human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "defensive dropout for hardening deep neural networks under adversarial attacks"
  Abstract: Deep neural networks (DNNs) are known vulnerable to adversarial attacks. That is, adversarial examples, obtained by adding delicately crafted distortions onto original legal inputs, can mislead a DNN to classify them as any target labels. This work provides a solution to hardening DNNs under adversarial attacks through defensive dropout. Besides using dropout during training for the best test accuracy, we propose to use dropout also at test time to achieve strong defense effects. We consider the problem of building robust DNNs as an attacker-defender two-player game, where the attacker and the defender know each others' strategies and try to optimize their own strategies towards an equilibrium. Based on the observations of the effect of test dropout rate on test accuracy and attack success rate, we propose a defensive dropout algorithm to determine an optimal test dropout rate given the neural network model and the attacker's strategy for generating adversarial examples. We also investigate the mechanism behind the outstanding defense effects achieved by the proposed defensive dropout. Comparing with stochastic activation pruning (SAP), another defense method through introducing randomness into the DNN model, we find that our defensive dropout achieves much larger variances of the gradients, which is the key for the improved defense effects (much lower attack success rate). For example, our defensive dropout can reduce the attack success rate from 100% to 13.89% under the currently strongest attack i.e., C&W attack on MNIST dataset.

Connected through hyperedge HE-1 (induced by source paper "towards query efficient black box adversary with zeroth order natural gradient descent"):
  with members:
    - "topology attack and defense for graph neural networks an optimization perspective"
    - "on the design of black box adversarial examples by leveraging gradient free optimization and operator splitting method"
    - "fault sneaking attack a stealthy framework for misleading deep neural networks"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "hessian aware zeroth order optimization for black box adversarial attack"
    - "did you hear that adversarial examples against automatic speech recognition"
    - "black box adversarial attacks with limited queries and information"
    - "structured adversarial attack towards general implementation and better interpretability"

Connected through hyperedge HE-2 (induced by source paper "rtmobile beyond real time mobile acceleration of rnns for speech recognition"):
  with members:
    - "deepsz a novel framework to compress deep neural networks by using error bounded lossy compression"
    - "protecting neural networks with hierarchical random switching towards better robustness accuracy trade off for stochastic defenses"
    - "2pfpce two phase filter pruning based on conditional entropy"
    - "admm nn an algorithm hardware co design framework of dnns using alternating direction method of multipliers"
    - "systematic weight pruning of dnns using alternating direction method of multipliers"
    - "soft filter pruning for accelerating deep convolutional neural networks"
    - "e rnn design optimization for efficient recurrent neural networks in fpgas"
    - "channel pruning for accelerating very deep neural networks"

Connected through hyperedge HE-3 (induced by source paper "advms a multi source multi cost defense against adversarial attacks"):
  with members:
    - "protecting neural networks with hierarchical random switching towards better robustness accuracy trade off for stochastic defenses"
    - "adversarial t shirt evading person detectors in a physical world"
    - "breaking transferability of adversarial samples with randomness"
    - "is robustness the cost of accuracy a comprehensive study on the robustness of 18 deep image classification models"
    - "obfuscated gradients give a false sense of security circumventing defenses to adversarial examples"
    - "keeping the bad guys out protecting and vaccinating deep learning with jpeg compression"
    - "mtdeep boosting the security of deep neural nets against adversarial attacks with moving target defense"
    - "synthesizing robust adversarial examples"

Connected through hyperedge HE-4 (induced by source paper "adversarial perturbations on the perceptual ball"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "understanding deep networks via extremal perturbations and smooth masks"
    - "interpretable and fine grained visual explanations for convolutional neural networks"
    - "interpretable counterfactual explanations guided by prototypes"
    - "universal adversarial perturbations against person re identification"
    - "the odds are odd a statistical test for detecting adversarial examples"
    - "counterfactual visual explanations"
    - "hardening deep neural networks via adversarial model cascades"

Connected through hyperedge HE-5 (induced by source paper "on the design of black box adversarial examples by leveraging gradient free optimization and operator splitting method"):
  with members:
    - "topology attack and defense for graph neural networks an optimization perspective"
    - "defensive quantization when efficiency meets robustness"
    - "fault sneaking attack a stealthy framework for misleading deep neural networks"
    - "interpreting adversarial examples by activation promotion and suppression"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "adversarial generative nets neural network attacks on state of the art face recognition"
    - "exploring the space of black box attacks on deep neural networks"
    - "black box adversarial attacks with limited queries and information"

Connected through hyperedge HE-6 (induced by source paper "fault sneaking attack a stealthy framework for misleading deep neural networks"):
  with members:
    - "adversarial generative nets neural network attacks on state of the art face recognition"
    - "is feature selection secure against training data poisoning"
    - "an admm based universal framework for adversarial attacks on deep neural networks"
    - "efficient neural network robustness certification with general activation functions"
    - "robust physical world attacks on deep learning models"
    - "adversarial examples are not easily detected bypassing ten detection methods"
    - "yes machine learning can be more secure a case study on android malware detection"
    - "randomized prediction games for adversarial machine learning"

Connected through hyperedge HE-7 (induced by source paper "protecting neural networks with hierarchical random switching towards better robustness accuracy trade off for stochastic defenses"):
  with members:
    - "fault sneaking attack a stealthy framework for misleading deep neural networks"
    - "adversarial reprogramming of neural networks"
    - "is robustness the cost of accuracy a comprehensive study on the robustness of 18 deep image classification models"
    - "an admm based universal framework for adversarial attacks on deep neural networks"
    - "obfuscated gradients give a false sense of security circumventing defenses to adversarial examples"
    - "adversarial examples are not easily detected bypassing ten detection methods"
    - "synthesizing robust adversarial examples"
    - "towards robust neural networks via random self ensemble"

Connected through hyperedge HE-8 (induced by source paper "random spiking and systematic evaluation of defenses against adversarial examples"):
  with members:
    - "theoretically principled trade off between robustness and accuracy"
    - "on evaluating adversarial robustness"
    - "audio adversarial examples targeted attacks on speech to text"
    - "feature squeezing detecting adversarial examples in deep neural networks"
    - "obfuscated gradients give a false sense of security circumventing defenses to adversarial examples"
    - "adversarial examples are not easily detected bypassing ten detection methods"
    - "magnet a two pronged defense against adversarial examples"
    - "magnet and efficient defenses against adversarial attacks are not robust to adversarial examples"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)