human: Given a node-centered hypergraph: <hypergraph>, where nodes represent papers and hyperedges represent sets of papers co-cited by a source paper.

Details of the hypergraph:
Center node: "prada protecting against dnn model stealing attacks"
  Abstract: As machine learning (ML) applications become increasingly prevalent, protecting the confidentiality of ML models becomes paramount for two reasons: (a) models may constitute a business advantage to its owner, and (b) an adversary may use a stolen model to find transferable adversarial examples that can be used to evade classification by the original model. One way to protect model confidentiality is to limit access to the model only via well-defined prediction APIs. This is common not only in machine-learning-as-a-service (MLaaS) settings where the model is remote, but also in scenarios like autonomous driving where the model is local but direct access to it is protected, for example, by hardware security mechanisms. Nevertheless, prediction APIs still leak information so that it is possible to mount model extraction attacks by an adversary who repeatedly queries the model via the prediction API. In this paper, we describe a new model extraction attack by combining a novel approach for generating synthetic queries together with recent advances in training deep neural networks. This attack outperforms state-of-the-art model extraction techniques in terms of transferability of targeted adversarial examples generated using the extracted model (+15-30 percentage points, pp), and in prediction accuracy (+15-20 pp) on two datasets. We then propose the first generic approach to effectively detect model extraction attacks: PRADA. It analyzes how the distribution of consecutive queries to the model evolves over time and raises an alarm when there are abrupt deviations. We show that PRADA can detect all known model extraction attacks with a 100% success rate and no false positives. PRADA is particularly suited for detecting extraction attacks against local models.

Connected through hyperedge HE-1 (induced by source paper "nass optimizing secure inference via neural architecture search"):
  with members:
    - "video action recognition via neural architecture searching"
    - "hardware software co exploration of neural architectures"
    - "accuracy vs efficiency achieving both through fpga implementation aware neural architecture search"
    - "auto deeplab hierarchical neural architecture search for semantic image segmentation"
    - "on neural architecture search for resource constrained hardware platforms"
    - "device circuit architecture co exploration for computing in memory neural accelerators"
    - "xonn xnor based oblivious deep neural network inference"
    - "gazelle a low latency framework for secure neural network inference"

Connected through hyperedge HE-2 (induced by source paper "model extraction attacks against recurrent neural networks"):
  with members:
    - "high fidelity extraction of neural network models"
    - "a framework for the extraction of deep neural networks by leveraging public data"
    - "dawn dynamic adversarial watermarking of neural networks"
    - "extraction of complex dnn models real threat or boogeyman"
    - "knockoff nets stealing functionality of black box models"
    - "csi neural network using side channels to recover your artificial neural network information"
    - "bert pre training of deep bidirectional transformers for language understanding"
    - "stealing hyperparameters in machine learning"

Connected through hyperedge HE-3 (induced by source paper "mitigating query flooding parameter duplication attack on regression models with high dimensional gaussian mechanism"):
  with members:
    - "mvg mechanism differential privacy under matrix valued query"
    - "stealing neural networks via timing side channels"
    - "utility optimized local differential privacy mechanisms for distribution estimation"
    - "stealing hyperparameters in machine learning"
    - "model extraction warning in mlaas paradigm"
    - "individual differential privacy a utility preserving formulation of differential privacy guarantees"
    - "practical black box attacks against machine learning"
    - "stealing machine learning models via prediction apis"

Connected through hyperedge HE-4 (induced by source paper "survey of attacks and defenses on edge deployed neural networks"):
  with members:
    - "tensorflow js machine learning for the web and beyond"
    - "bit flip attack crushing neural network with progressive bit search"
    - "xonn xnor based oblivious deep neural network inference"
    - "deeplaser practical fault attack on deep neural networks"
    - "knockoff nets stealing functionality of black box models"
    - "cache telepathy leveraging shared resource attacks to learn dnn architectures"
    - "mlcapsule guarded offline deployment of machine learning as a service"
    - "the secret sharer measuring unintended neural network memorization extracting secrets"

Connected through hyperedge HE-5 (induced by source paper "deep neural network fingerprinting by conferrable adversarial examples"):
  with members:
    - "structure matters towards generating transferable adversarial images"
    - "high fidelity extraction of neural network models"
    - "on the robustness of the backdoor based watermarking in deep neural networks"
    - "auto deeplab hierarchical neural architecture search for semantic image segmentation"
    - "ipguard protecting the intellectual property of deep neural networks via fingerprinting the classification boundary"
    - "how to prove your model belongs to you a blind watermark based framework to protect intellectual property of dnn"
    - "dawn dynamic adversarial watermarking of neural networks"
    - "on evaluating adversarial robustness"

Connected through hyperedge HE-6 (induced by source paper "thieves on sesame street model extraction of bert based apis"):
  with members:
    - "boolq exploring the surprising difficulty of natural yes no questions"
    - "right for the wrong reasons diagnosing syntactic heuristics in natural language inference"
    - "high fidelity extraction of neural network models"
    - "zero shot knowledge transfer via adversarial belief matching"
    - "learning and evaluating general linguistic intelligence"
    - "a framework for the extraction of deep neural networks by leveraging public data"
    - "membership inference attacks on sequence to sequence models"
    - "prediction poisoning utility constrained defenses against model stealing attacks"

Connected through hyperedge HE-7 (induced by source paper "making targeted black box evasion attacks effective and efficient"):
  with members:
    - "copy and paste a simple but effective initialization method for black box adversarial attacks"
    - "reducing adversarial example transferability using gradient regularization"
    - "autozoom autoencoder based zeroth order optimization method for attacking black box neural networks"
    - "model reuse attacks on deep learning systems"
    - "on the suitability of l_p norms for creating and preventing adversarial examples"
    - "query efficient black box attack by active learning"
    - "genattack practical black box attacks with gradient free optimization"
    - "black box adversarial attacks with limited queries and information"

Connected through hyperedge HE-8 (induced by source paper "high accuracy and high fidelity extraction of neural networks"):
  with members:
    - "s4l self supervised semi supervised learning"
    - "zero shot knowledge transfer via adversarial belief matching"
    - "a framework for the extraction of deep neural networks by leveraging public data"
    - "overlearning reveals sensitive attributes"
    - "rethinking deep active learning using unlabeled data at model training"
    - "combining mixmatch and active learning for better accuracy with fewer labels"
    - "on the learnability of deep random networks"
    - "xlnet generalized autoregressive pretraining for language understanding"

Question: Please tell me which class the center node belongs to. The 40 classes are: cs.NA(Numerical Analysis), cs.MM(Multimedia), cs.LO(Logic in Computer Science), cs.CY(Computers and Society), cs.CR(Cryptography and Security), cs.DC(Distributed, Parallel, and Cluster Computing), cs.HC(Human-Computer Interaction), cs.CE(Computational Engineering, Finance, and Science), cs.NI(Networking and Internet Architecture), cs.CC(Computational Complexity), cs.AI(Artificial Intelligence), cs.MA(Multiagent Systems), cs.GL(General Literature), cs.NE(Neural and Evolutionary Computing), cs.SC(Symbolic Computation), cs.AR(Hardware Architecture), cs.CV(Computer Vision and Pattern Recognition), cs.GR(Graphics), cs.ET(Emerging Technologies), cs.SY(Systems and Control), cs.CG(Computational Geometry), cs.OH(Other Computer Science), cs.PL(Programming Languages), cs.SE(Software Engineering), cs.LG(Machine Learning), cs.SD(Sound), cs.SI(Social and Information Networks), cs.RO(Robotics), cs.IT(Information Theory), cs.PF(Performance), cs.CL(Computation and Language), cs.IR(Information Retrieval), cs.MS(Mathematical Software), cs.FL(Formal Languages and Automata Theory), cs.DS(Data Structures and Algorithms), cs.OS(Operating Systems), cs.GT(Computer Science and Game Theory), cs.DB(Databases), cs.DL(Digital Libraries), cs.DM(Discrete Mathematics). Directly output the class name.

gpt: cs.CR(Cryptography and Security)