human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "interpretable deep learning under fire"
  Abstract: Providing explanations for deep neural network (DNN) models is crucial for their usability in security-sensitive domains. A plethora of interpretation models have been proposed to help end users understand the inner workings of DNNs: how does a DNN arrive at a specific decision for a given input? The improved interpretability is believed to offer a sense of security by involving human in the decision-making process. However, due to its data-driven nature, this interpretability itself is potentially susceptible to malicious manipulations, about which little is known thus far. #R##N#In this paper, we bridge this gap by conducting the first systematic study on the security of interpretable deep learning systems (IDLSes). We demonstrate that existing IDLSes are highly vulnerable to adversarial manipulations. Specifically, we present ADV^2, a general class of attacks that generate adversarial inputs not only misleading target DNNs but also deceiving their coupled interpretation models. Through empirical evaluation against four major types of IDLSes on benchmark datasets and in security-critical applications (e.g., skin cancer diagnosis), we show that with ADV^2 the adversary is able to arbitrarily designate an input's prediction and interpretation simultaneously. Moreover, with both analytical and empirical evidence, we identify the prediction-interpretation gap as one possible cause of this vulnerability -- a DNN and its interpretation model are often only partially aligned, resulting in the possibility to exploit both models simultaneously. Finally, we explore potential countermeasures against ADV^2, including leveraging its low transferability and incorporating it in an adversarial training framework. Our findings shed light on designing and operating IDLSes in a more secure and informative fashion, leading to several promising research directions.

Connected through hyperedge HE-1 (induced by source paper "aggregating explanation methods for stable and robust explainability"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "fairwashing the risk of rationalization"
    - "fooling neural network interpretations via adversarial model manipulation"
    - "a human grounded evaluation benchmark for local explanations of machine learning"
    - "explaining image classifiers by counterfactual generation"
    - "sanity checks for saliency maps"
    - "smoothgrad removing noise by adding noise"
    - "explaining nonlinear classification decisions with deep taylor decomposition"

Connected through hyperedge HE-2 (induced by source paper "heat and blur an effective and fast defense against adversarial examples"):
  with members:
    - "concise explanations of neural networks using adversarial training"
    - "adversarial examples are a natural consequence of test error in noise"
    - "explaining convolutional neural networks using softmax gradient layer wise relevance propagation"
    - "saliency methods for explaining adversarial attacks"
    - "interpreting adversarial examples by activation promotion and suppression"
    - "spatially transformed adversarial examples"
    - "concise and stable explanations using adversarial training"
    - "feature squeezing detecting adversarial examples in deep neural networks"

Connected through hyperedge HE-3 (induced by source paper "on the benefits of attributional robustness"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "attention based dropout layer for weakly supervised object localization"
    - "robust attribution regularization"
    - "interpretable and fine grained visual explanations for convolutional neural networks"
    - "theoretically principled trade off between robustness and accuracy"
    - "benchmarking neural network robustness to common corruptions and perturbations"
    - "defense against adversarial attacks using feature scattering based adversarial training"
    - "harnessing the vulnerability of latent layers in adversarially trained models"

Connected through hyperedge HE-4 (induced by source paper "interpreting adversarial examples with attributes"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "one pixel attack for fooling deep neural networks"
    - "on evaluating adversarial robustness"
    - "towards explanation of dnn based prediction with guided feature inversion"
    - "grounding visual explanations"
    - "multimodal explanations justifying decisions and pointing to the evidence"
    - "a large scale attribute dataset for zero shot learning"
    - "techniques for interpretable machine learning"

Connected through hyperedge HE-5 (induced by source paper "on the in fidelity and sensitivity for explanations"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "certified adversarial robustness via randomized smoothing"
    - "towards robust locally linear deep networks"
    - "gnn explainer a tool for post hoc explanation of graph neural networks"
    - "counterfactual visual explanations"
    - "interpreting black box predictions using fisher kernels"
    - "representer point selection for explaining deep neural networks"
    - "model agnostic supervised local explanations"

Connected through hyperedge HE-6 (induced by source paper "explaining deep learning based networked systems"):
  with members:
    - "neural packet classification"
    - "hyper sagnn a self attention based graph neural network for hypergraphs"
    - "tensorflow js machine learning for the web and beyond"
    - "pforest in network inference with random forests"
    - "interpreting and improving natural language processing in machines with natural language processing in the brain"
    - "fooling neural network interpretations via adversarial model manipulation"
    - "gnn explainer a tool for post hoc explanation of graph neural networks"
    - "mmalfm explainable recommendation by leveraging reviews and images"

Connected through hyperedge HE-7 (induced by source paper "fooling neural network interpretations via adversarial model manipulation"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "adversarial training for free"
    - "the odds are odd a statistical test for detecting adversarial examples"
    - "defense gan protecting classifiers against adversarial attacks using generative models"
    - "turning your weakness into a strength watermarking deep neural networks by backdooring"
    - "a survey of methods for explaining black box models"
    - "rise randomized input sampling for explanation of black box models"
    - "obfuscated gradients give a false sense of security circumventing defenses to adversarial examples"

Connected through hyperedge HE-8 (induced by source paper "interpreting adversarial examples by activation promotion and suppression"):
  with members:
    - "grad cam visual explanations from deep networks via gradient based localization"
    - "topology attack and defense for graph neural networks an optimization perspective"
    - "ml loo detecting adversarial examples with feature attribution"
    - "spatially transformed adversarial examples"
    - "adversarial patch"
    - "improved robustness to adversarial examples using lipschitz regularization of the loss"
    - "asp a fast adversarial attack example generation framework based on adversarial saliency prediction"
    - "lavan localized and visible adversarial noise"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)