human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "darts deceiving autonomous cars with toxic signs"
  Abstract: Sign recognition is an integral part of autonomous cars. Any misclassification of traffic signs can potentially lead to a multitude of disastrous consequences, ranging from a life-threatening accident to a large-scale interruption of transportation services relying on autonomous cars. In this paper, we propose and examine realistic security attacks against sign recognition systems for Deceiving Autonomous caRs with Toxic Signs (we call the proposed attacks DARTS). #R##N#Leveraging the concept of adversarial examples, we modify innocuous signs/advertisements in the environment in such a way that they seem normal to human observers but are interpreted as the adversary's desired traffic sign by autonomous cars. Further, we pursue a fundamentally different perspective to attacking autonomous cars, motivated by the observation that the driver and vehicle-mounted camera see the environment from different angles (the camera commonly sees the road with a higher angle, e.g., from top of the car). We propose a novel attack against vehicular sign recognition systems: we create signs that change as they are viewed from different angles, and thus, can be interpreted differently by the driver and sign recognition. #R##N#We extensively evaluate the proposed attacks under various conditions: different distances, lighting conditions, and camera angles. We first examine our attacks virtually, i.e., we check if the digital images of toxic signs can deceive the sign recognition system. Further, we investigate the effectiveness of attacks in real-world settings: we print toxic signs, install them in the environment, capture videos using a vehicle-mounted camera, and process them using our sign recognition pipeline.

Connected through hyperedge HE-1 (induced by source paper "applying tensor decomposition to image for robustness against adversarial attack"):
  with members:
    - "adversarial attacks and defences competition"
    - "feature denoising for improving adversarial robustness"
    - "defense gan protecting classifiers against adversarial attacks using generative models"
    - "comdefend an efficient image compression model to defend adversarial examples"
    - "robust physical world attacks on deep learning models"
    - "adversarial examples are not easily detected bypassing ten detection methods"
    - "magnet a two pronged defense against adversarial examples"
    - "defense against adversarial attacks using high level representation guided denoiser"

Connected through hyperedge HE-2 (induced by source paper "robust binary classification with the 01 loss"):
  with members:
    - "hopskipjumpattack a query efficient decision based attack"
    - "curriculum loss robust learning and generalization against label corruption"
    - "theoretically principled trade off between robustness and accuracy"
    - "adversarial training can hurt generalization"
    - "attacking binarized neural networks"
    - "practical black box attacks against machine learning"
    - "transferability in machine learning from phenomena to black box attacks using adversarial samples"
    - "towards evaluating the robustness of neural networks"

Connected through hyperedge HE-3 (induced by source paper "a model based derivative free approach to black box adversarial examples bobyqa"):
  with members:
    - "on the effectiveness of low frequency perturbations"
    - "fake news detection on social media using geometric deep learning"
    - "square attack a query efficient black box adversarial attack via random search"
    - "stochastic activation pruning for robust adversarial defense"
    - "low frequency adversarial perturbation"
    - "robust physical world attacks on deep learning models"
    - "practical black box attacks against machine learning"
    - "towards evaluating the robustness of neural networks"

Connected through hyperedge HE-4 (induced by source paper "adversarial robustness via label smoothing"):
  with members:
    - "adversarial examples opportunities and challenges"
    - "threat of adversarial attacks on deep learning in computer vision a survey"
    - "regularizing neural networks by penalizing confident output distributions"
    - "a boundary tilting persepective on the phenomenon of adversarial examples"
    - "on the effectiveness of defensive distillation"
    - "towards evaluating the robustness of neural networks"
    - "robustness of classifiers from adversarial to random noise"
    - "adversarial machine learning at scale"

Connected through hyperedge HE-5 (induced by source paper "taking care of the discretization problem a black box adversarial image attack in discrete integer domain"):
  with members:
    - "towards improved testing for deep learning"
    - "one pixel attack for fooling deep neural networks"
    - "procedural noise adversarial examples for black box attacks on deep convolutional networks"
    - "on the design of black box adversarial examples by leveraging gradient free optimization and operator splitting method"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "spatially transformed adversarial examples"
    - "formal security analysis of neural networks using symbolic intervals"
    - "commandersong a systematic approach for practical adversarial voice recognition"

Connected through hyperedge HE-6 (induced by source paper "advhat real world adversarial attack on arcface face id system"):
  with members:
    - "one pixel attack for fooling deep neural networks"
    - "a general framework for adversarial examples with objectives"
    - "fooling automated surveillance cameras adversarial patches to attack person detection"
    - "adversarial patch"
    - "cosface large margin cosine loss for deep face recognition"
    - "seeing isn t believing practical adversarial attack against object detectors"
    - "yolov3 an incremental improvement"
    - "arcface additive angular margin loss for deep face recognition"

Connected through hyperedge HE-7 (induced by source paper "diminishing the effect of adversarial perturbations via refining feature representation"):
  with members:
    - "adversarial defense by restricting the hidden space of deep neural networks"
    - "detecting adversarial image examples in deep neural networks with adaptive noise reduction"
    - "enhancing the robustness of deep neural networks by boundary conditional gan"
    - "on evaluating adversarial robustness"
    - "medical image synthesis for data augmentation and anonymization using generative adversarial networks"
    - "vulnerability analysis of chest x ray image classification against adversarial attacks"
    - "benchmarking neural network robustness to common corruptions and surface variations"
    - "feature denoising for improving adversarial robustness"

Connected through hyperedge HE-8 (induced by source paper "upc learning universal physical camouflage attacks on object detectors"):
  with members:
    - "humans can decipher adversarial images"
    - "robust adversarial perturbation on deep proposal based models"
    - "did you hear that adversarial examples against automatic speech recognition"
    - "textbugger generating adversarial text against real world applications"
    - "yolov3 an incremental improvement"
    - "shapeshifter robust physical adversarial attack on faster r cnn object detector"
    - "dpatch an adversarial patch attack on object detectors"
    - "black box adversarial attacks with limited queries and information"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)