human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "poisoning attacks to graph based recommender systems"
  Abstract: Recommender system is an important component of many web services to help users locate items that match their interests. Several studies showed that recommender systems are vulnerable to poisoning attacks, in which an attacker injects fake data to a recommender system such that the system makes recommendations as the attacker desires. However, these poisoning attacks are either agnostic to recommendation algorithms or optimized to recommender systems (e.g., association-rule-based or matrix-factorization-based recommender systems) that are not graph-based. Like association-rule-based and matrix-factorization-based recommender systems, graph-based recommender system is also deployed in practice, e.g., eBay, Huawei App Store (a big app store in China). However, how to design optimized poisoning attacks for graph-based recommender systems is still an open problem.   In this work, we perform a systematic study on poisoning attacks to graph-based recommender systems. We consider an attacker's goal is to promote a target item to be recommended to as many users as possible. To achieve this goal, our a"acks inject fake users with carefully crafted rating scores to the recommender system. Due to limited resources and to avoid detection, we assume the number of fake users that can be injected into the system is bounded. The key challenge is how to assign rating scores to the fake users such that the target item is recommended to as many normal users as possible. To address the challenge, we formulate the poisoning attacks as an optimization problem, solving which determines the rating scores for the fake users. We also propose techniques to solve the optimization problem. We evaluate our attacks and compare them with existing attacks under white-box (recommendation algorithm and its parameters are known), gray-box (recommendation algorithm is known but its parameters are unknown), and blackbox (recommendation algorithm is unknown) settings using two real-world datasets. Our results show that our attack is effective and outperforms existing attacks for graph-based recommender systems. For instance, when 1% of users are injected fake users, our attack can make a target item recommended to 580 times more normal users in certain scenarios.

Connected through hyperedge HE-1 (induced by source paper "mga momentum gradient attack on network"):
  with members:
    - "unsupervised euclidean distance attack on network embedding"
    - "things you may not know about adversarial example a black box adversarial image attack"
    - "adversarial attack on graph structured data"
    - "adversarial training towards robust multimedia recommender system"
    - "adversarial attacks on node embeddings via graph poisoning"
    - "ga based q attack on community detection"
    - "adversarial examples that fool both computer vision and time limited humans"
    - "curriculum adversarial training"

Connected through hyperedge HE-2 (induced by source paper "influence function based data poisoning attacks to top n recommender systems"):
  with members:
    - "private and communication efficient edge learning a sparse differential gaussian masking distributed sgd approach"
    - "byzantine resilient stochastic gradient descent for distributed learning a lipschitz inspired coordinate wise median approach"
    - "on the accuracy of influence functions for measuring group effects"
    - "local model poisoning attacks to byzantine robust federated learning"
    - "attacking graph based classification via manipulating the graph structure"
    - "data dropout optimizing training data for convolutional neural networks"
    - "byzantine robust distributed learning towards optimal statistical rates"
    - "manipulating machine learning poisoning attacks and countermeasures for regression learning"

Connected through hyperedge HE-3 (induced by source paper "pots protective optimization technologies"):
  with members:
    - "discrimination through optimization how facebook s ad delivery can lead to biased outcomes"
    - "adversarial attacks on copyright detection systems"
    - "explaining explanations in ai"
    - "delayed impact of fair machine learning"
    - "wild patterns ten years after the rise of adversarial machine learning"
    - "the measure and mismeasure of fairness a critical review of fair machine learning"
    - "fighting offensive language on social media with unsupervised text style transfer"
    - "questioning the assumptions behind fairness solutions"

Connected through hyperedge HE-4 (induced by source paper "defending against machine learning based inference attacks via adversarial examples opportunities and challenges"):
  with members:
    - "certified adversarial robustness via randomized smoothing"
    - "misleading authorship attribution of source code using adversarial learning"
    - "mockingbird defending against deep learning based website fingerprinting attacks with adversarial traces"
    - "tagvisor a privacy advisor for sharing hashtags"
    - "generative adversarial privacy"
    - "graph based security and privacy analytics via collective classification with joint weight learning and propagation"
    - "adversarial binaries for authorship identification"
    - "calibrate frequency estimation and heavy hitter identification with local differential privacy via incorporating prior knowledge"

Connected through hyperedge HE-5 (induced by source paper "attacking graph based classification via manipulating the graph structure"):
  with members:
    - "adversarial attacks on graph neural networks via meta learning"
    - "certifiable robustness and robust training for graph convolutional networks"
    - "adversarial attack on graph structured data"
    - "adversarial attacks on node embeddings via graph poisoning"
    - "graph based security and privacy analytics via collective classification with joint weight learning and propagation"
    - "structure based sybil detection in social networks via local rule based propagation"
    - "manipulating machine learning poisoning attacks and countermeasures for regression learning"
    - "sybilfuse combining local attributes with global structure to perform robust sybil detection"

Connected through hyperedge HE-6 (induced by source paper "local model poisoning attacks to byzantine robust federated learning"):
  with members:
    - "attacking graph based classification via manipulating the graph structure"
    - "analyzing federated learning through an adversarial lens"
    - "exploiting unintended feature leakage in collaborative learning"
    - "federated learning strategies for improving communication efficiency"
    - "byzantine robust distributed learning towards optimal statistical rates"
    - "manipulating machine learning poisoning attacks and countermeasures for regression learning"
    - "is feature selection secure against training data poisoning"
    - "spectral signatures in backdoor attacks"

Connected through hyperedge HE-7 (induced by source paper "data poisoning attacks on neighborhood based recommender systems"):
  with members:
    - "data poisoning against differentially private learners attacks and defenses"
    - "data poisoning attack against knowledge graph embedding"
    - "are we really making much progress a worrying analysis of recent neural recommendation approaches"
    - "transferability in machine learning from phenomena to black box attacks using adversarial samples"
    - "you are who you know and how you behave attribute inference attacks via users social friends and behaviors"
    - "data poisoning attacks on factorization based collaborative filtering"
    - "adversarial machine learning at scale"
    - "bpr bayesian personalized ranking from implicit feedback"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.IR(Information Retrieval)