DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 02/20/2026 has been entered.
Response to Arguments
Applicant's arguments filed 02/20/2026regarding the rejection under 35 USC 101 have
been fully considered but they are not persuasive.
Applicant argues, see especially pages 8, that claims 1, 4-5, 8, 11-12, 15, 18-19, and 21-26, are -patent eligible because “Applicant respectfully traverses the rejection and asserts that the invention provides an improvement in computer-related technology as well as an improvement to at least the field of federated learning, as described in at least paragraphs [0018] - [0022] and [0058] of the specification. These paragraphs describe the utilization of abstract interpretation techniques to ensure that a resulting aggregated model is robust and not stealthily compromised. The advantages of Applicant's approach over the prior art is that the abstract interpretation is sound and it is impossible for a datapoint which was certified to have its predicted class change under any circumstance, subject to a defined bound. Furthermore, Applicant's invention includes a certifier and filtering components that can detect and reject stealthy compromise. Regardless of stealth, due to the soundness of abstract interpretation if a datapoint could be misclassified under the specified bound it will always be detected. Accordingly, even if a quorum is fully malicious Applicant's invention provides robust detection. In the August 4t Subject Matter Eligibility Memo it states that "The examiner is reminded to consult the specification to determine whether the disclosed invention improves technology or a technical field and evaluate the claim to ensure it reflects the disclosed improvement." Applicant directs the Examiner to the paragraphs recited above and reminds the Examiner that the "claim itself does not need to explicitly recite the improvement described in the specification." Nonetheless, in the interest of expediting prosecution, Applicant has accordingly amended independent claims 1, 8, and 15 to include language further detailing the transforming of the dataset and the training of the centralized machine learning model. The amendments below were made in under the guidance of the August 4th Memo to ensure that the claims reflect the disclosed improvement." More specifically, Applicant has amended” Examiner respectfully disagrees. The disclosure does not provide sufficient details such that one of ordinary skill in the art would recognize the claimed invention as providing an improvement. The specification merely sets forth an improvement in a conclusory manner and does not provide enough details for one of ordinary skill in the art to recognize the elements laid out in the specification as being an improvement over the prior state of the art.
Applicant argues, see especially pages 9, that claims 1-20, are -patent eligible because “The 2019 Revised Patent Subject Matter Eligibility Guidance provides that an invention is not abstract if it is determined that additional elements are recited in the claim beyond an alleged judicial exception which integrate the exception into a practical application of the exception. This requires an element in the claim to apply, rely on, or use the judicial exception in a manner that imposes a meaningful limit on the judicial exception. Based on this recent guidance, Applicant's claims, which are implemented on a computer, are necessarily not abstract. Specifically, Applicant's invention recites a computer- implemented method, system, and program product for federated learning. Applicant asserts that these claims do not seek to cover a judicial exception to patent eligibility.” Examiner respectfully disagrees. Claims can recite a mental process even if they are claimed as being performed on a computer. The Supreme Court recognized this in Benson, determining that a mathematical algorithm for converting binary coded decimal to pure binary within a computer’s shift register was an abstract idea. The Court concluded that the algorithm could be performed purely mentally even though the claimed procedures "can be carried out in existing computers long in use, no new machinery being necessary." 409 U.S at 67, 175 USPQ at 675. See also Mortgage Grader, 811 F.3d at 1324, 117 USPQ2d at 1699 (concluding that concept of "anonymous loan shopping" recited in a computer system claim is an abstract idea because it could be "performed by humans without a computer"). (MPEP 2106.04(a)(2)(III)(C)).
The rejection under 35 USC 101 is maintained.
Applicant's arguments filed 02/20/2026regarding the rejection under 35 USC 103 have
been fully considered but they are not persuasive.
Applicant’s arguments with respect to claim(s) 1, 4-5, 8, 11-12, 15, 18-19, and 21-26 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
The rejection under 35 USC 103 is maintained.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea (mental process) without significantly more.
Regarding claim 1, in Step 1 of the 101 analyses set forth in MPEP 2106, the claim recites A method, by a processor, for providing enhanced adversarial robustness of machine learning models using certification for federated learning in a computing environment, comprising: A method is one of the four statutory categories.
In Step 2a Prong 1 of the 101 analyses set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process/mathematical concept but for recitation of generic computer components:
generating one or more certification parameters and one or more filtered machine learning model updates for a machine learning model by certifying each of plurality of data points using one or more abstract representations in a machine learning operation and (generating one or more certification parameters and one or more machine learning model updates by certifying each of a plurality of data points represents a mathematical calculation which falls within the mathematical concept grouping of abstract ideas 2106.04(a)(2)).
determining if a robustness property holds for the neural network by analyzing an abstract output of the neural network; (a person can mentally determine if a robustness property holds by a process of simply evaluating the output of the neural network and making a judgement on if the output is robust)
transforming the dataset into one or more abstract representations, wherein the one or more abstract representations represent each one of a plurality of data points based on the set of hyperparameters; (a person can mentally transform a data set into one or more abstract representations based on a set of hyperparameters by a process of simply evaluating the data and the hyperparameters and make a judgement on how to transform the data (MPEP 2106).))
filtering the plurality of machine learning model updates, (a person can mentally filter machine learning updates by a process of simply evaluating the update and making a judgement on whether or not it is a valid update that meets specified filters (MPEP 2106).))
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process/mathematical concept but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. According, the claim “recites” an abstract idea.
In Step 2a Prong 2 of the 101 analyses set forth in MPEP 2106, the examiner has determined that the following additional elements do not integrate this judicial exception into a practical application:
receiving a plurality of machine learning model updates, a dataset, and a set of hyperparameters; and (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g))).
passing the one or more abstract representations for each of the plurality of data points through a neural network in a domain; (Merely utilizing a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f))).
training a centralized machine learning model using the one or more certification parameters and the one or more filtered machine learning model updates. (Merely training a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f))).
Since the claim does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In Step 2b of the 101 analyses set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
receiving a plurality of machine learning model updates, a dataset, and a set of hyperparameters; and (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g)), Furthermore the additional element is directed to receiving or transmitting data over a network / performing repetitive calculations / electronic recordkeeping / storing and retrieving information in memory / electronically scanning or extracting data from a physical document, which the courts have recognized as well‐understood, routine, and conventional when they are claimed in a generic manner. See MPEP § 2106.05(d)(II).).
passing the one or more abstract representations for each of the plurality of data points through a neural network in a domain; (Merely utilizing a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f)) Furthermore, the additional element is directed to application of a computer tool (machine learning model), which is not indicative of significantly more (MPEP 2106.05(f)).
training a centralized machine learning model using the one or more certification parameters and the one or more filtered machine learning model updates. (Merely training a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f)) Furthermore, the additional element is directed to application of a computer tool (machine learning model), which is not indicative of significantly more (MPEP 2106.05(f)).)
Regarding claim 4 it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 4 recites filtering the plurality of machine learning model updates by accepting or rejecting one or more of the plurality of machine learning model updates. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally accept or reject one or more of a plurality of machine learning updates by a process of simply evaluating the updates and making a judgement on weather to reject or accept the update.) accepting one or more of the plurality of machine learning model updates for those of the one or more certification parameters above a defined threshold. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally accept a machine learning update by a process of simply evaluating the update and making a judgement on if to accept the machine learning model update or not.)
Regarding claim 5 it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 5 recites maintaining one or more certification statistics to accept those of the plurality of machine learning model updates associated with one or more clients during the filtering. (In step 2A, prong 2, this recites insignificant extra solution activity of mere data storage, which is not indicative of integration into a practical application (MPEP 2106.05(g)). In step 2B, this recites storing and retrieving information in memory which is a well-understood, routine and conventional activity, which is not indicative of significantly more.) tracking one or more certification statistics to accept those of the plurality of machine learning model updates for one or more clients. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally track one or more certification statistics by a process of simply evaluating the certification statistics and making a judgement on if to accept the machine learning model updates)
Regarding claim 8, in Step 1 of the 101 analyses set forth in MPEP 2106, the claim recites A system for providing enhanced adversarial robustness of machine learning models using certification for federated learning in a computing environment, comprising:. A system is one of the four statutory categories.
In Step 2a Prong 1 of the 101 analyses set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process/mathematical concept but for recitation of generic computer components:
generate one or more certification parameters and one or more filtered machine learning model updates for a machine learning model by certifying each of plurality of data points using one or more abstract representations in a machine learning operation and (generating one or more certification parameters and one or more machine learning model updates by certifying each of a plurality of data points represents a mathematical calculation which falls within the mathematical concept grouping of abstract ideas 2106.04(a)(2)).
determine if a robustness property holds for the neural network by analyzing an abstract output of the neural network; (a person can mentally determine if a robustness property holds by a process of simply evaluating the output of the neural network and making a judgement on if the output is robust)
transforming the dataset into one or more abstract representations, wherein the one or more abstract representations represent each one of a plurality of data points based on the set of hyperparameters; (a person can mentally transform a data set into one or more abstract representations based on a set of hyperparameters by a process of simply evaluating the data and the hyperparameters and make a judgement on how to transform the data (MPEP 2106).))
filtering the plurality of machine learning model updates, (a person can mentally filter machine learning updates by a process of simply evaluating the update and making a judgement on whether or not it is a valid update that meets specified filters (MPEP 2106).))
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process/mathematical concept but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. According, the claim “recites” an abstract idea.
In Step 2a Prong 2 of the 101 analyses set forth in MPEP 2106, the examiner has determined that the following additional elements do not integrate this judicial exception into a practical application:
one or more computers with executable instructions that when executed cause the system to: (Generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))).
receive a plurality of machine learning model updates, a dataset, and a set of hyperparameters; and (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g))).
pass the one or more abstract representations for each of the plurality of data points through a neural network in a domain; (Merely utilizing a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f))).
training a centralized machine learning model using the one or more certification parameters and the one or more filtered machine learning model updates. (Merely training a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f))).
Since the claim does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In Step 2b of the 101 analyses set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
one or more computers with executable instructions that when executed cause the system to: (Generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h)) Furthermore the additional element is directed to generally linking the use of the judicial exception to a particular technological environment or field of use, which is not indicative of significantly more.).
receive a plurality of machine learning model updates, a dataset, and a set of hyperparameters; and (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g)) Furthermore the additional element is directed to receiving or transmitting data over a network / performing repetitive calculations / electronic recordkeeping / storing and retrieving information in memory / electronically scanning or extracting data from a physical document, which the courts have recognized as well‐understood, routine, and conventional when they are claimed in a generic manner. See MPEP § 2106.05(d)(II).).
pass the one or more abstract representations for each of the plurality of data points through a neural network in a domain; (Merely utilizing a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f))) Furthermore, the additional element is directed to application of a computer tool (machine learning model), which is not indicative of significantly more (MPEP 2106.05(f)).)
training a centralized machine learning model using the one or more certification parameters and the one or more filtered machine learning model updates. (Merely training a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f)) Furthermore, the additional element is directed to application of a computer tool (machine learning model), which is not indicative of significantly more (MPEP 2106.05(f)).)
As discussed above, additional elements (iii.) and (v.) recite generally linking the use of the judicial exception to a particular technological environment or field of use, which is not indicative of significantly more. Additional element (iv.) recites insignificant extra solution activities. Further, element (iv.) recites a step that are further interpreted as representing steps of merely receiving data over a network, which has been determined by the courts to recite a well understood, routine and conventional activity which is not indicative of significantly more.
Regarding claim 11 it is dependent upon claim 8, and thereby incorporates the limitations of, and corresponding analysis applied to claim 8. Further, claim 11 recites the executable instructions that when executed cause the system to (In step 2A prong 2, instructions to be executed by a system constitutes “applying” the instructions (MPEP 2106.05(f)). In step 2B, mere instructions to apply a judicial exception is not indicative of significantly more.) filter the plurality of machine learning model updates by accepting or rejecting one or more of the plurality of machine learning model updates. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally accept or reject one or more of a plurality of machine learning updates by a process of simply evaluating the updates and making a judgement on weather to reject or accept the update.) accept one or more of the plurality of machine learning model updates for those of the one or more certification parameters above a defined threshold. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally accept a machine learning update by a process of simply evaluating the update and making a judgement on if to accept the machine learning model update or not.)
Regarding claim 12 it is dependent upon claim 8, and thereby incorporates the limitations of, and corresponding analysis applied to claim 8. Further, claim 12 recites the executable instructions that when executed cause the system to (In step 2A prong 2, instructions to be executed by a system constitutes “applying” the instructions (MPEP 2106.05(f)). In step 2B, mere instructions to apply a judicial exception is not indicative of significantly more.) maintain one or more certification statistics to accept those of the plurality of machine learning model updates associated with one or more clients during the filtering. (In step 2A, prong 2, this recites insignificant extra solution activity of mere data storage, which is not indicative of integration into a practical application (MPEP 2106.05(g)). In step 2B, this recites storing and retrieving information in memory which is a well-understood, routine and conventional activity, which is not indicative of significantly more.) track one or more certification statistics to accept those of the plurality of machine learning model updates for one or more clients. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally track one or more certification statistics by a process of simply evaluating the certification statistics and making a judgement on if to accept the machine learning model updates)
Regarding claim 15, in Step 1 of the 101 analyses set forth in MPEP 2106, the claim recites A computer program product for providing enhanced adversarial robustness of machine learning models using certification for federated learning in a computing environment, the computer program product comprising:. An apparatus is one of the four statutory categories.
In Step 2a Prong 1 of the 101 analyses set forth in the MPEP 2106, the examiner has determined that the following limitations recite a process that, under the broadest reasonable interpretation, covers a mental process/mathematical concept but for recitation of generic computer components:
program instructions to generate one or more certification parameters and one or more filtered machine learning model updates for a machine learning model by certifying each of plurality of data points using one or more abstract representations in a machine learning operation and (generating one or more certification parameters and one or more machine learning model updates by certifying each of a plurality of data points represents a mathematical calculation which falls within the mathematical concept grouping of abstract ideas 2106.04(a)(2)).
… transforming the dataset into one or more abstract representations, wherein the one or more abstract representations represent each one of a plurality of data points based on the set of hyperparameters; (a person can mentally transform a data set into one or more abstract representations based on a set of hyperparameters by a process of simply evaluating the data and the hyperparameters and make a judgement on how to transform the data (MPEP 2106).))
program instructions to determine if a robustness property holds for the neural network by analyzing an abstract output of the neural network; (a person can mentally determine if a robustness property holds by a process of simply evaluating the output of the neural network and making a judgement on if the output is robust)
filtering the plurality of machine learning model updates, (a person can mentally filter machine learning updates by a process of simply evaluating the update and making a judgement on whether or not it is a valid update that meets specified filters (MPEP 2106).))
If claim limitations, under their broadest reasonable interpretation, covers performance of the limitations as a mental process/mathematical concept but for the recitation of generic computer components, then it falls within the mental process grouping of abstract ideas. According, the claim “recites” an abstract idea.
In Step 2a Prong 2 of the 101 analyses set forth in MPEP 2106, the examiner has determined that the following additional elements do not integrate this judicial exception into a practical application:
one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instruction comprising: (Generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))).
program instructions to receive a plurality of machine learning model updates, a dataset, and a set of hyperparameters; and (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g))).
…program instructions to… (program instructions constitutes “applying” the machine learning model (MPEP 2106.05(f))).
program instructions to pass the one or more abstract representations for each of the plurality of data points through a neural network in a domain; (Merely utilizing a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f))).
Program instructions to train a centralized machine learning model using the one or more certification parameters and the one or more filtered machine learning model updates. (Merely training a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f))).
Since the claim does not contain any other additional elements that are indicative of integration into a practical application, the claim is “directed” to an abstract idea.
In Step 2b of the 101 analyses set forth in the 2019 PEG, the examiner has determined that the claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instruction comprising: (Generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h)) Furthermore the additional element is directed to generally linking the use of the judicial exception to a particular technological environment or field of use, which is not indicative of significantly more.).
program instructions to receive a plurality of machine learning model updates, a dataset, and a set of hyperparameters; and (Adding insignificant extra-solution activity (mere data gathering) to the judicial exception (MPEP 2106.05(g)) Furthermore the additional element is directed to receiving or transmitting data over a network / performing repetitive calculations / electronic recordkeeping / storing and retrieving information in memory / electronically scanning or extracting data from a physical document, which the courts have recognized as well‐understood, routine, and conventional when they are claimed in a generic manner. See MPEP § 2106.05(d)(II).).
…program instructions to… (program instructions constitutes “applying” the machine learning model (MPEP 2106.05(f)) Furthermore, the additional element is directed to application of a computer tool (machine learning model), which is not indicative of significantly more (MPEP 2106.05(f)).)
program instructions to pass the one or more abstract representations for each of the plurality of data points through a neural network in a domain; (Merely utilizing a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f)) Furthermore, the additional element is directed to application of a computer tool (machine learning model), which is not indicative of significantly more (MPEP 2106.05(f)).)
program instructions to train a centralized machine learning model using the one or more certification parameters and the one or more filtered machine learning model updates. (Merely training a generic machine learning model constitutes “applying” the machine learning model (MPEP 2106.05(f)) Furthermore, the additional element is directed to application of a computer tool (machine learning model), which is not indicative of significantly more (MPEP 2106.05(f)).)
Regarding claim 18 it is dependent upon claim 15, and thereby incorporates the limitations of, and corresponding analysis applied to claim 15. Further, claim 16 recites further including program instructions to (In step 2A prong 2, instructions to be executed by a system constitutes “applying” the instructions (MPEP 2106.05(f)). In step 2B, mere instructions to apply a judicial exception is not indicative of significantly more.) filter the plurality of machine learning model updates by accepting or rejecting one or more of the plurality of machine learning model updates. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally accept or reject one or more of a plurality of machine learning updates by a process of simply evaluating the updates and making a judgement on weather to reject or accept the update.) accepting one or more of the plurality of machine learning model updates for those of the one or more certification parameters above a defined threshold. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally accept a machine learning update by a process of simply evaluating the update and making a judgement on if to accept the machine learning model update or not.)
Regarding claim 19 it is dependent upon claim 15, and thereby incorporates the limitations of, and corresponding analysis applied to claim 15. Further, claim 16 recites further including program instructions to: (In step 2A prong 2, instructions to be executed by a system constitutes “applying” the instructions (MPEP 2106.05(f)). In step 2B, mere instructions to apply a judicial exception is not indicative of significantly more.) maintain one or more certification statistics to accept those of the plurality of machine learning model updates associated with one or more clients during the filtering; and (In step 2A, prong 2, this recites insignificant extra solution activity of mere data storage, which is not indicative of integration into a practical application (MPEP 2106.05(g)). In step 2B, this recites storing and retrieving information in memory which is a well-understood, routine and conventional activity, which is not indicative of significantly more.) track the one or more certification statistics to accept those of the plurality of machine learning model updates for each of the one or more clients. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally track one or more certification statistics by a process of simply evaluating the certification statistics and making a judgement on if to accept the machine learning model updates)
Regarding claim 21 it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 21 recites identifying one or more areas subject to an adversarial attack in the machine learning model by specifying an Linfinity bound in abstract interpretation, wherein the Linfinity Specifies a maximum change applied to a feature in each one of the plurality of data points. (In step 2A, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))). In step 2B, generally linking the use of the judicial exception to a particular technological environment is not indicative of significantly more.)
Regarding claim 23 it is dependent upon claim 22, and thereby incorporates the limitations of, and corresponding analysis applied to claim 22. Further, claim 23 recites wherein the domain is at least, one or more of, an interval, a zonotope, an octagon, or a polyhedral. (In step 2A, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))). In step 2B, generally linking the use of the judicial exception to a particular technological environment is not indicative of significantly more.) wherein a concrete element is represented with all perturbations with an abstract element, and wherein the determining whether the robustness property of the neural network holds is performed by passing the abstract element through the neural network and analyzing the abstract output to determine whether any of the plurality of data points results in the neural network changing predictions. (In step 2A, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))). In step 2B, generally linking the use of the judicial exception to a particular technological environment is not indicative of significantly more.)
Regarding claim 24 it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 24 recites wherein the plurality of machine learning updates, the dataset, and the set of hyperparameters are received by a federated learning service, and wherein the federated learning service is comprised of at least a training component, a certifier component, a filter component, a machine learning component, and a tracker component. (In step 2A, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))). In step 2B, generally linking the use of the judicial exception to a particular technological environment is not indicative of significantly more.)
Regarding claim 25 it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 25 recites wherein the set of hyperparameters are defender specified certification parameters including at least an Lp bound and certification domain. (In step 2A, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))). In step 2B, generally linking the use of the judicial exception to a particular technological environment is not indicative of significantly more.)
Regarding claim 27 it is dependent upon claim 24, and thereby incorporates the limitations of, and corresponding analysis applied to claim 24. Further, claim 27 recites determining, by the certifier component, whether each of the plurality of datapoints are misclassified under a given bounds based on the passing of the one or more abstract representations through the neural network. (In step 2A, prong 1, this recites a mental process without significantly more. A person can mentally determine whether each of a plurality of data points are misclassified by a process of simply evaluating the datapoints and making a judgement on if they are in or outside the predefined bounds)
Regarding claim 28 it is dependent upon claim 1, and thereby incorporates the limitations of, and corresponding analysis applied to claim 1. Further, claim 28 recites accepting or rejecting, by a filtering component in association with a certifier component, each of the plurality of machine learning model updates, wherein one or more certification statistics are maintained for the accepting of updates during the filtering. . (In step 2A, prong 2, this recites generally linking the use of the judicial exception to a particular technological environment or field of use (MPEP 2106.05(h))). In step 2B, generally linking the use of the judicial exception to a particular technological environment is not indicative of significantly more.)
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35
Claims 1, 4-5, 8, 11-12, 15, 18-19, 21, and 23-28 are rejected under 35 U.S.C. 103 as being unpatentable over Xie et al. “CRFL: Certifiably Robust Federated Learning against Backdoor Attacks” in view of Sundaresan, Patent No: US 12033039 B2.
Regarding claim 1 Xie teaches A method, by a processor, for providing enhanced adversarial robustness of machine learning models using certification for federated learning in a computing environment, comprising: (Xie, page 3-7, section 4-5, teaches a certifiably robust federated learning system against backdoor attacks (i.e. adversarial). Machine learning inherently is done on a computer that contains a processor to operate) receiving a plurality of machine learning model updates, a dataset and a set of hyperparameters; (Xie, page 3-4, section 4, teaches a federated learning method that has a central server that receives updated models from the various other nodes in the federated learning model. Xie, page 2, section 3.1, teaches the use of a dataset that is used in the certification process. Xie, page 5, section 5.1, Corollary 1, teaches the use of two hyperparameters in the training and detecting of the robustness of the global model in the federated learning model.) …1 generating one or more certification parameters …2…3 (Xie, page 6, section 5.3, teaches how the CRFL generates the certification parameters and determines if the model is certifiably robust. Further Xie, page 7, section 6.1 teaches the use of certified rate and certified accuracy as different metrics for determining the certification of the model.) training a centralized machine learning model using …4 (Xie, page 3-4, section 4, teaches the updating of the central model based on the certification of the updated models and the certification parameters generated from the certification process,)
Xie does not teach …1 transforming the dataset into one or more abstract representations, wherein the one or more abstract representations represent each one of a plurality of data points based on the set of hyperparameters; passing the one or more abstract representations for each of the plurality of data points through a neural network in a domain; 5… However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, teaches the use of machine learning and machine learning algorithms in the process of federated learning, machine learning models abstract the data that is input to them in order for them to create an internal understanding of the data. This abstracted data is used in the process of certifying a model.)
Further Xie does not teach …2and one or more filtered machine learning model updates for a machine learning model by certifying each of plurality of data points using one or more abstract representations in a machine learning operation However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, teaches the edge models sending model updates to a central server that is running a certify node. The certifying node goes through each point of data and verifies that that data point has not been used in the training of the model before in order to obtain a certified version of the model. The model uses and encrypted version of the data (i.e., abstract representation) in the process of certification.)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine Sundaresan’s teaching of filtering machine learning updates in a federated learning system based on a threshold with Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the federated learning central node to determine which updates are valid non-corrupted machine learning updates and to reject them.
Further Xie does not teach and filtering the plurality of machine learning model updates, …3 However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value)
Further Xie does not teach …4 the one or more filtered machine learning model updates. However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine Sundaresan’s teaching of filtering machine learning updates based on a threshold value with Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the central node of the federated learning system to determine which updates get incorporated into the main global model and which updates get rejected.
Further the combination of Xie and Sundaresan does not teach 9…determining if a robustness property holds for the neural network by analyzing an abstract output of the neural network;… However, Lin teaches this limitation in analogous art (Lin, page 149-151, section II, teaches the correctness analysis machine learning algorithm that produces an abstract output and analyses it for robustness.)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine’s Lin teaching of a machine learning system to check correctness using abstract outputs value with Sundaresan and Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the federated leaning system to handle abstract inputs and outputs and evaluate them for correctness along with non-abstract inputs and outputs.
Regarding Claim 4 the combination of Xie, Sundaresan, and Lin teaches the method of claim 1, further including filtering the plurality of machine learning model updates by accepting or rejecting one or more of the plurality of machine learning model updates and (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value) accepting one or more of the plurality of machine learning model updates for those of the one or more certification parameters above a defined threshold. (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value. Where it is inherent that threshold values are reversable meaning the saying that a value is above the defined threshold is the same as saying that the value is below the same threshold value if the numbers are represented in a different manner.)
Regarding Claim 5 the combination of Xie, Sundaresan, and Lin teaches the method of claim 1, further including maintains one or more certification statistics (Xie, page 7, section 6.1, teaches the maintaining of the certified radius, certified rate and certified accuracy which are certification statistics that are used in the process of certifying model updates.) to accept those of the plurality of machine learning model updates associated with one or more clients during the filtering and (Sundaresan, page 7, column 7, paragraph 3, teaches the filtering of model updates using the number of times that the model has submitted updates and has been updated along with the checking of the data that was used in training the current update. It is also checked against an encrypted version of the original model in which the model was initially trained with.) tracking one or more certification statistics to accept those of the plurality of machine learning model updates for one or more clients. (Xie, page 7, section 6.1, teaches the tracking of the certified radius, certified rate and certified accuracy which are certification statistics that are used in the process of certifying model updates.)
Regarding Claim 8 Xie teaches A system for providing enhanced adversarial robustness of machine learning models using certification for federated learning in a computing environment, comprising: one or more computers with executable instructions that when executed cause the system to: (Xie, page 3-7, section 4-5, teaches a certifiably robust federated learning system against backdoor attacks (i.e. adversarial). Machine learning inherently is done on a computer that contains a processor that execute instructions to operate, further federated learning is inherently done on distributed computing systems that also inherently use processors that execute instructions to operate.) receive a plurality of machine learning model updates, a dataset, and a set of hyperparameters; (Xie, page 3-4, section 4, teaches a federated learning method that has a central server that receives updated models from the various other nodes in the federated learning model. Xie, page 2, section 3.1, teaches the use of a dataset that is used in the certification process. Xie, page 5, section 5.1, Corollary 1, teaches the use of two hyperparameters in the training and detecting of the robustness of the global model in the federated learning model.) …5 generate one or more certification parameters …6 …7 (Xie, page 6, section 5.3, teaches how the CRFL generates the certification parameters and determines if the model is certifiably robust. Further Xie, page 7, section 6.1 teaches the use of certified rate and certified accuracy as different metrics for determining the certification of the model.) training a centralized machine learning model using …8 (Xie, page 3-4, section 4, teaches the updating of the central model based on the certification of the updated models and the certification parameters generated from the certification process,)
Xie does not teach …5 transforming the dataset into one or more abstract representations, wherein the one or more abstract representations represent each one of a plurality of data points based on the set of hyperparameters; passing the one or more abstract representations for each of the plurality of data points through a neural network in a domain; 9… However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, teaches the use of machine learning and machine learning algorithms in the process of federated learning, machine learning models abstract the data that is input to them in order for them to create an internal understanding of the data. This abstracted data is used in the process of certifying a model.)
Further Xie does not teach …6 and one or more filtered machine learning model updates for a machine learning model by certifying each of plurality of data points using one or more abstract representations in a machine learning operation However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, teaches the edge models sending model updates to a central server that is running a certify node. The certifying node goes through each point of data and verifies that that data point has not been used in the training of the model before in order to obtain a certified version of the model. The model uses and encrypted version of the data (i.e., abstract representation) in the process of certification.) However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine Sundaresan’s teaching of filtering machine learning updates based on a threshold value with Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the central node of the federated learning system to determine which updates get incorporated into the main global model and which updates get rejected.
Further Xie does not teach and filtering the plurality of machine learning model updates, …7 However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value)
Further Xie does not teach …8 the one or more filtered machine learning model updates. However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine Sundaresan’s teaching of filtering machine learning updates based on a threshold value with Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the central node of the federated learning system to determine which updates get incorporated into the main global model and which updates get rejected.
Further the combination of Xie and Sundaresan does not teach 5…determining if a robustness property holds for the neural network by analyzing an abstract output of the neural network;… However, Lin teaches this limitation in analogous art (Lin, page 149-151, section II, teaches the correctness analysis machine learning algorithm that produces an abstract output and analyses it for robustness.)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine’s Lin teaching of a machine learning system to check correctness using abstract outputs value with Sundaresan and Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the federated leaning system to handle abstract inputs and outputs and evaluate them for correctness along with non-abstract inputs and outputs.
Regarding Claim 11 the combination of Xie, Sundaresan, and Lin teaches the system of claim 8, wherein the executable instructions that when executed cause the system to filter the plurality of machine learning model updates by accepting or rejecting one or more of the plurality of machine learning model updates and (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value) accepting one or more of the plurality of machine learning model updates for those of the one or more certification parameters above a defined threshold. (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value. Where it is inherent that threshold values are reversable meaning the saying that a value is above the defined threshold is the same as saying that the value is below the same threshold value if the numbers are represented in a different manner.)
Regarding Claim 12 the combination of Xie, Sundaresan, and Lin teaches the system of claim 8, wherein the executable instructions that when executed cause the system to maintain one or more certification statistics and (Xie, page 7, section 6.1, teaches the maintaining of the certified radius, certified rate and certified accuracy which are certification statistics that are used in the process of certifying model updates.) to accept those of the plurality of machine learning model updates associated with one or more clients during the filtering. (Sundaresan, page 7, column 7, paragraph 3, teaches the filtering of model updates using the number of times that the model has submitted updates and has been updated along with the checking of the data that was used in training the current update. It is also checked against an encrypted version of the original model in which the model was initially trained with.) tracking one or more certification statistics to accept those of the plurality of machine learning model updates for one or more clients. (Xie, page 7, section 6.1, teaches the tracking of the certified radius, certified rate and certified accuracy which are certification statistics that are used in the process of certifying model updates.)
Regarding Claim 15 Xie teaches A computer program product for providing enhanced adversarial robustness of machine learning models using certification for federated learning in a computing environment, the computer program product comprising: one or more computer readable storage media, and program instructions collectively stored on the one or more computer readable storage media, the program instruction comprising: (Xie, page 3-7, section 4-5, teaches a certifiably robust federated learning system against backdoor attacks (i.e. adversarial). Machine learning inherently is done on a computer that contains a processor to operate, further federated learning is inherently done on distributed computing systems that also inherently use processors to operate.) program instructions to receive a plurality of machine learning model updates, a dataset, and a set of hyperparameters; (Xie, page 3-4, section 4, teaches a federated learning method that has a central server that receives updated models from the various other nodes in the federated learning model. Xie, page 2, section 3.1, teaches the use of a dataset that is used in the certification process. Xie, page 5, section 5.1, Corollary 1, teaches the use of two hyperparameters in the training and detecting of the robustness of the global model in the federated learning model.) …9 program instructions to generate one or more certification parameters (Xie, page 6, section 5.3, teaches how the CRFL generates the certification parameters and determines if the model is certifiably robust. Further Xie, page 7, section 6.1 teaches the use of certified rate and certified accuracy as different metrics for determining the certification of the model.) …10 …11wherein the abstract representations represent each one of the plurality of data points (Xie, page 3-7, section 4-5, teaches the use of machine learning and algorithms for the certification of data in which the data that is fed into these machine learning models is transformed to an abstract representation in order for it to be processed by the model.) program instructions to train a centralized machine learning model using …12 (Xie, page 3-4, section 4, teaches the updating of the central model based on the certification of the updated models and the certification parameters generated from the certification process,)
Xie does not teach …9 program instructions to transform the dataset into one or more abstract representations, wherein the one or more abstract representations represent each one of a plurality of data points based on the set of hyperparameters; program instructions to pass the one or more abstract representations for each of the plurality of data points through a neural network in a domain; 13… However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, teaches the use of machine learning and machine learning algorithms in the process of federated learning, machine learning models abstract the data that is input to them in order for them to create an internal understanding of the data. This abstracted data is used in the process of certifying a model.)
Further Xie does not teach …10 and one or more filtered machine learning model updates for a machine learning model by certifying each of plurality of data points using one or more abstract representations in a machine learning operation However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, teaches the edge models sending model updates to a central server that is running a certify node. The certifying node goes through each point of data and verifies that that data point has not been used in the training of the model before in order to obtain a certified version of the model. The model uses and encrypted version of the data (i.e., abstract representation) in the process of certification.)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine Sundaresan’s teaching of filtering machine learning updates in a federated learning system based on a threshold with Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the federated learning central node to determine which updates are valid non-corrupted machine learning updates and to reject them.
Further Xie does not teach and filtering the plurality of machine learning model updates, …11 However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value)
Further Xie does not teach …12 the one or more filtered machine learning model updates. However, Sundaresan in analogous art teaches this limitation (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine Sundaresan’s teaching of filtering machine learning updates based on a threshold value with Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the central node of the federated learning system to determine which updates get incorporated into the main global model and which updates get rejected.
Further the combination of Xie and Sundaresan does not teach 13… program instructions to determine if a robustness property holds for the neural network by analyzing an abstract output of the neural network;… However, Lin teaches this limitation in analogous art (Lin, page 149-151, section II, teaches the correctness analysis machine learning algorithm that produces an abstract output and analyses it for robustness.)
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to combine’s Lin teaching of a machine learning system to check correctness using abstract outputs value with Sundaresan and Xie’s teaching of a federated learning system that is robust to adversarial attacks. The motivation to do so would be to allow the federated leaning system to handle abstract inputs and outputs and evaluate them for correctness along with non-abstract inputs and outputs.
Regarding Claim 18 the combination of Xie, Sundaresan, and Lin teaches the computer program product of claim 15, further including program instructions to filter the plurality of machine learning model updates by accepting or rejecting one or more of the plurality of machine learning model updates. (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value) accept one or more of the plurality of machine learning model updates for those of the one or more certification parameters above a defined threshold. (Sundaresan, page 7, column 7, paragraph 3, The certifying node receives the model updates and the data from the edge model and filters the updates by rejecting the ones that are over a set threshold and accepting the ones that are under the set threshold value. Where it is inherent that threshold values are reversable meaning the saying that a value is above the defined threshold is the same as saying that the value is below the same threshold value if the numbers are represented in a different manner.)
Regarding Claim 19 the combination of Xie, Sundaresan, and Lin teaches The computer program product of claim 15, further including program instructions to: maintain one or more certification statistics (Xie, page 7, section 6.1, teaches the maintaining of the certified radius, certified rate and certified accuracy which are certification statistics that are used in the process of certifying model updates.) to accept those of the plurality of machine learning model updates associated with one or more clients during the filtering; (Sundaresan, page 7, column 7, paragraph 3, teaches the filtering of model updates using the number of times that the model has submitted updates and has been updated along with the checking of the data that was used in training the current update. It is also checked against an encrypted version of the original model in which the model was initially trained with.) and track the one or more certification statistics to accept those of the plurality of machine learning model updates for each of the one or more clients. (Xie, page 7, section 6.1, teaches the tracking of the certified radius, certified rate and certified accuracy which are certification statistics that are used in the process of certifying model updates.)
Regarding Claim 21 the combination of Xie, Sundaresan, and Lin teaches The method of claim 1, further comprising: Linfinity identifying one or more areas subject to an adversarial attack in the machine learning model by specifying an Linfinity bound in abstract interpretation, wherein the specifies a maximum change applied to a feature in each one of the plurality of data points. (Xie, page 5, section 5, theorem 1, teaches the use of and upper bound of the backdoor for every attacker and it is applied to the data points that are being fed through the model since the model is assuming it has already been backdoored.)
Regarding Claim 23 the combination of Xie, Sundaresan, and Lin teaches The method of claim 1, wherein the domain is at least, one or more of, an interval, a zonotope, an octagon, or a polyhedral. (Sundaresan, page 7, column 7, paragraph 3, teaches the edge models sending model updates to a central server that is running a certify node. The certifying node goes through each point of data and verifies that that data point has not been used in the training of the model before in order to obtain a certified version of the model. The model goes through all the data in the range that is sent to the central server (i.e. interval.).) wherein a concrete element is represented with all perturbations with an abstract element, and wherein the determining whether the robustness property of the neural network holds is performed by passing the abstract element through the neural network and analyzing the abstract output to determine whether any of the plurality of data points results in the neural network changing predictions. (Lin, page 149-155, section II-IIII, teaches the correctness analysis machine learning takes in an abstract input with all for its possible perturbations and produces an abstract output that is then analyzed to determine if it is possible for the input to be changed and verifies its robustness.)
Regarding Claim 24 the combination of Xie, Sundaresan, and Lin teaches The method of claim 1, wherein the plurality of machine learning updates, the dataset, and the set of hyperparameters are received by a federated learning service, and wherein the federated learning service is comprised of at least a training component, a certifier component, a filter component, a machine learning component, and a tracker component. (Xie, page 2-4, sections 3-4, teaches a federated learning system, that is capable of training, certifying, filtering and tracking and utilizes a machine learning algorithm. (i.e. training component, certifier component, filter component, machine learning component, and a tracking component.))
Regarding Claim 25 the combination of Xie, Sundaresan, and Lin teaches The method of claim 1, wherein the set of hyperparameters are defender specified certification parameters including at least an Lp bound and certification domain. (Xie, page 4-5, sections 5, teaches the federated system using hyperparameters that are specified by the in the process of anomaly detection. The federated learning system looks at the features, sample, and clients to certify that no interference has taken place (i.e. certification domain). The federated learning system also uses bounds to constrain every attacker (i.e. Lp bound).)
Regarding Claim 26 the combination of Xie, Sundaresan, and Lin teaches The method of claim 1, wherein certifying each of the plurality of data points further comprises: determining whether the machine learning model has been stealthily weakened by inserting a Linfinity bounded backdoor in a federated learning round and specifying the Linfinity bound in abstract interpretation. (Xie, page 5, sections 5, teaches how the federated learning system uses an upper bound to help determine if the system has been backdoored. The federated system imposes the bound on all the inputs that are abstract representations.)
Regarding Claim 27 the combination of Xie, Sundaresan, and Lin teaches The method of claim 24, further comprising: determining, by the certifier component, whether each of the plurality of datapoints are misclassified under a given bounds based on the passing of the one or more abstract representations through the neural network. (Lin, page 149-155, section II-IIII, teaches the correctness analysis machine learning takes in an abstract input with all for its possible perturbations and produces an abstract output that is then analyzed to determine if it is possible for the input to be changed and verifies its robustness by checking if the output falls in or outside of predefined bounds.)
Regarding Claim 28 the combination of Xie, Sundaresan, and Lin teaches The method of claim 1, wherein the filtering of the plurality of machine learning model updates further comprises:accepting or rejecting, by a filtering component in association with a certifier component, each of the plurality of machine learning model updates, wherein one or more certification statistics are maintained for the accepting of updates during the filtering. (Sundaresan, page 7, column 7, paragraph 3, teaches the edge models sending model updates to a central server that is running a certify node. The certifying node goes through each point of data and verifies that that data point has not been used in the training of the model before in order to obtain a certified version of the model. The model uses and encrypted version of the data (i.e., abstract representation) in the process of certification. All of the process data is maintained by the system in order to be used for future updating of the models.)
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THOMAS B LANE whose telephone number is (571)272-1872. The examiner can normally be reached M-Th: 6:40am-4:40pm; F: Out of Office.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, MARIELA REYES can be reached at (571) 270-1006. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/THOMAS BERNARD LANE/Examiner, Art Unit 2142
/HAIMEI JIANG/Primary Examiner, Art Unit 2142
Prosecution Insights