DETAILED ACTION
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
2. Applicant’s submission filed on 22 September 2025 [hereinafter Response] has been entered, where:
Claims 1, 8, 10, 11, and 12 have been amended.
Claims 1-12 are pending.
Claims 1-12 are rejected.
Examiner notes that foreign priority is claimed to EP 20169266, filed 14 April 2020. A certified copy of this paper has been filed 03 May 2021. Accordingly, receipt is acknowledged of certified copies of papers required by 37 CFR 1.55.
Claim Rejections - 35 U.S.C. § 101
3. 35 U.S.C. § 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
4. Claims 1-12 are rejected under 35 U.S.C. § 101 because the claimed invention is directed to an abstract idea without significantly more.
Claim 1 recites a computer-implemented method, which is a process, and thus one of the statutory categories of patentable subject matter. (35 U.S.C. § 101).
However, under Step 2A Prong One, the claim recites the limitation of “selecting at random a first perturbation from the set of perturbations for an input signal and a corresponding desired output signal from the subset,” “obtaining a second perturbation by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier,” and “obtaining a first adversarial example by applying the second perturbation to the input signal.” These activities of “selecting at random,” “obtaining . . . by adapting,” and “obtaining a first adversarial example by applying” are limitations that can practically be performed in the human mind, including, for example, observations, evaluations, judgments, and opinions, and accordingly, recite a mental process, (MPEP § 2106.04(a)(2) sub III), and is one of the groupings of abstract ideas. (MPEP § 2106.04(a)(2)). The claim also recites more details and specifics to the abstract idea of “obtaining a second perturbation,” where “a second perturbation, which is stronger than the first perturbation . . . in that the second perturbation is more apt to be used for fooling the classifier than the first perturbation,” and “the first perturbation or the second perturbation is initialized as random noise,” and accordingly, are merely more specific to the abstract idea. Examiner notes that the plain meaning of the term “random” is lacking a predictable pattern or order. Accordingly, the broadest reasonable interpretation of the claim term “selecting at random” is a selection lacking a predictable pattern or order, which is not inconsistent with the Applicant’s disclosure, (MPEP § 2111), that covers the teachings of Ratner where values may be modified, or perturbed, inherently without a given order or sequence. Thus, claim 1 recites an abstract idea.
Under Step 2A Prong Two, the claim as a whole is not integrated into a practical application, because the additional elements recited in the claim beyond the identified judicial exception include “a computer-implemented method,” and “a classifier.” These are additional elements used to implement the abstract idea, which do not serve to integrate the abstract idea into a practical application. (MPEP § 2106.05(f)). The claim also recites the limitation of a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not serve to integrate the abstract idea into a practical application. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not integrate the abstract idea into a practical application. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are insignificant extra-solution activities of mere data gathering, (MPEP § 2016.05(g)), and do not integrate the abstract idea into a practical application. Therefore, claim 1 is directed to the abstract idea.
Finally, under Step 2B, the additional elements, taken alone or in combination, do not represent significantly more than the abstract idea itself. the additional elements recited in the claim beyond the identified judicial exception include “a computer-implemented method,” and “a classifier.” These are additional elements used to implement the abstract idea, which do not amount to significantly more than the abstract idea. (MPEP § 2106.05(f)). The claim also recites the limitation of a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not amount to significantly more than the abstract idea. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not amount to significantly more than the abstract idea. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal from a first dataset of training samples,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are well-understood, routine, and conventional activities of storing and retrieving information in memory, (MPEP § 2106.05(d) sub II.iv), which do not amount to significantly more than the abstract idea. Therefore, claim 1 is subject-matter ineligible.
Claim 2 depends from claim 1. The claim provides more details or specifics to the additional element of the “classifier,” (claim 2: “wherein the classifier is pretrained on the first dataset or another dataset and one or multiple perturbations from the set of perturbations are provided based on a corresponding set of second adversarial examples of the classifier”), and thus, is merely more specific to the additional element. The abstract idea of these claims are not integrated into a practical application, (see MPEP § 2106.04(d)), nor do they amount to significantly more than the abstract idea, (MPEP § 2106.05), because the claims recite no more than the abstract idea. Thus, claim 2 is subject-matter ineligible.
Claim 3 depends directly or indirectly from claim 1. The claim provides more details or specifics to the additional element of the “classifier,” (claim 3: “wherein a second adversarial example from the set of second adversarial examples is provided based on random noise.”), and thus, is merely more specific to the additional element. The abstract idea of these claims are not integrated into a practical application, (see MPEP § 2106.04(d)), nor do they amount to significantly more than the abstract idea, (MPEP § 2106.05), because the claims recite no more than the abstract idea. Thus, claim 3 is subject-matter ineligible.
Claim 4 depends directly or indirectly from claim 1. The claim provides more details or specifics to the additional element of the “classifier,” (claim 4: “wherein the second adversarial example is provided based on applying random noise at a random location of an input signal from the first dataset”), and thus, is merely more specific to the additional element. The abstract idea of these claims are not integrated into a practical application, (see MPEP § 2106.04(d)), nor do they amount to significantly more than the abstract idea, (MPEP § 2106.05), because the claims recite no more than the abstract idea. Thus, claim 4 is subject-matter ineligible.
Claim 5 depends directly or indirectly from claim 1. Claim 5 recites the limitations of “wherein one or multiple perturbations from the set of perturbations are provided according to the following steps: “selecting a subset of input signals from the first dataset,” “adapting each of the input signals . . . by scaling a plurality of values in the input signal in the selected subset,” “applying the adapted input signals as perturbations to input signals of the first dataset to obtain a set of new input signals,” “determining a first value for each of the adapted input signals,” and “ranking the adapted input signals by their corresponding first values and providing a desired amount of the best ranked adapted input signals as perturbations.” These limitations of selecting, adapting, scaling, applying, and determining recite a “mental process,” (MPEP § 2106.04(a)(2) sub III), which are one of the groupings of abstract ideas. (MPEP § 2106.04(a)(2)). The claim also recites more details or specifics to the abstract ideas of applying and determining, by “[applying the adapted input signals] . . . , wherein each of the adapted input signals is applied to a plurality of input signals of the first dataset, and wherein each of the new input signals from the set of new input signals corresponds to an adapted input signal,” and “[determining a first value] . . . , wherein a first value characterizes an ability of the corresponding adapted input signal to fool the classifier when used as perturbation, and wherein the first value is determined based on an ability of the new input signals corresponding to the adapted input signal to fool the classifier,” and accordingly, are merely more specific to the abstract idea. Thus, claim 5 is directed to an abstract idea, and without more, is subject-matter ineligible.
Claim 6 depends directly or indirectly from claim 1. The claim recites more details or specifics to the additional element of using the classifier (claim 6: “wherein the classifier is trained by supplying the first adversarial example to the classifier and using the corresponding desired output signal as a desired output signal for the adversarial example”), and accordingly, is merely more specific to the additional element. The abstract idea of these claims are not integrated into a practical application, (see MPEP § 2106.04(d)), nor do they amount to significantly more than the abstract idea, (MPEP § 2106.05), because the claims recite no more than the abstract idea. Thus, claim 6 is subject-matter ineligible.
Claim 7 depends from claim 1. The claim recites the additional element of “training the classifier based on the input signal and the corresponding desired output signal,” which is simply using the generic computer component (that is, the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), and thus does not serve to integrate the abstract idea into a practical application, nor does it amount to significantly more than the abstract idea. Thus, claim 7 is subject-matter ineligible.
Claim 8 recites a computer-implemented method, which is a process, and thus one of the statutory categories of patentable subject matter. (35 U.S.C. § 101). However, under Step 2A Prong One, the claim recites the limitation of “selecting at random a first perturbation from the set of perturbations for an input signal and a corresponding desired output signal from the subset,” “obtaining a second perturbation by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier,” and “obtaining a first adversarial example by applying the second perturbation to the input signal.” Examiner notes that the plain meaning of the term “random” is lacking a predictable pattern or order. Accordingly, the broadest reasonable interpretation of the claim term “selecting at random” is a selection lacking a predictable pattern or order, which is not inconsistent with the Applicant’s disclosure, (MPEP § 2111), that covers the teachings of Ratner where values may be modified, or perturbed, inherently without a given order or sequence. These activities of “selecting at random,” “obtaining . . . by adapting,” and “obtaining a first adversarial example by applying” are limitations that can practically be performed in the human mind, including, for example, observations, evaluations, judgments, and opinions, and accordingly, are a mental process, (MPEP § 2106.04(a)(2) sub III), and is one of the groupings of abstract ideas. (MPEP § 2106.04(a)(2)). The claim also recites more details and specifics to the abstract idea of “obtaining a second perturbation,” where “a second perturbation, which is stronger than the first perturbation . . . in that the second perturbation is more apt to be used for fooling the classifier than the first perturbation,” and “the first perturbation or the second perturbation is initialized as random noise,” and accordingly, are merely more specific to the abstract idea. Thus, claim 8 recites an abstract idea.
Under Step 2A Prong Two, the claim as a whole is not integrated into a practical application, because the additional elements recited in the claim beyond the identified judicial exception include “a computer-implemented method,” “a classifier,” and “a control system.” These are additional elements used to implement the abstract idea, which do not serve to integrate the abstract idea into a practical application. (MPEP § 2106.05(f)). The claim also recites the limitation that a “classifier that includes a neural network,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not serve to integrate the abstract idea into a practical application. The claim also recites the additional element of “training a classifier that includes a neural network,” and “adapting the classifier by training the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which are simply using the generic computer component (that is, the classifier that includes a neural network) to implement the abstract idea, (MPEP § 2106.05(f)), which does not integrate the abstract idea into a practical application. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal from a first dataset of training samples,” “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation,” “providing the classifier in a control system,” and “obtaining the output signal from the control system, wherein the control system supplies the input signal to the classifier to obtain the output signal. These activities of providing, replacing, and obtaining are insignificant extra-solution activities of mere data gathering, (MPEP § 2016.05(g)), and do not integrate the abstract idea into a practical application. Also, the “providing the classifier in a control system” is generally linking the use of a judicial exception to particular technological environment or field of use," (MPEP § 2106.05(h)), and cannot integrate the judicial exception into a practical application. Therefore, claim 8 is directed to the abstract idea.
Finally, under Step 2B, the additional elements, taken alone or in combination, do not represent significantly more than the abstract idea itself. the additional elements recited in the claim beyond the identified judicial exception include “a computer-implemented method,” “a classifier,” and “a control system.” These are additional elements used to implement the abstract idea, which do not amount to significantly more than the abstract idea. (MPEP § 2106.05(f)). The claim also recites the limitation that a “classifier that includes a neural network,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not amount to significantly more than the abstract idea. The claim also recites the additional elements of “training a classifier” and “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not amount to significantly more than the abstract idea. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation,” “providing the classifier in a control system,” and “obtaining the output signal from the control system, wherein the control system supplies the input signal to the classifier to obtain the output signal. These activities of providing, replacing, and obtaining are well-understood, routine, and conventional activities of storing and retrieving information in memory, (MPEP § 2106.05(d) sub II.iv), which do not amount to significantly more than the abstract idea. Also, the “providing the classifier in a control system” is generally linking the use of a judicial exception to particular technological environment or field of use," (MPEP § 2106.05(h)), and cannot amount to significantly more than the abstract idea. Therefore, claim 8 is subject-matter ineligible.
Claim 9 depends from claim 8. The claim recites more specifics or details of the additional element of an “input signal,” “wherein the input signal is obtained based on a signal of a sensor and/or an actuator is controlled based on the output signal and/or a display device is controlled based on the output signal,” and accordingly, is more specific to the additional element. The claim also recites additional elements of “a sensor,” or “an actuator,” or “a display device,” which are generic computer components upon which the abstract idea is implemented, (MPEP § 2106.05(f)), that do not serve to integrate the abstract idea into a practical application, nor do they amount to significantly more than an abstract idea. Also, the claim recites the limitation of the generic computer components “is controlled based on the output signal,” which is mere data gathering, (MPEP § 2106.05(g)), and does not integrate the abstract idea into a practical application, and also, is a well-understood, routine, and conventional activity of receiving or transmitting data over a network, (MPEP § 2106.05(d) sub II.i), that does not amount to significantly more than an abstract idea. Thus, claim 9 is subject-matter ineligible.
Claim 10 recites a control system, which is a machine, and thus one of the statutory categories of patentable subject matter. (35 U.S.C. § 101). However, under Step 2A Prong One, the claim recites the limitation of “selecting at random a first perturbation from the set of perturbations for an input signal and a corresponding desired output signal from the subset,” “obtaining a second perturbation by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier,” and “obtaining a first adversarial example by applying the second perturbation to the input signal.” Examiner notes that the plain meaning of the term “random” is lacking a predictable pattern or order. Accordingly, the broadest reasonable interpretation of the claim term “selecting at random” is a selection lacking a predictable pattern or order, which is not inconsistent with the Applicant’s disclosure, (MPEP § 2111), that covers the teachings of Ratner where values may be modified, or perturbed, inherently without a given order or sequence. These activities of “selecting at random,” “obtaining . . . by adapting,” and “obtaining a first adversarial example by applying” are limitations that can practically be performed in the human mind, including, for example, observations, evaluations, judgments, and opinions, and accordingly, are a mental process, (MPEP § 2106.04(a)(2) sub III), and is one of the groupings of abstract ideas. (MPEP § 2106.04(a)(2)). The claim also recites more details and specifics to the abstract idea of “obtaining a second perturbation,” where “a second perturbation, which is stronger than the first perturbation . . . in that the second perturbation is more apt to be used for fooling the classifier than the first perturbation,” and “the first perturbation or the second perturbation is initialized as random noise,” and accordingly, are merely more specific to the abstract idea. Thus, claim 10 recites an abstract idea.
Under Step 2A Prong Two, the claim as a whole is not integrated into a practical application, because the additional elements recited in the claim beyond the identified judicial exception include “a control system,” and “a classifier,” or “an actuator,” or “display device.” These are additional elements used to implement the abstract idea, which do not serve to integrate the abstract idea into a practical application. (MPEP § 2106.05(f)). The claim also recites the limitation that a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not serve to integrate the abstract idea into a practical application. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not integrate the abstract idea into a practical application. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are insignificant extra-solution activities of mere data gathering, (MPEP § 2016.05(g)), and do not integrate the abstract idea into a practical application. Therefore, claim 10 is directed to the abstract idea.
Finally, under Step 2B, the additional elements, taken alone or in combination, do not represent significantly more than the abstract idea itself. the additional elements recited in the claim beyond the identified judicial exception include “a control system,” and “a classifier,” or “an actuator,” or “display device.” These are additional elements used to implement the abstract idea, which do not amount to significantly more than the abstract idea. (MPEP § 2106.05(f)). The claim also recites the limitation of a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not amount to significantly more than the abstract idea. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not amount to significantly more than the abstract idea. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are well-understood, routine, and conventional activities of storing and retrieving information in memory, (MPEP § 2106.05(d) sub II.iv), which do not amount to significantly more than the abstract idea. Therefore, claim 10 is subject-matter ineligible.
Claim 11 recites a non-transitory machine-readable storage medium, which is a product, and thus one of the statutory categories of patentable subject matter. (35 U.S.C. § 101). However, under Step 2A Prong One, the claim recites the limitation of “selecting at random a first perturbation from the set of perturbations for an input signal and a corresponding desired output signal from the subset,” “obtaining a second perturbation by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier,” and “obtaining a first adversarial example by applying the second perturbation to the input signal.” Examiner notes that the plain meaning of the term “random” is lacking a predictable pattern or order. Accordingly, the broadest reasonable interpretation of the claim term “selecting at random” is a selection lacking a predictable pattern or order, which is not inconsistent with the Applicant’s disclosure, (MPEP § 2111), that covers the teachings of Ratner where values may be modified, or perturbed, inherently without a given order or sequence. These activities of “selecting at random,” “obtaining . . . by adapting,” and “obtaining a first adversarial example by applying” are limitations that can practically be performed in the human mind, including, for example, observations, evaluations, judgments, and opinions, and accordingly, are a mental process, (MPEP § 2106.04(a)(2) sub III), and is one of the groupings of abstract ideas. (MPEP § 2106.04(a)(2)). The claim also recites more details and specifics to the abstract idea of “obtaining a second perturbation,” where “a second perturbation, which is stronger than the first perturbation . . . in that the second perturbation is more apt to be used for fooling the classifier than the first perturbation,” and “the first perturbation or the second perturbation is initialized as random noise,” and accordingly, are merely more specific to the abstract idea. Thus, claim 11 recites an abstract idea.
Under Step 2A Prong Two, the claim as a whole is not integrated into a practical application, because the additional elements recited in the claim beyond the identified judicial exception include “a non-transitory machine-readable storage medium on which is stored a computer program for training a classifier for classifying input signals provided to the classifier, wherein the classifier is configured to obtain an output signal characterizing a classification of the input signal, the computer program, when executed by a computer, causing the computer to.” Instructions to apply the abstract idea on generic computer components (non-transitory machine-readable storage medium, computer, classifier) do not serve to integrate the abstract idea into a practical application. (MPEP § 2106.05(f)). The claim also recites the limitation of a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not serve to integrate the abstract idea into a practical application. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not integrate the abstract idea into a practical application. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are insignificant extra-solution activities of mere data gathering, (MPEP § 2016.05(g)), and do not integrate the abstract idea into a practical application. Therefore, claim 11 is directed to the abstract idea.
Finally, under Step 2B, the additional elements, taken alone or in combination, do not represent significantly more than the abstract idea itself. the additional elements recited in the claim beyond the identified judicial exception include “non-transitory machine-readable storage medium on which is stored a computer program for training a classifier for classifying input signals provided to the classifier, wherein the classifier is configured to obtain an output signal characterizing a classification of the input signal, the computer program, when executed by a computer, causing the computer to . . . .” Instructions to apply the abstract idea on generic computer components (non-transitory machine-readable storage medium, computer, classifier) do not amount to significantly more than the abstract idea. (MPEP § 2106.05(f)). The claim also recites the limitation of a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not amount to significantly more than the abstract idea. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not amount to significantly more than the abstract idea. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are well-understood, routine, and conventional activities of storing and retrieving information in memory, (MPEP § 2106.05(d) sub II.iv), which do not amount to significantly more than the abstract idea. Therefore, claim 11 is subject-matter ineligible.
Claim 12 recites a training system, which is a machine, and thus one of the statutory categories of patentable subject matter. (35 U.S.C. § 101). However, under Step 2A Prong One, the claim recites the limitation of “selecting at random a first perturbation from the set of perturbations for an input signal and a corresponding desired output signal from the subset,” “obtaining a second perturbation by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier,” and “obtaining a first adversarial example by applying the second perturbation to the input signal.” Examiner notes that the plain meaning of the term “random” is lacking a predictable pattern or order. Accordingly, the broadest reasonable interpretation of the claim term “selecting at random” is a selection lacking a predictable pattern or order, which is not inconsistent with the Applicant’s disclosure, (MPEP § 2111), that covers the teachings of Ratner where values may be modified, or perturbed, inherently without a given order or sequence. These activities of “selecting at random,” “obtaining . . . by adapting,” and “obtaining a first adversarial example by applying” are limitations that can practically be performed in the human mind, including, for example, observations, evaluations, judgments, and opinions, and accordingly, area mental process, (MPEP § 2106.04(a)(2) sub III), and is one of the groupings of abstract ideas. (MPEP § 2106.04(a)(2)). The claim also recites more details and specifics to the abstract idea of “obtaining a second perturbation,” where “a second perturbation, which is stronger than the first perturbation . . . in that the second perturbation is more apt to be used for fooling the classifier than the first perturbation,” and “the first perturbation or the second perturbation is initialized as random noise,” and accordingly, are merely more specific to the abstract idea. Thus, claim 12 recites an abstract idea.
Under Step 2A Prong Two, the claim as a whole is not integrated into a practical application, because the additional elements recited in the claim beyond the identified judicial exception include “training system,” and “a classifier.” These are additional elements used to implement the abstract idea, which do not serve to integrate the abstract idea into a practical application. (MPEP § 2106.05(f)). The claim also recites the limitation of a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not serve to integrate the abstract idea into a practical application. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not integrate the abstract idea into a practical application. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are insignificant extra-solution activities of mere data gathering, (MPEP § 2016.05(g)), and do not integrate the abstract idea into a practical application. Therefore, claim 12 is directed to the abstract idea.
Finally, under Step 2B, the additional elements, taken alone or in combination, do not represent significantly more than the abstract idea itself. the additional elements recited in the claim beyond the identified judicial exception include “a training system,” and “a classifier.” These are additional elements used to implement the abstract idea, which do not amount to significantly more than the abstract idea. (MPEP § 2106.05(f)). The claim also recites the limitation of a “neural network of the classifier,” which is recited at such a level of generality that is a generic computer component used to implement the abstract idea, (MPEP § 2106.05(f)), that does not amount to significantly more than the abstract idea. The claim also recites the additional element of “adapting the classifier by training the neural network of the classifier based on the first adversarial example and the corresponding desired output signal to harden the classifier against the second perturbation,” which is simply using the generic computer component (that is, the neural network of the classifier) to implement the abstract idea, (MPEP § 2106.05(f)), which does not amount to significantly more than the abstract idea. The claim also recites additional elements of “providing a set of perturbations,” “providing a batch of training data including a respective input signal and a respective corresponding desired output signal,” and “replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation.” These activities of providing, and replacing are well-understood, routine, and conventional activities of storing and retrieving information in memory, (MPEP § 2106.05(d) sub II.iv), which do not amount to significantly more than the abstract idea. Therefore, claim 12 is subject-matter ineligible.
Claim Rejections - 35 U.S.C. § 103
5. The following is a quotation of 35 U.S.C. § 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in Section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. § 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
7. This application currently names joint inventors. In considering patentability of the claims the Examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the Examiner to consider the applicability of 35 U.S.C. § 102(b)(2)(C) for any potential 35 U.S.C. § 102(a)(2) prior art against the later invention.
8. Claims 1, 2, and 6-12 are rejected under 35 U.S.C. § 103 as being unpatentable over US Published Application 20200372309 to Ratner et al. [hereinafter Ratner] in view of US Published Application 20200193285 to Ishii [hereinafter Ishii], Shoshan et al., “Regularized adversarial examples for model interpretability,” arXiv (2018) [hereinafter Shoshan], and Vivek et al., "Regularizer to Mitigate Gradient Masking Effect during Single-Step Adversarial Training," CVF (2019) [hereinafter Vivek].
Regarding claims 1, 10, 11, and 12, Ratner teaches [a] computer-implemented method for training a classifier that includes a neural network, the classifier classifying input signals provided to the classifier (Ratner, claim 8, teaches “a computer implemented method”),wherein the classifier is configured to obtain an output signal characterizing a classification of the input signal of claim 1, [a] control system configured to control an actuator and/or a display device based on an output signal of a classifier that includes a neural network (Ratner ¶¶ 0034 & 0036 teach “The computing device 300 may include a processor 302 that is to execute stored instructions, a memory device 304 to provide temporary memory space for operations of said instructions during operation” and “[t]he processor 302 may also be linked through the system interconnect 306 to a display interface 312 adapted to connect the computing device 300 to a display device [(that is, a control system configured to control . . . a display device)]”) of claim 10, [a] non-transitory machine-readable storage medium (Ratner ¶ 0062 recites “[t]he present techniques may be a system, a method or computer program product. The computer program product may include a computer readable storage medium (or media) having computer readable program instructions thereon for causing a processor to carry out aspects of the present invention”) of claim 11, and [a] training system configured to train a classifier that includes a neural network (Ratner ¶ ¶ 0014 teaches a “trained model 106 may have been trained on training input for classifying various classes of objects [(that is, a training system configured to train a classifier)]), of claim 12, comprising:
a. providing a set of perturbations (Ratner ¶ 0013 teaches an “input perturbation is the delta between the original input and the perturbed input. A perturbation, as used herein, is a change in a value of the input to a value of the perturbed input. For example, the perturbation may be the change in value of a pixel from an input to the perturbed input; Ratner ¶ 0013 teaches “[c]onvergence as used herein refers to the settling of perturbed values on a particular set of perturbed values [(that is, providing a set of perturbations)] during training”);
b. providing a batch of training data (Ratner ¶ 0014 teaches a “trained model 106 may have been trained on training input for classifying various classes of objects [(that is, “various classes” pertains to each class of providing a batch of training data)]”), each including a respective input signal and a respective corresponding desired output signal (Ratner ¶ 0014 teaches “[t]he trained model 106 may have been trained on training input [(that is, each including a respective input signal)] for classifying various classes of objects [(that is, “classifying” is a respective desired output signal)]”);
c. selecting at random a first perturbation from the set of perturbations for an input signal and a corresponding desired output signal from the subset (Ratner, Fig. 1, teaches “example system for generating saliency masks for inputs of machine-learning models [Examiner annotations in dashed-line text boxes]:
PNG
media_image1.png
612
608
media_image1.png
Greyscale
Ratner ¶ 0014 teaches “the one of more values of the input 102 may be modified, or perturbed. . . . [A] trained model 106 receive the perturbed input 104 [(that is, applying a perturbation is selecting at random a first perturbation from the set of perturbations for an input signal)]. In various examples, the trained model 106 may initially receive the input 102. The trained model 106 may have been trained on training input for classifying various classes of objects. The trained model 106 is shown generating a classification 108 based on the perturbed input 104 [(that is, “generating a classification 108” is a corresponding desired output signal from the subset)]”;
[Examiner notes that the plain meaning of the term “random” is lacking a predictable pattern or order. Accordingly, the broadest reasonable interpretation of the claim term “selecting at random” is a selection lacking a predictable pattern or order, which is not inconsistent with the Applicant’s disclosure, (MPEP § 2111), that covers the teachings of Ratner where values may be modified, or perturbed, inherently without a given order or sequence]);
d. obtaining a second perturbation, which is stronger than the first perturbation (Ratner ¶ 0030 teaches “convergence may be detected when the perturbed values of a perturbed input have changed less [(that is, a strong “convergence” of “perturbed values” is obtaining a second perturbation, which is stronger than the first perturbation)] than a threshold amount [(that is, a convergence process is obtaining a second perturbation, that necessarily results in [a second perturbation that] is stronger than the first perturbation)]”; Ratner ¶ 0016 teaches “a perturbation is a delta between an original input and a perturbed version of the input. a saliency metric may be used as the APE based loss110 to generate the perturbed input. As used herein, a perturbation is a delta between an original input and a perturbed version of the input. In various examples, the specific type of [adversarial perturbative explanation (APE)] metric used may depend on whether a smallest destroying region (SDR) or smallest sufficient region (SSR) is used. An APED metric refers to an APE metric that suppresses class evidence when an SDR is used. An APES metric refers to an APE metric that maintains class evidence when SSR is used”; Ratner ¶ 0017 teaches “[d]estructiveness as used herein refers to the amount of change in the classification with regards to a class i given a change in the saliency region”), by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier (Ratner ¶ 0014 teaches “an Adversarial Perturbative Explanation (APE) based loss 110 [that] may be back propagated through the trained model 106 [(that is, the “APE” is adapting)], which remains unchanged, and used to update the perturbed input 104 [(that is, the to “update the perturbed input” is obtaining a second perturbation . . . by adapting the first perturbation based on the input signal, the corresponding desired output signal, and the classifier)]”), . . . ;
e. obtaining a first adversarial example by applying the second perturbation to the input signal (Ratner ¶ 0014 teaches “[t]he updated perturbed input 104 [(that is, “updating” is obtaining a first adversarial example by applying the second perturbation to the input signal)] may then be processed through the trained model 106, resulting in a new [adversarial perturbative explanation (APE) metric] based loss 110, and so forth”);
f. adapting the classifier by training the neural network of the classifier (Ratner ¶ 0025 teaches “small perturbations of the input may also affect classification (and classification term), . . . in neural networks . . . [(that is, a neural network of the classifier)]”; Ratner, Fig. 1, further teaches generating a saliency mask (that is, adapting the classifier) for the trained model 106 [Examiner annotations in dashed-line text boxes]:
PNG
media_image2.png
712
821
media_image2.png
Greyscale
Ratner ¶ 0013 teaches “saliency maps can be generated for inputs [(that is, saliency maps” is adapting the classifier)] into a trained model. . . . The processor can then detect . . . a convergence of values in the perturbed input. Convergence as used herein refers to the settling of perturbed values on a particular set of perturbed values during training [of the trained model 106] [(that is, [(that is, training the classifier)]”) based on the first adversarial example (see above, Ratner ¶ 0014, which teaches a “perturbed input 104 [(that is, the first adversarial example)]”) and the corresponding desired output signal (Ratner ¶ 0014 teaches “generating a classification 108 [(that is, the corresponding desired output signal)] based on the perturbed input 104”) to harden the classifier against the second perturbation (Ratner ¶ 0037 teaches a “perturbation transformer module 326 can iteratively generate a perturbed input based on the input that reduces a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant [(that is, reducing the “saliency metric” is to harden the classifier against the second perturbation)]”);
g. replacing the first perturbation in the set of perturbations by a . . . combination of the first perturbation and the second perturbation (Ratner ¶ 0014 teaches “A final perturbed input 112 is generated by transforming the perturbation in a final iteration. For example, the final perturbed input 112 may thus be the value of the perturbed input 104 in a final iteration of back propagation of the APE based loss 110 [(that is, the “final perturbed input 112” is replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation)]”;
[Examiner notes Ratner teaches that “a perturbation is a delta between an original input and a perturbed version of the input.” Accordingly, the converged “final perturbed input” is a combination of the first perturbation and the second perturbation, and the resulting delta between the original input (that is, the perturbed input 104) and a perturbed version of the input (that is, the final perturbed input 112)); and
h. repeating steps b. to g (Ratner, Abstract, teaches “[t]he processor is to iteratively generate a perturbed input).
Though Ratner teaches a model trained on training input for classifying various classes of objects, in which the model generates a classification based on the perturbed input, Ratner, however, does not explicitly teach replacing the first perturbation “by a linear combination” of the first and second perturbation.
But Ishii teaches “the restriction on the perturbation r* for generating the adversarial feature is only a constraint that a magnitude is equal to or less than ε. In comparison with this, the third example introduces a constraint, for example, that it can be expressed by a linear combination of the training data.” (Ishii ¶ 0076).
Ratner and Ishii are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify Ratner pertaining to adversarial example generation with the linear combination of training data, which include perturbation of Ishii.
The motivation to do so is to “to learn a neural network with high performance by processing, when the number of pieces of training data is small, the training data to efficiently generate data which contribute to an improvement of learning and by learning those data.” (Ishii ¶ 0026).
Though Ratner and Ishii teach adversarial feature generation that adds perturbations so that recognition by a classifier neural network being currently learned becomes difficult, in which a final perturbed input is drawn iteratively from a first perturbed input, the combination of Ratner and Ishii does not explicitly teach –
* * *
d. [obtaining a second perturbation] . . . ,
[(d.1)] wherein the second perturbation is stronger than the first perturbation in that the second perturbation is more apt to be used for fooling the classifier than the first perturbation, . . . ;
, . . . ;
* * *
But Shoshan teaches –
* * *
d. [obtaining a second perturbation] . . . ,
[(d.1)] wherein the second perturbation is stronger than the first perturbation in that the second perturbation is more apt to be used for fooling the classifier than the first perturbation (Shoshan, right column of p. 1, “1. Introduction,” first partial & first paragraphs, teaches the “aiming to provide explanation of which subset regions of the model input are the main reason for the model prediction. Part of the methods [?, 3, 1] focus on introducing perturbations into the input of a model and then analyzing the modified model prediction. In parallel, a significant effort is being put in recent years into developing adversarial examples generation methods for fooling models, usually aiming to keep the “true label” of the input, as will be classified by a human reader ([8, 4]). The goal of such adversarial attacks is to identify unwanted behavior of a network and exploit it [(that is, a resulting “unwanted network behavior” is where the second perturbation is more apt to be used for fooling the classifier than the first perturbation)]”; Shoshan, right column of p. 4, “5.2 GT localization metric,” first paragraph, teaches the “[digital database for screening mammography (DDSM)] dataset contains localized GT (ground truth) information delineating malignant lesions. Since it is important to know if the perturbation method managed to ‘fool’ the model in nonsensical ways, especially in the context of adversarial example generation, we examine how well the explanation masks correlate with the actual findings in the images”), . . . ;
* * *
Ratner, Ishii, and Shoshan are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Shoshan teaches explaining which subset regions of a model input is the main reason for the model prediction, while, in parallel, developing adversarial example generation methods for fooling models, while not altering the true label of the input. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify the combination of Ratner and Ishii pertaining to adversarial example generation with the linear combination of training data having perturbed examples with the adversarial example generation for fooling models of Shoshan.
The motivation to do so is because “it is important to know if the perturbation method managed to ‘fool’ the model in nonsensical ways, especially in the context of adversarial example generation, [to] examine how well the explanation masks correlate with the actual findings in the images.” (Shoshan, right column of p. 4, “5.2 GT localization metric,” first paragraph).
Though Ratner, Ishii, and Shoshan teach adversarial feature generation that adds perturbations so that recognition by a classifier neural network being currently learned becomes difficult, in which a final perturbed input is drawn iteratively from a first perturbed input, the combination of Ratner, Ishii, and Shoshan, however, does not explicitly teach –
* * *
[d. obtaining a second perturbation] . . . ,
[(d.2)] wherein the first perturbation or the second perturbation is initialized as random noise;
* * *
But Vivek teaches –
* * *
[d. obtaining a second perturbation] . . . ,
[(d.2)] wherein the first perturbation or the second perturbation is initialized as random noise (Vivek, right column of p. 2, “3.1 Adversarial Sample Generation Methods, Projected Gradient Descent (PGD), teaches “the perturbation is initialized with a random point [(that is, random noise)] within the allowed LP-norm ball and the I-FGSM is applied with re-projection [(that is, wherein the first perturbation or the second perturbation is initialized as random noise )]);
* * *
Ratner, Ishii, Shoshan, and Vivek are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Shoshan teaches explaining which subset regions of a model input is the main reason for the model prediction, while, in parallel, developing adversarial example generation methods for fooling models, while not altering the true label of the input. Vivek teaches proposed regularization term causes training loss to increase when the distance between logits (i.e., pre-softmax output of a classifier) for FGSM and R-FGSM (small random noise is added to the clean sample before computing its FGSM sample) adversaries of a clean sample becomes large. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify the combination of Ratner, Ishii, and Shoshan pertaining to adversarial example generation with the linear combination of training data having perturbed examples for fooling models with the random noise initialization of Vivek.
The motivation to do so is for a “single-step adversarial training [that] is faster than computationally expensive state-of-the-art PGD adversarial training method, and also achieves on par results.” (Vivek, Abstract).
Examiner notes that the Applicant’s preambles do not afford patentable weight to the Applicant’s claims because each of the respective claim preambles are not “necessary to give life, meaning, and vitality” to the respective claim. Moreover, because the Applicant’s preambles merely states the purpose or intended use of the invention rather than any distinct definition of any of the claimed invention’s limitations, the preambles are not considered as limitations and are respectively no significance to claim construction.
Regarding claim 2, the combination of Ratner, Ishii, Shoshan, and Vivek teaches all of the limitations of claim 1, as described above in detail.
Ratner teaches -
wherein the classifier is pretrained on the first dataset or another dataset (Ratner ¶ 0012 teaches “if the model was trained using limited training data, then the model may be classifying an object [(that is, the classifier)] based on an unrelated and unwanted factor that was present in the training data. On the other hand, there may be evidence outside the annotated [ground truth] object that may legitimately influence a model decision. GT based metrics are unable to take into account that such evidence may legitimately influence model decisions [(that is, the classifier is pretrained on the first dataset or another dataset)]”) and one or multiple perturbations from the set of perturbations (Ratner ¶ 0013 teaches “settling of perturbed values on a particular set of perturbed values during training [(that is, one or more multiple perturbations from the set of perturbations)]”) are provided based on a corresponding set of second adversarial examples of the classifier (Ratner ¶ 0013 teaches “iteratively generat[ing] an adversarial example, referred to herein as a perturbed input [(that is, each iteration produces an adversarial example, which is a corresponding set of second adversarial examples of a classifier)]”).
Regarding claim 6, the combination of Ratner, Ishii, Shoshan, and Vivek teaches all of the limitations of claim 1, as described above in detail.
Ratner teaches -
wherein the classifier is trained (Ratner ¶ 0002 teaches “system can include processor to receive an input and a model trained to classify inputs [(that is, the classifier is trained)]”) by supplying the first adversarial example to the classifier (see above, Ratner ¶ 0014, which teaches “an updated perturbed input 104 [(that is, by supplying the first adversarial example to the classifier)]”) and using the corresponding desired output signal as a desired output signal for the adversarial example (Ratner ¶ 0014 teaches “[t]he trained model 106 is shown generating a classification 108 [(that is, a desired output signal for the adversarial example)] based on the perturbed input 104 [(that is, using the corresponding desired output signal)]”).
Regarding claim 7, the combination of Ratner, Ishii, Shoshan, and Vivek teaches all of the limitations of claim 1, as described above in detail.
Ratner teaches -
further comprising the following step:
o. training the classifier based on the input signal and the corresponding desired output signal (Ratner ¶ 0013 & Fig. 1 teaches “[c]onvergence as used herein refers to the settling of perturbed values on a particular set of perturbed values during training”; Ratner ¶ 0014 teaches “[t]he trained model 106 may have been trained on training input [(that is, based on the input signal) for classifying [(that is, the corresponding desired output signal)] various classes of objects [(that is, training the classifier based on the input signal and the corresponding desired output signal)”).
Regarding claim 8, Ratner teaches [a] computer-implemented method (Ratner, claim 8, teaches “a computer implemented method”) for obtaining an output signal characterizing a classification of an input signal, comprising the following steps:
training a classifier that includes a neural network (Ratner ¶ ¶ 0014 teaches a “trained model 106 may have been trained on training input for classifying various classes of objects [(that is, training a classifier)]”; Ratner ¶ 0025 teaches “small perturbations of the input may also affect classification (and classification term), . . . in neural networks . . . [(that is, a classifier that includes a neural network)]) by:
a. providing a set of perturbations (Ratner ¶ 0013 teaches an “input perturbation is the delta between the original input and the perturbed input. A perturbation, as used herein, is a change in a value of the input to a value of the perturbed input. For example, the perturbation may be the change in value of a pixel from an input to the perturbed input; Ratner ¶ 0013 teaches “[c]onvergence as used herein refers to the settling of perturbed values on a particular set of perturbed values [(that is, providing a set of perturbations)] during training”),
b. providing a batch of training data (Ratner ¶ 0014 teaches a “trained model 106 may have been trained on training input for classifying various classes of objects [(that is, “various classes” pertains to each class of providing a subset of first training samples)]”) including a respective input signal and a respective corresponding desired output signal (Ratner ¶ 0014 teaches “[t]he trained model 106 may have been trained on training input [(that is, each including a respective input signal)] for classifying various classes of objects [(that is, “classifying” is a respective desired output signal)]”),
c. selecting at random a first perturbation from the set of perturbations for the input signal and a corresponding desired output signal from the subset (Ratner, Fig. 1, teaches “example system for generating saliency masks for inputs of machine-learning models [Examiner annotations in dashed-line text boxes]:
PNG
media_image1.png
612
608
media_image1.png
Greyscale
Ratner ¶ 0014 teaches “the one of more values of the input 102 may be modified, or perturbed. . . . [A] trained model 106 receive the perturbed input 104 [(that is, applying a perturbation is selecting at random a first perturbation from the set of perturbations for an input signal)]. In various examples, the trained model 106 may initially receive the input 102. The trained model 106 may have been trained on training input for classifying various classes of objects. The trained model 106 is shown generating a classification 108 based on the perturbed input 104 [(that is, “generating a classification 108” is a corresponding desired output signal from the subset)]”),
d. obtaining a second perturbation, which is stronger than the first perturbation (Ratner ¶ 0030 teaches “convergence may be detected when the perturbed values of a perturbed input have changed less [(that is, a strong “convergence” of “perturbed values” is obtaining a second perturbation, which is stronger than the first perturbation)] than a threshold amount [(that is, a convergence process is obtaining a second perturbation, that necessarily results in [a second perturbation that] is stronger than the first perturbation)]”; Ratner ¶ 0016 teaches “a perturbation is a delta between an original input and a perturbed version of the input. a saliency metric may be used as the APE based loss110 to generate the perturbed input. As used herein, a perturbation is a delta between an original input and a perturbed version of the input. In various examples, the specific type of [adversarial perturbative explanation (APE)] metric used may depend on whether a smallest destroying region (SDR) or smallest sufficient region (SSR) is used. An APED metric refers to an APE metric that suppresses class evidence when an SDR is used. An APES metric refers to an APE metric that maintains class evidence when SSR is used”; Ratner ¶ 0017 teaches “[d]estructiveness as used herein refers to the amount of change in the classification with regards to a class i given a change in the saliency region”), by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier (Ratner ¶ 0014 teaches “an Adversarial Perturbative Explanation (APE) based loss 110 [that] may be back propagated through the trained model 106 [(that is, the “APE” is adapting)], which remains unchanged, and used to update the perturbed input 104 [(that is, the to “update the perturbed input” is obtaining a second perturbation . . . by adapting the first perturbation based on the input signal, the corresponding desired output signal, and the classifier)]”) . . . ,
e. obtaining a first adversarial example by applying the second perturbation to the input signal (Ratner ¶ 0014 teaches “[t]he updated perturbed input 104 [(that is, “updating” is obtaining a first adversarial example by applying the second perturbation to the input signal)] may then be processed through the trained model 106, resulting in a new [adversarial perturbative explanation (APE) metric] based loss 110, and so forth”),
f. adapting the classifier by training the neural network of the classifier (Ratner ¶ 0002 teaches “system can include processor to receive an input and a model trained to classify inputs [(that is, training the neural network of the classifier)]”) based on the first adversarial example and the corresponding desired output signal (see above, Ratner ¶ 0014, which teaches “an updated perturbed input 104 [(that is, the first adversarial example)]”) to harden the classifier against the second perturbation (Ratner ¶ 0037 teaches a “perturbation transformer module 326 can iteratively generate a perturbed input based on the input that reduces a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant [(that is, reducing the “saliency metric” is to harden the classifier against the second perturbation)]”),
g. replacing the first perturbation in the set of perturbations by a . . . combination of the first perturbation and the second perturbation (Ratner ¶ 0014 teaches “A final perturbed input 112 is generated by transforming the perturbation in a final iteration. For example, the final perturbed input 112 may thus be the value of the perturbed input 104 in a final iteration of back propagation of the APE based loss 110 [(that is, the “final perturbed input 112” is replacing the first perturbation in the set of perturbations by a linear combination of the first perturbation and the second perturbation)]”;
[Examiner notes Ratner teaches that “a perturbation is a delta between an original input and a perturbed version of the input.” Accordingly, the converged “final perturbed input” is a combination of the first perturbation and the second perturbation, and the resulting delta between the original input (that is, the perturbed input 104) and a perturbed version of the input (that is, the final perturbed input 112)), and
h. repeating steps b. to g (Ratner, Abstract, teaches “[t]he processor is to iteratively generate a perturbed input);
providing the classifier in a control system (Ratner ¶ 0027 teaches “The method 200 can be implemented with any suitable computing device, such as the computing device 300 of FIG. 3 or the system 100 of FIG. 1”; Ratner ¶ 0028 teaches “an input and a model trained to classify inputs is received [(that is, providing the classifier)]. For example, the input may be an image to be classified. As one example, the image may be classified as including a malignant lesion or not having a malignant lesion. In various examples, other types of input to be classified may be received”; Ratner ¶ 0033 teaches “. Computing device 300 may be practiced in distributed cloud computing environments where tasks are performed by remote processing devices that are linked through a communications network [(that is, “computing device” is a control system)]”);
obtaining the output signal from the control system, wherein the control system supplies the input signal to the classifier to obtain the output signal (Ratner ¶ 0028 teaches “an input and a model trained to classify inputs is received. For example, the input may be an image to be classified. As one example, the image may be classified as including a malignant lesion or not having a malignant lesion [(that is, obtaining the output signal from the control system, wherein the control system supplies the input signal to the classifier to obtain the output signal)]”).
Though Ratner teaches a model trained on training input for classifying various classes of objects, in which the model generates a classification based on the perturbed input, Ratner, however, does not explicitly teach replacing the first perturbation “by a linear combination” of the first and second perturbation.
But Ishii teaches “the restriction on the perturbation r* for generating the adversarial feature is only a constraint that a magnitude is equal to or less than ε. In comparison with this, the third example introduces a constraint, for example, that it can be expressed by a linear combination of the training data.” (Ishii ¶ 0076).
Ratner and Ishii are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify Ratner pertaining to adversarial example generation with the linear combination of training data, which include perturbation of Ishii.
The motivation to do so is to “to learn a neural network with high performance by processing, when the number of pieces of training data is small, the training data to efficiently generate data which contribute to an improvement of learning and by learning those data.” (Ishii ¶ 0026).
Though Ratner and Ishii teach adversarial feature generation that adds perturbations so that recognition by a classifier neural network being currently learned becomes difficult, in which a final perturbed input is drawn iteratively from a first perturbed input, the combination of Ratner and Ishii does not explicitly teach –
* * *
d. [obtaining a second perturbation] . . . , the second perturbation is more apt to be used for fooling the classifier than the first perturbation, . . . ;
* * *
But Shoshan teaches –
* * *
d. [obtaining a second perturbation] . . . the second perturbation is more apt to be used for fooling the classifier than the first perturbation (Shoshan, right column of p. 1, “1. Introduction,” first partial & first paragraphs, teaches the “aiming to provide explanation of which subset regions of the model input are the main reason for the model prediction. Part of the methods [?, 3, 1] focus on introducing perturbations into the input of a model and then analyzing the modified model prediction. In parallel, a significant effort is being put in recent years into developing adversarial examples generation methods for fooling models, usually aiming to keep the “true label” of the input, as will be classified by a human reader ([8, 4]). The goal of such adversarial attacks is to identify unwanted behavior of a network and exploit it [(that is, a resulting “unwanted network behavior” is where the second perturbation is more apt to be used for fooling the classifier than the first perturbation)]”; Shoshan, right column of p. 4, “5.2 GT localization metric,” first paragraph, teaches the “[digital database for screening mammography (DDSM)] dataset contains localized GT (ground truth) information delineating malignant lesions. Since it is important to know if the perturbation method managed to ‘fool’ the model in nonsensical ways, especially in the context of adversarial example generation, we examine how well the explanation masks correlate with the actual findings in the images”), . . . ;
* * *
Ratner, Ishii, and Shoshan are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Shoshan teaches explaining which subset regions of a model input is the main reason for the model prediction, while, in parallel, developing adversarial example generation methods for fooling models, while not altering the true label of the input. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify the combination of Ratner and Ishii pertaining to adversarial example generation with the linear combination of training data having perturbed examples with the adversarial example generation for fooling models of Shoshan.
The motivation to do so is because “it is important to know if the perturbation method managed to ‘fool’ the model in nonsensical ways, especially in the context of adversarial example generation, [to] examine how well the explanation masks correlate with the actual findings in the images.” (Shoshan, right column of p. 4, “5.2 GT localization metric,” first paragraph).
Though Ratner, Ishii, and Shoshan teach adversarial feature generation that adds perturbations so that recognition by a classifier neural network being currently learned becomes difficult, in which a final perturbed input is drawn iteratively from a first perturbed input, the combination of Ratner, Ishii, and Shoshan, however, does not explicitly teach –
* * *
[d. obtaining a second perturbation] . . . ,
wherein the first perturbation or the second perturbation is initialized as random noise;
* * *
But Vivek teaches –
* * *
[d. obtaining a second perturbation] . . . ,
wherein the first perturbation or the second perturbation is initialized as random noise (Vivek, right column of p. 2, “3.1 Adversarial Sample Generation Methods, Projected Gradient Descent (PGD), teaches “the perturbation is initialized with a random point [(that is, random noise)] within the allowed LP-norm ball and the I-FGSM is applied with re-projection [(that is, wherein the first perturbation or the second perturbation is initialized as random noise )]);
* * *
Ratner, Ishii, Shoshan, and Vivek are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Shoshan teaches explaining which subset regions of a model input is the main reason for the model prediction, while, in parallel, developing adversarial example generation methods for fooling models, while not altering the true label of the input. Vivek teaches proposed regularization term causes training loss to increase when the distance between logits (i.e., pre-softmax output of a classifier) for FGSM and R-FGSM (small random noise is added to the clean sample before computing its FGSM sample) adversaries of a clean sample becomes large. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify the combination of Ratner, Ishii, and Shoshan pertaining to adversarial example generation with the linear combination of training data having perturbed examples for fooling models with the random noise initialization of Vivek.
The motivation to do so is for a “single-step adversarial training [that] is faster than computationally expensive state-of-the-art PGD adversarial training method, and also achieves on par results.” (Vivek, Abstract).
Examiner notes that the Applicant’s preamble does not afford patentable weight to the Applicant’s claims because the claim preamble is not “necessary to give life, meaning, and vitality” to the claim. Moreover, because the Applicant’s preamble merely states the purpose or intended use of the invention rather than any distinct definition of any of the claimed invention’s limitations, the preamble is not considered a limitation and is of no significance to claim construction.
Regarding claim 9, the combination of Ratner, Ishii, Shoshan, and Vivek teaches all of the limitations of claim 8, as described above in detail.
Ratner teaches -
wherein the input signal is obtained based on a signal of a sensor and/or an actuator is controlled based on the output signal and/or a display device is controlled based on the output signal (Ratner ¶ 0021 teaches “[i]n the example of a trained model 106 trained to classify medical imaging input 102 as either containing or not containing malignant tumors [(that is, controlled by output signals)], given perturbed output Î binarization . . . . An optimization problem may then be used to find a value of Î that minimizes the APED saliency metric [(that is, the input signal is obtained based on . . . a display device is controlled based on the output signal)]”).
9. Claims 3 and 4 are rejected under 35 U.S.C. § 103 as being unpatentable over US Published Application 20200372309 to Ratner et al. [hereinafter Ratner] in view of US Published Application 20200193285 to Ishii [hereinafter Ishii], Shoshan et al., “Regularized adversarial examples for model interpretability,” arXiv (2018) [hereinafter Shoshan], Vivek et al., "Regularizer to Mitigate Gradient Masking Effect during Single-Step Adversarial Training," CVF (2019) [hereinafter Vivek], and US Published Application 20190251612 to Fang et al. [hereinafter Fang].
Regarding claim 3, the combination of Ratner, Ishii, Shoshan, and Vivek teaches all of the limitations of claim 2, as described above in detail.
Though Ratner, Ishii, Shoshan, and Vivek teach adversarial pattern generation methods by training data artificial minute noises, the combination of Ratner, Ishii, Shoshan, and Vivek, however, does not teach –
wherein a second adversarial example from the set of second adversarial examples is provided based on random noise.
But Fang teaches –
wherein a second adversarial example from the set of second adversarial examples is provided based on random noise (Fang ¶ 0137 teaches “training the GAN can include jointly training 606 the generator and the discriminator. For instance, the generator G takes as inputs a random noise vector . . . and a category . . . and synthesizes an image [(that is, a second adversarial example . . . is provided based on random noise)]”).
Ratner, Ishii, Shoshan, Vivek and Fang are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Shoshan teaches explaining which subset regions of a model input is the main reason for the model prediction, while, in parallel, developing adversarial example generation methods for fooling models, while not altering the true label of the input. Fang teaches, in relation to a generative adversarial network, a generator that learns how, using random noise combined with latent code vectors in low-dimensional random latent space, to generate synthesized images that have a similar appearance and distribution to a corpus of training images. Vivek teaches proposed regularization term causes training loss to increase when the distance between logits (i.e., pre-softmax output of a classifier) for FGSM and R-FGSM (small random noise is added to the clean sample before computing its FGSM sample) adversaries of a clean sample becomes large. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify the combination of Ratner, Ishii, Shoshan, and Vivek pertaining to adversarial example generation through a linear combination of training data having perturbed examples with the adversarial example generation for fooling models, with the random noise insertion of Fang.
The motivation to do so is to take “a random noise vector as input and synthesizes an image. . . . [that] trains the GAN 200 using a loss function to improve image quality and realness of images synthesized by the generator 202 as well as to improve detection of non-realistic images by the discriminator 204.” (Fang ¶ 0058).
Regarding claim 4, the combination of Ratner, Ishii, Shoshan, Vivek, and Fang teaches all of the limitations of claim 3, as described above in detail.
Fang teaches -
wherein the second adversarial example is provided based on applying random noise at a random location of an input signal from the first dataset (Fang ¶ 0046 teaches that “[d]uring training latent code can be combined with and include random noise, as described below. In addition, in some embodiments, latent code refers to a location within the random latent spaced [(that is, a random location)] learned by the generator of the image generative adversarial network [(that is, the “latent code” pertains to the second adversarial example is provided based on applying random noise at a random location of an input signal from the first dataset)]”).
10. Claim 5 is rejected under 35 U.S.C. § 103 as being unpatentable over US Published Application 20200372309 to Ratner et al. [hereinafter Ratner] in view of US Published Application 20200193285 to Ishii [hereinafter Ishii], Shoshan et al., “Regularized adversarial examples for model interpretability,” arXiv (2018) [hereinafter Shoshan], Vivek et al., "Regularizer to Mitigate Gradient Masking Effect during Single-Step Adversarial Training," CVF (2019) [hereinafter Vivek], and US Published Application 20190095629 to Lee et al. [hereinafter Lee].
Regarding claim 5, the combination of Ratner, Ishii, Shoshan, and Vivek teaches all of the limitations of claim 2, as described above in detail.
Ratner teaches -
wherein one or multiple perturbations from the set of perturbations are provided according to the following steps:
i. selecting a subset of input signals from the first dataset (Ratner ¶ 0014 teaches “The system 100 of FIG. 1 includes an input 102. For example, the input may be an image containing an object to be classified [(that is, selecting a subset of input signals from the first dataset)]”);
j. adapting each of the input signals (Ratner, Abstract, teaches “iteratively generate a perturbed input that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term [(that is, “iteratively” pertains to each)] in the selected subset by scaling a plurality of values in the input signal in the selected subset (Ratner ¶ 0018 teaches “a saliency metric [Adversarial Perturbative Explanation (APES) may be calculated and used to maintain class evidence when a smallest sufficient region is used [(that is, a “smallest sufficient region” is adapting each of the input signals in the selected subsect by scaling a plurality of values in the input signal in the selected subset)]”);
k. applying the adapted input signals as perturbations to input signals of the first dataset to obtain a set of new input signals, wherein each of the adapted input signals is applied to a plurality of input signals of the first dataset, and wherein each of the new input signals from the set of new input signals corresponds to an adapted input signal (Ratner ¶ 0037 teaches a “perturbation transformer module 326 can iteratively generate a perturbed input based on the input that reduces [(that is, scaling)] a saliency metric including a classification term, a sparsity term, and a smoothness term {(that is, applying the adapted input signals as perturbations to input signals of the first dataset to obtain a set of new input signals)] . . . . [The] classification term represents a destructiveness of a saliency region with respect to an object class. The sparsity term is to reduce the total number of values changed in the perturbed input relative to the input [(that is, wherein each of the adapted input signals is applied to a plurality of input signals of the first dataset, and wherein each of the new input signals from the set of new input signals corresponds to an adapted input signal)]”);
l. determining a first value for each of the adapted input signals, wherein a first value characterizes an ability of the corresponding adapted input signal to fool the classifier when used as perturbation (Ratner ¶ 0016 teaches a “saliency metric,” where “a saliency metric may be used as the APE based loss 110 to generate the perturbed input. In various examples, the saliency metric may be an adversarial perturbative explanation (APE) metric. Perturbation based explanation describes regions that affect the decision of a model, given a modified (perturbed) input. As used herein, a perturbation is a delta between an original input and a perturbed version of the input. In various examples, the specific type of APE metric used may depend on whether a smallest destroying region (SDR) or smallest sufficient region (SSR) is used. An APED metric refers to an APE metric that suppresses class evidence when an SDR is used. An APES metric refers to an APE metric that maintains class evidence when SSR is used [(that is, the “SDR” and/or “SSR” are each a first value characterizes an ability of the corresponding adapted input signal to fool the classifier when used as a perturbation)]”), and wherein the first value is determined based on an ability of the new input signals corresponding to the adapted input signal to fool the classifier (see Ratner ¶ 0016 regarding “an APED metric” and/or “an APES metric” (that is, wherein the first value is determined based on an ability of the new input signals corresponding to the adapted input signal to fool the classifier);
* * *
Though Ratner, Ishii, Shoshan, and Vivek teach adversarial pattern generation methods by training data artificial minute noises, the combination of Ratner, Ishii, Shoshan, and Vivek, however, does not explicitly teach -
* * *
m. ranking the adapted input signals by their corresponding first values and providing a desired amount of the best ranked adapted input signals as perturbations.
But Lee teaches –
* * *
m. ranking the adapted input signals by their corresponding first values and providing a desired amount of the best ranked adapted input signals as perturbations (Lee ¶ 0056 & Fig. 1B, teach “a perturbation insertion engine 160 is provided in association with, or as part of, the trained neural network model 130 [Examiner annotations in dashed-line text boxes]:”
PNG
media_image3.png
604
852
media_image3.png
Greyscale
Lee ¶ 0053 teaches “each slot of the vector output 135 corresponds to a possible classification from ‘0’ to ‘9’ indicating the possible numerical values that the portion of the input image may represent [(that is, ranking the adapted input signals by their corresponding first values and providing a desired amount of the best ranked adapted input signals as perturbations)]”).
Ratner, Ishii, Shoshan, Vivek, and Lee are from the same or similar field of endeavor. Ratner teaches iteratively generate an adversarial example, referred to herein as a perturbed input, that optimizes a saliency metric including a classification term, a sparsity term, and a smoothness term, while keeping parameters of the model constant. Ishii teaches an adversarial pattern generation method of adding, to the training data, artificial minute noises so that recognition by a machine is difficult. Shoshan teaches explaining which subset regions of a model input is the main reason for the model prediction, while, in parallel, developing adversarial example generation methods for fooling models, while not altering the true label of the input. Vivek teaches proposed regularization term causes training loss to increase when the distance between logits (i.e., pre-softmax output of a classifier) for FGSM and R-FGSM (small random noise is added to the clean sample before computing its FGSM sample) adversaries of a clean sample becomes large. Lee teaches to reduce or eliminate the attacker's ability to perform a model stealing attack by introducing perturbations, or noise, into the output probabilities generated by the neural network, so as to fool the attacker who is trying the copy the neural network model. Thus, it would have been obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant’s invention to modify the combination of Ratner, Ishii, Shoshan and Vivek pertaining to adversarial example generation based on a linear combination of training data having perturbed examples with the adversarial example generation for fooling models, with the modified vector ranking of Lee.
The motivation to do so is because “perturbations that are introduced deviate the attacker's gradients from a correct direction and amount and minimize loss in the accuracy of the protected neural network model.” (Lee ¶ 0022).
Response to Arguments
11. Examiner has fully considered Applicant’s arguments, and responds below accordingly.
Claim Rejections – 35 U.S.C. § 101
12. Under Step 2A Prong One, Applicant submits that “Without conceding that the rest of the assertions of judicial exception in the Office Action are correct, Applicant focuses on the characterization in page 3 of the Office Action that the limitation ‘wherein the first perturbation or the second perturbation is initialized as random noise’ is ‘merely more specific to the abstract idea.’” (Response at p. 8).
Applicant submits that under the Office guidance, “‘[t]he rejection must explain why those claim limitations set forth or describe a judicial exception (e.g., a law of nature).’ Here, in arguing that the random noise wherein clause added by the previous Amendment is \merely more specific to the abstract idea,’ the Patent Office has merely assumed, without offering any reasoned analysis, that the wherein clause is just as abstract as the allegedly abstract first and second perturbations. Without explaining why this is the case, the Patent Office has failed to shoulder the burden clearly placed on it by the MPEP.” (Response at p. 9 (citing MPEP § 2106.07(a); also citing Ex parte Ghosh (Appeal No. 2024-001820) (nonprecedential)).
Examiner’s Response:
Examiner respectfully disagrees because the rejections set out hereinabove comply with the Office guidance, which recites, in whole, that:
For Step 2A Prong One, the rejection should identify the judicial exception by referring to what is recited (i.e., set forth or described) in the claim and explain why it is considered an exception. For example, if the claim is directed to an abstract idea, the rejection should identify the abstract idea as it is recited (i.e., set forth or described) in the claim and explain why it is an abstract idea. Similarly, if the claim is directed to a law of nature or a natural phenomenon, the rejection should identify the law of nature or natural phenomenon as it is recited (i.e., set forth or described) in the claim and explain using a reasoned rationale why it is considered a law of nature or natural phenomenon.
Notably, the guidance does not recite the word “must,” (that is, to be obliged or required), but rather the word “should,” (that is, indicates obligation, expectation, or advisability), and such as the distinction between “shall” and “may.”
The nonprecedential decision of Ex parte Ghosh relates to “cardiac evaluation,” and in particular, to monitoring electrical activity from tissue of a patient. Accordingly, the fact pattern of Ex part Ghosh departs from that of the instant application and associated claims.
Accordingly, Examiner submits that the subject matter evaluation under Step 2A Prong One as set out above in detail is proper.
13. Under Step 2A Prong Two, Applicant argues that “this step [of ‘adapting the classifier by training the neural network of the classifier] fails to integrate the alleged judicial exception(s) found in the Prong One analysis into a practical application because Applicant submits that it represents an improvement in the technology of training neural networks for classifiers.” (Response at p. 10 (citing MPEP § 2106.04(d)(1); also citing Ex parte Mixter (Appeal No. 2023-003543) (nonprecedential)).
Examiner’s Response:
Examiner respectfully submits that the claim, considered as a whole, does not integrate the abstract idea into a practical application under Step 2A Prong Two. Under the Office guidance, the SME under Step 2A Prong Two is:
For Step 2A Prong Two, the rejection should identify any additional elements (specifically point to claim features/limitations/steps) recited in the claim beyond the identified judicial exception; and evaluate the integration of the judicial exception into a practical application by explaining that 1) there are no additional elements in the claim; or 2) the claim as a whole, looking at the additional elements individually and in combination, does not integrate the judicial exception into a practical application using the considerations set forth in MPEP §§ 2106.04(d), 2106.05(a)-(c) and (e)- (h). Examiners should give weight to all of the claimed additional elements in Prong Two, even if those elements represent well-understood, routine, conventional activity.
(MPEP § 2106.07(a)).
In regard to evaluating the claims as a whole, “[a]s explained in MPEP 2106.04(d), subsection III, the Step 2A, ‘‘Prong Two analysis considers the claim as a whole. That is, the limitations containing the judicial exception as well as the additional elements in the claim besides the judicial exception need to be evaluated together to determine whether the claim integrates the judicial exception into a practical application.’’ (2024 SME Guidance, 89 Fed. Reg. 137 at p. 58136 (17 July 2024)).
The additional elements of Applicant’s claims include generic computer components (computer-implemented, classifier, neural network of the classifier), which are used to implement the abstract idea, (MPEP § 2106.05(f)), that do not serve to integrate the abstract idea into a practical application nor amount to significantly more than the abstract idea. Also, the limitations of “adapting the classifier by training,” is the use of the generic computer component (classifier) to implement the abstract idea, (MPEP § 2106.05(f)), that do not serve to integrate the abstract idea into a practical application nor amount to significantly more than the abstract idea. Still also, these additional elements are recited at a high-level of generality, such that the claim recites generic computer components performing their conventional functions, without identification of improved ways of carrying out the familiar computer capabilities.
Also, the limitations of “a. providing” and “g. replacing” are insignificant extra-solution activities of mere data gathering, (MPEP § 2106.05(g)), that do not integrate the abstract idea into a practical application, and further, are well-understood, routine, and conventional activities of storing and retrieving information in memory, (MPEP § 2106.05(d) sub II.iv), that do not amount to significantly more than the abstract idea. The claims do not provide details as to how the “providing” and “replacing” are conducted, and accordingly, also have a generous broadest reasonable interpretation that covers general aspects of data gathering and/or storing and retrieving information in memory.
With respect to the Applicant’s submission that “[t]his diversity allows for defending the classifier against a wide range of adversarial examples. In turn, this improves the performance and robustness of the classifier,” the fact that such diversity can be used to make a process more robust, however, does not necessarily render an abstract idea less abstract.
The decision of Ex parte Mixter relates to training an artificial neural network. The Board held that “[o]n this record, there is no meaningful dispute that the combination of elements recited by the claims result in an improvement to existing artificial neural network technology.” (Ex parte Mixter, at p. 7). Without more, the Board deferred to the Mixter applicant.
Under MPEP § 2106.04(d)(1), may be based on the improvements in the functioning of a computer or an improvement to any other technology or technical field. (MPEP § 2106.04(d)(1)). The evaluation requires, [i]n sum, that (1) the specification should be evaluated to determine if the disclosure provides sufficient details such that one of ordinary skill in the art would recognize the claimed invention as providing an improvement. Next, (2) if the specification sets forth such an improvement, the claim must be evaluated to ensure that the claim itself reflects the disclosed improvement.
As an example, the instant claim recites “d. obtaining a second perturbation, which is stronger than the first perturbation, by adapting the first perturbation based on the input signal, the corresponding desired output signal and the classifier.” (claim 1, lines 11-12). The disclosure appears to set out, without more, that “adapting” is the result is “to become stronger.” (see Specification at p. 4, lines 12-15, at p. 5, lines 15-19, and at p. 14, lines 18-23).
Per the Office Guidance, “[t]he specification need not explicitly set forth the improvement, but it must describe the invention such that the improvement would be apparent to one of ordinary skill in the art. Conversely, if the specification explicitly sets forth an improvement but in a conclusory manner (i.e.,, a bare assertion of an improvement without the detail necessary to be apparent to a person of ordinary skill in the art), the examiner should not determine the claim improves technology.” (MPEP § 2106.04(d)(1)).
In the instant specification, “adapting” to “become stronger” appears to proffered in a conclusory manner, and thus, departs from the fact pattern of Ex parte Mixter.
Accordingly, the claims are subject-matter ineligible as set out hereinabove in detail.
14. Under Step 2B, Applicant argues that “[e]ven if the Patent Office disagrees that the claims are eligible under Prong Two of Step 2A, Applicant submits that the Patent Office has improperly applied Step 2B to all the limitations that the Patent Office has identified as additional elements.” (Response at p. 14).
Also, Applicant argues that “[t]he Patent Office applies Step 2B improperly by merely quoting the additional element and making the bald-face pronouncement that it "does not amount to significantly more than the abstract idea," without complying with any of requirements (A)-(D).” (Response at p. 15 (citing MPEP § 2106.05(d)).
Examiner’s Response:
Examiner respectfully submits that the rejection conforms to the Office guidance, as set out hereinabove in detail. As set out, additional elements of “providing” and “replacing” are well-understood, routine, and conventional activities of storing and retrieving information in memory, with authority provided under MPEP § 2106.05(d) sub II.iv, which is one of the four options specified in Subsection III. (MPEP § 2106.07(a)).
Accordingly, the claims are subject-matter ineligible.
Claim Rejections – 35 U.S.C. § 103
15. Applicant submits that “none of the applied references, either alone or in combination with one another teaches or suggests the invention of claim 1. Page 13 of the Office Action addresses the ‘selecting’ step (now amended to read ‘selecting at random a first perturbation from the set of perturbations for [[an]] the input signal and a corresponding desired output signal from the subset’) . . . . Even if the Patent Office correctly applied Ratner to the former version of the selecting step (Applicant does not so concede), nothing in these blurbs (or in any other) of Ratner discloses selecting a first perturbation "at random." Since none of the other applied references overcomes this deficiency in Ratner, Applicant requests withdrawal of all prior art rejections.”
(Response at p. 17).
Examiner’s Response:
Examiner respectfully disagrees because the plain meaning of the term “random” is lacking a predictable pattern or order. Accordingly, the broadest reasonable interpretation of the claim term “selecting at random” is a selection lacking a predictable pattern or order, which is not inconsistent with the Applicant’s disclosure, (MPEP § 2111), that covers the teachings of Ratner where values may be modified, or perturbed, inherently without a given order or sequence. In this regard, the cited art of Ratner
Moreover, the rejections hereinabove clearly sets forth which claim limitations are taught by each of the prior art references, and the reason why it would be obvious to a person having ordinary skill in the art as of the effective filing date of the Applicant's invention to combine their teachings, and Applicant has not explained why the cited prior art references cannot be combined in the manner set forth in the rejection.
Conclusion
16. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
17. The prior art made of record and not relied upon is considered pertinent to Applicant's disclosure:
(US Patent 10007866 to Criminisi et al.) teaches a training engine is described which has a memory arranged to access a neural network image classifier, the neural network image classifier having been trained using a plurality of training images from an input space, the training images being labeled for a plurality of classes. The training engine has an adversarial example generator which computes a plurality of adversarial images by, for each adversarial image, searching a region in the input space around one of the training images, the region being one in which the neural network is linear, to find an image which is incorrectly classified into the plurality of classes by the neural network. The training engine has a processor which further trains the neural network image classifier using at least the adversarial images.
(Bertsimas et al., “Robust Classification,” INFORMS Journal on Optimization (2019)) teaches n robust formulations for the three most widely used classification methods: support vector machines, logistic regression, and decision trees. We show that adding robustness does not materially change the complexity of the problem and that all robust counterparts can be solved in practical computational times. We demonstrate the advantage of these robust formulations over regularized and nominal methods in synthetic data experiments, and we show that our robust classification methods offer improved out-of-sample accuracy.
18. Any inquiry concerning this communication or earlier communications from the Examiner should be directed to KEVIN L. SMITH whose telephone number is (571) 272-5964. Normally, the Examiner is available on Monday-Thursday 0730-1730.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the Examiner by telephone are unsuccessful, the Examiner’s supervisor, KAKALI CHAKI can be reached on 571-272-3719. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/K.L.S./
Examiner, Art Unit 2122
/KAKALI CHAKI/Supervisory Patent Examiner, Art Unit 2122