearning linear filtration for logit based classifiers"
    - "bypassing backdoor detection algorithms in deep learning"
    - "hidden trigger backdoor attacks"
    - "making ai forget you data deletion in machine learning"
    - "certified data removal from machine learning models"
    - "auditing data provenance in text generation models"

Connected through hyperedge HE-7 (induced by source paper "nnoculation broad spectrum and targeted treatment of backdoored dnns"):
  with members:
    - "are adversarial perturbations a showstopper for ml based cad a case study on cnn based lithographic hotspot detection"
    - "strip a defence against trojan attacks on deep neural networks"
    - "defending neural backdoors via generative distribution modeling"
    - "wild patterns ten years after the rise of adversarial machine learning"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "generative adversarial networks an overview"
    - "spectral signatures in backdoor attacks"
    - "fastmri an open dataset and benchmarks for accelerated mri"

Connected through hyperedge HE-8 (induced by source paper "backdoor attacks against transfer learning with pre trained deep learning models"):
  with members:
    - "defending against misclassification attacks in transfer learning"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "is feature selection secure against training data poisoning"
    - "potrojan powerful neural level trojan designs in deep learning models"
    - "feature squeezing detecting adversarial examples in deep neural networks"
    - "generative poisoning attack method against neural networks"
    - "magnet a two pronged defense against adversarial examples"
    - "towards poisoning of deep learning algorithms with back gradient optimization"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)