Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This action is responsive to the claims filed on 10/27/2021. Claims 5-6, 8-10 are cancelled. Claims 1-3 are amended. Claims 1-4, 7 are pending for examination.
Priority
Receipt is acknowledged of certified copies of papers required by 37 CFR 1.55.
Drawings
The Drawings filed on 10/27/2021 are acceptable for examination purposes.
Specification
The Specification filed on 10/27/2021 is acceptable for examination purposes.
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 10/27/2021 and 12/27/2022 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 1-4, 7 rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Regarding Claim 1:
Subject Matter Eligibility Analysis Step 1:
Claim 1 recites A robustness setting device and is thus a machine, one of the four statutory categories of patentable subject matter.
Subject Matter Eligibility Analysis Step 2A Prong 1:
Claim 1 recites specify a robustness level required in a computation device using a trained model against an adversarial sample that is an input signal to which a perturbation has been added in order to induce an erroneous determination by the trained model; (a mental process of determining a robustness level).
and determine a noise removal level for the input signal based on the robustness level. (mental process of determining a noise removal level given the robustness level)
Subject Matter Eligibility Analysis Step 2A Prong 2:
Claim 1 further recites the additional element of:
A robustness setting device comprising: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to; (merely recites a generic computer or other machinery on which to perform the abstract idea, e.g. “apply it on a computer” (see MPEP 2106.05(f)).)
Subject Matter Eligibility Analysis Step 2B:
The additional elements of Claim 1 do not provide significantly more than the abstract idea itself, taken alone or in combination, because
A robustness setting device comprising: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to; (merely recites a generic computer or other machinery on which to perform the abstract idea, which by MPEP 2106.05(f) amounts to no more than instructions to apply the abstract idea on a computer or other machinery, and cannot integrate the abstract idea into a practical application.)
These additional element does not integrate the abstract idea into a practical application, taken alone or in combination. Therefore, Claim 1 is directed to the abstract idea.
Claim 2 only recites the additional elements of: wherein the at least one processor is configured to execute the instructions (which is merely using a computer or other machinery as a tool to perform the mental process, which by MPEP 2106.05(f) amounts to no more than instructions to apply the abstract idea on a computer or other machinery, and cannot integrate the abstract idea into a practical application) to specify the robustness level based on a perturbation level of the perturbation in the adversarial sample.(a further mental step of determining the robustness level based on a perturbation level).Thus, the claim remains directed towards an abstract idea.
Claim 3 only recites the additional elements of: wherein the at least one processor is further configured to execute the instructions to: (which is merely using a computer or other machinery as a tool to perform the mental process, which by MPEP 2106.05(f) amounts to no more than instructions to apply the abstract idea on a computer or other machinery, and cannot integrate the abstract idea into a practical application) generate multiple adversarial samples for each of multiple perturbation levels; (a mental process of determining changes in an input to and specify an output accuracy…with respect to the adversarial samples for each of the multiple perturbation levels, (mental process of evaluating the output of the computation device to ascertain the accuracy of the predictions) …of the computation device…wherein the at least one processor is configured to execute the instructions to (which is merely using a computer or other machinery as a tool to perform the mental process, which by MPEP 2106.05(f) amounts to no more than instructions to apply the abstract idea on a computer or other machinery, and cannot integrate the abstract idea into a practical application.) specify the robustness level based on the output accuracy for each perturbation level. which amounts to a mental process of determining a robustness level given an output accuracy for a perturbation level. Thus, the claim remains directed towards an abstract idea.
Claims 4 recite a method that the system of claim 1 implements with substantially the same limitations, respectively. Therefore the rejection applied to claim 1 also applies to claims 4.
Regarding Claim 7:
Subject Matter Eligibility Analysis Step 1:
Claim 7 recites A robustness evaluation method and is thus a method, one of the four statutory categories of patentable subject matter.
Subject Matter Eligibility Analysis Step 2A Prong 1:
Claim 7 recites A robustness evaluation method comprising: generating multiple adversarial samples for each of multiple perturbation levels for inducing an erroneous determination by a trained model; (a mental process of determining changes in an input given a perturbation level to obtain adversarial examples).
specifying an output accuracy of a computation device using the trained model with respect to the adversarial samples for each of the multiple perturbation levels; (mental process of evaluating the output of the computation device to ascertain the accuracy of the predictions)
Subject Matter Eligibility Analysis Step 2A Prong 2:
Claim 7 further recites the additional element of:
a trained model…(merely recites a generic computer or other machinery on which to perform the abstract idea, e.g. “apply it on a computer” (see MPEP 2106.05(f)).)
a computation device (merely recites a generic computer or other machinery on which to perform the abstract idea, e.g. “apply it on a computer” (see MPEP 2106.05(f)).)
and presenting information indicating a robustness level of the computation device against the adversarial samples based on the output accuracy for each of the multiple perturbation levels. (which amounts to an insignificant extra-solution activity under (MPEP 2106.05(g))
Subject Matter Eligibility Analysis Step 2B:
The additional elements of Claim 7 do not provide significantly more than the abstract idea itself, taken alone or in combination, because
a trained model…(merely recites a generic computer or other machinery (e.g. a trained model) on which to perform the abstract idea, which by MPEP 2106.05(f) amounts to no more than instructions to apply the abstract idea on a computer or other machinery, and cannot integrate the abstract idea into a practical application.)
a computation device (merely recites a generic computer or other machinery on which to perform the abstract idea, which by MPEP 2106.05(f) amounts to no more than instructions to apply the abstract idea on a computer or other machinery, and cannot integrate the abstract idea into a practical application.)
and presenting information indicating a robustness level of the computation device against the adversarial samples based on the output accuracy for each of the multiple perturbation levels. ( MPEP 2106.05(d)(II) indicates that merely “presenting offers” is well-understood, routine, and conventional function when it is claimed in a merely generic manner (as it is in the present claim). Thereby, a conclusion that the claimed presenting steps are a well-understood, routine, conventional activity is supported under Berkheimer).
These additional element does not integrate the abstract idea into a practical application, taken alone or in combination. Therefore, Claim 7 is directed to the abstract idea.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-4 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Pouya et al. “DEFENSE-GAN: PROTECTING CLASSIFIERS AGAINST ADVERSARIAL ATTACKS USING GENERATIVE MODELS”.
Regarding claim 1, Pouya teaches A robustness setting device comprising: at least one memory configured to store instructions; and at least one processor configured to execute the instructions to:("Our implementation is based on TensorFlow (Abadi et al., 2015) and builds on open-source software: CleverHans by Papernot et al. (2016a) and improved WGAN training by Gulrajani et al. (2017). We use machines equipped with NVIDIA GeForce GTX TITAN X GPUs." In other words, the methods taught by Pouya are implemented on a computer with a GPU that is understood to contain a memory and processor.)
specify a robustness level required in a computation device using a trained model against an adversarial sample that is an input signal to which a perturbation has been added in order to induce an erroneous determination by the trained model; (Section 3, "We propose a new defense strategy which uses a WGAN [Wasserstein Generative Adversarial Networks] trained on legitimate (un-perturbed) training samples to “denoise” adversarial examples." (Section 3.2) "Defense-GAN can be used in conjunction with any classifier and does not modify the classifier structure itself. It can be seen as an add-on or pre-processing step prior to classification." (Section 4.1.2) "We now investigate the effect of changing the attack ϵ in Table 3. As expected, with higher ϵ, the FGSM attack is more successful, especially on the F-MNIST dataset where the noise norm seems to have a more pronounced effect with nearly 37% drop in performance between ϵ = 0.1 and 0.3" See Table 3. The broadest reasonable interpretation of “specify a robustness level” is interpreted to include instances where a robustness level is explicitly stated (specified). In light of the instant specification, [0044] "The robustness specifying unit31 analyzes the generation model stored in the generation model storage unit32 and specifies an adversarial sample perturbation level as the robustness level. In other words, the robustness setting device30 provides the computation device10 with robustness against adversarial samples associated with the specified perturbation level." it is understood the broadest reasonable interpretation of "a robustness level" can be interpreted to include a level of perturbation. As the robustness level can be specified as "an adversarial sample perturbation level..." In other words, a robustness level, which in light of the specification may be a perturbation level, is specified as a perturbation value ϵ. The perturbation value ϵ represents the level of change or noise introduced to create an adversarial example.)
and determine a noise removal level for the input signal based on the robustness level.(Section 2.3, "GANs, originally introduced by Goodfellow et al. (2014), consist of two neural networks, G [generator] and D [discriminator]. G...maps a low-dimensional latent space to the high dimensional sample space of x. D is a binary neural network classifier...While G learns to generate outputs G(z) that have a distribution similar to that of x, D learns to discriminate between “real” samples x and “fake” samples G(z)." (Section 3) " Section 3, "We propose a new defense strategy which uses a WGAN [Wasserstein Generative Adversarial Networks] trained on legitimate (un-perturbed) training samples to “denoise” adversarial examples." In other words, it is understood that the Generator "de-noise[s]" adversarial examples (input signal) to create an output that closely represents an un-perturbed input. Additionally, it is understood that the degree of adjustments (noise removal level) made by the Generator depends on the characteristics of the adversarial example, such as the magnitude of adversarial noise. Therefore, the WGAN taught by Pouya would adjust the denoising based on the robustness level (level of perturbation in adversarial example).).
Regarding claim 2, Pouya teaches The robustness setting device according to claim 1, the at least one processor is configured to execute the instructions to specify the robustness level based on a perturbation level of the perturbation in the adversarial sample.(Pouya (Section 4.1.2) "We now investigate the effect of changing the attack ϵ in Table 3. As expected, with higher ϵ, the FGSM attack is more successful, especially on the F-MNIST dataset where the noise norm seems to have a more pronounced effect with nearly 37% drop in performance between ϵ = 0.1 and 0.3" See Table 3. In light of the interpretation explained in the rejection of claim 1, the broadest reasonable interpretation of a "robustness level" is interpreted to include a level of perturbation. Pouya teaches the specification of a perturbation level ϵ in Table 3.).
Regarding claim 3, Pouya teaches The robustness setting device according to claim 2, wherein the at least one processor is further configured to execute the instructions to: generate multiple adversarial samples for each of multiple perturbation levels; (Pouya (Section 4.1.2) "We now investigate the effect of changing the attack ϵ in Table 3. As expected, with higher ϵ, the FGSM attack is more successful, especially on the F-MNIST dataset where the noise norm seems to have a more pronounced effect with nearly 37% drop in performance between ϵ = 0.1 and 0.3. Figure 7 in Appendix D shows adversarial samples as well as their reconstructions with DefenseGAN at different values of ϵ." See Table 3 and Table 7. In other words, Table 3 shows the results of applying adversarial examples with different levels of perturbations ϵ. Table 7 further shows that multiple adversarial examples are generated for each perturbation level.)
and specify an output accuracy of the computation device with respect to the adversarial samples for each of the multiple perturbation levels, (Pouya, See Table 3. "Table 3: Classification accuracy of Model F using Defense-GAN (L = 400, R = 10), under FGSM black-box attacks for various noise norms ϵ and substitute Model E." The broadest reasonable interpretation of “specify an output accuracy” is interpreted to include any form of presenting or explicitly stating (specifying) the accuracy of a model. Table 3 shows the output accuracy of Defense GAN based on the level of perturbation in the adversarial example. For example, the accuracy of Defense GAN on denoising adversarial examples with a perturbation level of "0.20" is equal to "0.9772 ± 0.0019")
wherein the at least one processor is configured to execute the instructions to specify the robustness level based on the output accuracy for each perturbation level.(Pouya, See Table 3. The broadest reasonable interpretation of “specify the robustness level” is interpreted to include any form of presenting or explicitly stating (specifying) a robustness level. In light of the interpretation explained in the rejection of claim 1, the broadest reasonable interpretation of a "robustness level" is interpreted to include a level of perturbation. Therefore, Pouya teaches specifying the robustness level (perturbation level) in relation to, or based on, the accuracy of Defense GAN for the perturbation level.).
Claim 4 recites a method that the system of claim 1 implements with substantially the same limitations, respectively. Therefore the rejection applied to claim 1 also applies to claim 4.
In addition, Claim 4 recites A robustness setting method comprising: specifying a robustness level required in a computation device using a trained model against an adversarial sample that is an input signal to which a perturbation has been added in order to induce an erroneous determination by the trained model; and determining a noise removal level for the input signal based on the robustness level. that the “…robustness setting device comprising: at least one memory configured to store instructions; and at least one processor…" of Claim 1 is configured to perform with substantially the same limitations, respectively. Therefore, the rejection applied to claim 1 also applies to claim 4.
Claims 7 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Panda et al. “Discretization based Solutions for Secure Machine Learning against Adversarial Attacks”.
Regarding claim 7, Panda teaches A robustness evaluation method comprising: generating multiple adversarial samples for each of multiple perturbation levels for inducing an erroneous determination by a trained model; (Section IV, "For adversarial training, we employ Random-step FGSM (R-FGSM) proposed in [15] to create a variety of training set adversaries." (Abstract) "Intuitively, constraining the dimensionality of inputs or parameters of a network reduces the ‘space’ in which adversarial examples exist. Guided by this intuition, we demonstrate that discretization greatly improves the robustness of DLNs against adversarial attacks. Specifically, discretizing the input space (or allowed pixel levels from 256 values or 8bit to 4 values or 2bit) extensively improves the adversarial robustness of DLNs for a substantial range of perturbations for minimal loss in test accuracy." (Section IV) " Fig. 4 illustrates the evolution of adversarial accuracy of the CIFAR10 models (from Table I) with increasing level of perturbation, ∈." In other words, Panda uses FGSM to generate "a variety of training set adversaries" (multiple adversarial samples) with multiple levels of perturbation levels (see Figure 4, "∈ values").)
specifying an output accuracy of a computation device using the trained model with respect to the adversarial samples for each of the multiple perturbation levels; ((Section IV) "The corresponding accuracy (trained on AlexNet for 20 epochs) is shown in Table I. There is a natural tradeoff between input discretization and overall accuracy of a network." See Table I. The broadest reasonable interpretation of “specify an output accuracy” is interpreted to include any form of presenting or explicitly stating (specifying) the accuracy of a model. Therefore, Table I which explicitly states an accuracy of each level of perturbation would correspond to specifying an output accuracy with respect to the adversarial example of each perturbation level.)
and presenting information indicating a robustness level of the computation device against the adversarial samples based on the output accuracy for each of the multiple perturbation levels.(See Figure 4. In other words, the charts in figure 4 demonstrate a robustness level (performance) on adversarial examples for perturbation levels (∈ values) and the resulting accuracy on the vertical axis.).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Liang et al. “Detecting Adversarial Image Examples in Deep Neural Networks with Adaptive Noise Reduction” is considered pertinent as it discloses methods for adaptively reducing noise in adversarial image examples.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JACK H RANSOM whose telephone number is (703)756-1658. The examiner can normally be reached Monday - Friday 8am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Miranda Huang can be reached on 571-270-7092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.H.R./ Examiner, Art Unit 2124
/Kevin W Figueroa/Primary Examiner, Art Unit 2124
Prosecution Insights