human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "model reuse attacks on deep learning systems"
  Abstract: Many of today's machine learning (ML) systems are built by reusing an array of, often pre-trained, primitive models, each fulfilling distinct functionality (e.g., feature extraction). The increasing use of primitive models significantly simplifies and expedites the development cycles of ML systems. Yet, because most of such models are contributed and maintained by untrusted sources, their lack of standardization or regulation entails profound security implications, about which little is known thus far. #R##N#In this paper, we demonstrate that malicious primitive models pose immense threats to the security of ML systems. We present a broad class of {\em model-reuse} attacks wherein maliciously crafted models trigger host ML systems to misbehave on targeted inputs in a highly predictable manner. By empirically studying four deep learning systems (including both individual and ensemble systems) used in skin cancer screening, speech recognition, face verification, and autonomous steering, we show that such attacks are (i) effective - the host systems misbehave on the targeted inputs as desired by the adversary with high probability, (ii) evasive - the malicious models function indistinguishably from their benign counterparts on non-targeted inputs, (iii) elastic - the malicious models remain effective regardless of various system design choices and tuning strategies, and (iv) easy - the adversary needs little prior knowledge about the data used for system tuning or inference. We provide analytical justification for the effectiveness of model-reuse attacks, which points to the unprecedented complexity of today's primitive models. This issue thus seems fundamental to many ML systems. We further discuss potential countermeasures and their challenges, which lead to several promising research directions.

Connected through hyperedge HE-1 (induced by source paper "sentinet detecting localized universal attacks against deep learning systems"):
  with members:
    - "on adaptive attacks to adversarial example defenses"
    - "on evaluating adversarial robustness"
    - "adversarial patch"
    - "yolov3 an incremental improvement"
    - "lavan localized and visible adversarial noise"
    - "anomaly detection using one class neural networks"
    - "review of deep learning"
    - "hardware trojan attacks on neural networks"

Connected through hyperedge HE-2 (induced by source paper "daedalus breaking non maximum suppression in object detection via adversarial examples"):
  with members:
    - "semantic adversarial examples"
    - "stochastic activation pruning for robust adversarial defense"
    - "adversarial patch"
    - "deep learning for generic object detection a survey"
    - "characterizing adversarial subspaces using local intrinsic dimensionality"
    - "yolov3 an incremental improvement"
    - "multi task learning as multi objective optimization"
    - "traits transferability of adversarial examples against instance segmentation object detection"

Connected through hyperedge HE-3 (induced by source paper "making targeted black box evasion attacks effective and efficient"):
  with members:
    - "copy and paste a simple but effective initialization method for black box adversarial attacks"
    - "reducing adversarial example transferability using gradient regularization"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "on the suitability of l_p norms for creating and preventing adversarial examples"
    - "query efficient black box attack by active learning"
    - "prada protecting against dnn model stealing attacks"
    - "genattack practical black box attacks with gradient free optimization"
    - "black box adversarial attacks with limited queries and information"

Connected through hyperedge HE-4 (induced by source paper "man in the middle attacks against machine learning classifiers via malicious generative models"):
  with members:
    - "diagnosing and enhancing vae models"
    - "semantic adversarial examples"
    - "zeroth order stochastic variance reduction for nonconvex optimization"
    - "genattack practical black box attacks with gradient free optimization"
    - "generating adversarial examples with adversarial networks"
    - "black box adversarial attacks with limited queries and information"
    - "obfuscated gradients give a false sense of security circumventing defenses to adversarial examples"
    - "adversarial examples are not easily detected bypassing ten detection methods"

Connected through hyperedge HE-5 (induced by source paper "the tale of evil twins adversarial inputs versus backdoored models"):
  with members:
    - "wild patterns ten years after the rise of adversarial machine learning"
    - "formal security analysis of neural networks using symbolic intervals"
    - "characterizing adversarial subspaces using local intrinsic dimensionality"
    - "adef an iterative algorithm to construct adversarial deformations"
    - "spectral signatures in backdoor attacks"
    - "poison frogs targeted clean label poisoning attacks on neural networks"
    - "feature squeezing detecting adversarial examples in deep neural networks"
    - "obfuscated gradients give a false sense of security circumventing defenses to adversarial examples"

Connected through hyperedge HE-6 (induced by source paper "shielding collaborative learning mitigating poisoning attacks through client side detection"):
  with members:
    - "analyzing federated learning through an adversarial lens"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "federated learning strategies for improving communication efficiency"
    - "privacy preserving collaborative deep learning with unreliable participants"
    - "backdooring convolutional neural networks via targeted weight perturbations"
    - "byzantine robust distributed learning towards optimal statistical rates"
    - "how to backdoor federated learning"
    - "mitigating sybils in federated learning poisoning"

Connected through hyperedge HE-7 (induced by source paper "a target agnostic attack on deep models exploiting security vulnerabilities of transfer learning"):
  with members:
    - "security of deep learning methodologies challenges and opportunities"
    - "how to achieve high classification accuracy with just a few labels a semi supervised approach using sampled packets"
    - "adversarial examples that fool both computer vision and time limited humans"
    - "deep learning for encrypted traffic classification an overview"
    - "backdoor embedding in convolutional neural network models via invisible perturbation"
    - "poison frogs targeted clean label poisoning attacks on neural networks"
    - "are you tampering with my data"
    - "the extreme value machine"

Connected through hyperedge HE-8 (induced by source paper "strip a defence against trojan attacks on deep neural networks"):
  with members:
    - "one pixel attack for fooling deep neural networks"
    - "tabor a highly accurate approach to inspecting and restoring trojan backdoors in ai systems"
    - "detecting backdoor attacks on deep neural networks by activation clustering"
    - "fine pruning defending against backdooring attacks on deep neural networks"
    - "sentinet detecting physical attacks against deep learning systems"
    - "turning your weakness into a strength watermarking deep neural networks by backdooring"
    - "backdoor embedding in convolutional neural network models via invisible perturbation"
    - "blackmarks black box multi bit watermarking for deep neural networks"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)