DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 12/31/2025 has been entered.
Response to Arguments
Applicant's arguments filed 12/31/2025 have been fully considered and they are partially persuasive.
Regarding applicant’s remarks directed to the rejection of claims under 35 USC § 101, the applicant argues that the amended claims directed to a technical solution. Examiner respectfully agrees and withdraws the prior rejection of claims under 35 USC § 101.
Regarding applicant’s remarks directed to the rejection of claims under 35 USC § 103, the arguments are directed to newly amended limitations that were not previously examined by the examiner. Therefore, applicants arguments are rendered moot. The examiner refers to the rejection under 35 USC § 103 in the current office action for more details.
Claim Objections
Claim 1 is objected to because of the following informalities: “determining, a computer processor” should read as “determining, with a computer processor.” Appropriate correction is required.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 3, 7-9, 13-14, and 29-30 are rejected under 35 U.S.C. 103 as being unpatentable over R. Xu, J. B. D. Joshi and C. Li, "CryptoNN: Training Neural Networks over Encrypted Data," (“Xu”) in view of Xie, Cihang, et al. "Mitigating adversarial effects through randomization." arXiv preprint arXiv:1711.01991 (2017). (“Xie”)
In regards to claim 3 and analogous claims 13,
Xu teaches A method for using modified data with a neural network, the method comprising: determining, a computer processor, an algorithm to modify a plurality of examples, each example comprising an array of values, and where each example is a training example or a test example,
(Xu, Section IV. B., “The test platform is a personal computer with Intel Core i7 processor [a computer processor], 16GB memory and macOS. Note that the training process of the model only relies on the CPU.”)
(Xu, Section III A., “The proposed CryptoNN framework includes three entities: authority, server, and client as depicted in the Fig.1. The authority is responsible for setting up the crypto parameters such as public key mpk and master secret key msk. Then it holds the msk and distributes the public keys to the servers and clients. Besides, it also generates the function derived key for the server to decrypt the function result. The client first needs to pre-process the training data as required [determining an algorithm to modify a plurality of examples ie required pre-processing of the training data], and then encrypt all the pre-processed training data using the public key, mpk. The pre-processing operation can be quite simple. For instance, in the computer vision related neural network model, the pretreatment involves mapping each image into a vector. Suppose that the data is a color image with size 28 × 28. The client needs to map all 28 × 28 × 3 pixel values into one vector [each example comprising an array of values ie a vector of pixel values, where each example is a training example] and then encrypt the vector. Similar pretreatment and encryption are applied to the label. Once the encrypted training data is ready, the client sends it to the server for training a neural network model.”)
Xu teaches training, in the computer processor, the neural network by: obtaining a plurality of training examples;
(Xu, Section II A., fig. 1, “To be specific, in the training phase, what the client needs to do is encrypting its sensitive data as required and then sending it to the server. The server computes several permitted functions over encrypted data, acquires the computation result, and builds the final neural network model.”; see example sample x as the training example input
PNG
media_image1.png
341
867
media_image1.png
Greyscale
)
Xu teaches and forming a trained neural network by training the neural network with the plurality of [padded] training examples;
(Xu, Section II A., “To be specific, in the training phase, what the client needs to do is encrypting its sensitive data as required and then sending it to the server. The server computes several permitted functions over encrypted data, acquires the computation result, and builds the final neural network model [forming a trained neural network].”; wherein Xu previously teaches that the client must pre-process the training data as required (Xu, Section III A.) wherein the pre-processing is provided by the random padding layer of Xie)
Xu teaches after forming the trained neural network, deleting or encrypting at least a portion of the [padding] parameters recorded in the stored record such that the trained neural network is stored without information sufficient to reconstruct the array of values of the training examples from the [padded] training examples;
Examiner’s note: Following Examiner’s interpretation of “padding parameters” as the padded image, Examiner interprets the limitation as encrypting the padded image.
(Xu, Section II A., “Similarly, the data to be used for prediction is also encrypted [encrypting at least a portion of the padding parameters (wherein the padding is supplied by the random padding layer of Xie; Examiner points out that Xie teaches supplying the randomly padded image to the neural network) recorded in the stored record such that the trained neural network is stored without information sufficient to reconstruct the array of values of the training examples from the padded training examples; wherein since the example is encrypted, there is accordingly insufficient information to reconstruct the example] in the prediction phase, and then the server outputs the prediction using the trained model [after forming the trained neural network].”)
Xu teaches and forming a prediction in the computer processor using the trained neural network by: accepting a test example;
(Xu, Section II A., “Similarly, the data [a test example] to be used for prediction is also encrypted in the prediction phase, and then the server outputs the prediction using the trained model [forming a prediction in the computer processor using the trained neural network].”)
Xu teaches and forming a prediction from the output of the trained neural network by providing the trained neural network with the [padded] test example as input.
(Xu, Section II A., “Similarly, the data [a test example] to be used for prediction is also encrypted in the prediction phase, and then the server outputs the prediction using the trained model [forming a prediction in the computer processor using the trained neural network].”; wherein the padding is supplied by the random padding layer of Xie; Examiner points out that Xie teaches supplying the randomly padded image to the neural network)
However, Xu does not explicitly teach padded; and where the algorithm comprises a padding modification that specifies, for at least some positions of the array of values, corresponding padding values or padding rules; recording, in a stored record accessible to the computer processor, padding parameters of the padding modification, the padding parameters including data identifying the positions in the array of values that are padded and the corresponding padding values or padding rules; modifying each training example of the plurality of training examples according to the algorithm to form a plurality of padded training examples, including applying the padding modification to each training example prior to providing the modified training examples as inputs to the neural network;
modifying, outside of and prior to input to the trained neural network, the test example according to the algorithm and in accordance with the padding parameters recorded in the stored record to form a padded test example;
Xie teaches and where the algorithm comprises a padding modification that specifies, for at least some positions of the array of values, corresponding padding values or padding rules;
Examiner’s note: While Xu teaches padding, Examiner respectfully notes that the padding of Xu is not always applied and typically applied if deemed required (Xu, Section III E., “Typically, the original image is surrounded by zero-padding data if the padding is required in the CNN model.”) In other words, Xu is not relied upon to teach padding. Thus, as Xie is relied upon to provide a random padding layer, the padding of Xu is not required.
(Xie, Section 3.2.1, “The second randomization layer is the random padding layer [where the algorithm comprises a padding modification], which pads zeros around the resized image in a random manner. Specifically, by padding the resized image Xn into a new image Xn with the size W × H ×3, we can choose to pad w zero pixels on the left, W − W−w zero pixels on the right, h zero pixels on the top and H−H−h zero pixels on the bottom. This results in a total number of (W −W+1)×(H −H+1) different possible padding patterns.”
PNG
media_image2.png
388
823
media_image2.png
Greyscale
)
Xie teaches recording, in a stored record accessible to the computer processor, padding parameters of the padding modification, the padding parameters including data identifying the positions in the array of values that are padded and the corresponding padding values or padding rules;
Examiner’s note: Examiner interprets recording the padding parameters in BRI as storing the padded image.
(Xie, Figure 2., “The resulting padded image Xn is used for classification.”; wherein the resulting padded image must be stored and accessible in order to be used)
Xie teaches modifying each training example of the plurality of training examples according to the algorithm to form a plurality of padded training examples, including applying the padding modification to each training example prior to providing the modified training examples as inputs to the neural network;
(Xie, Section 3.2, “The goal of defense is to build a network that is robust to adversarial examples, i.e., it can classify adversarial images correctly with little performance loss on non-adversarial (clean) images. Towards this goal, we propose a randomization-based method, as shown in Figure 2, which adds a random resizing layer and a random padding layer to the beginning of the classification networks [including applying the padding modification to each training example prior to providing the modified training examples as inputs to the neural network; ie a random padding layer at the beginning of the classification network (neural network of Aprilpyone)]. There is no re-training or fine-tuning needed which makes the proposed method very easy to implement.”)
Xie teaches modifying, outside of and prior to input to the trained neural network, the test example according to the algorithm and in accordance with the padding parameters recorded in the stored record to form a padded test example;
(Xie, Section 3.2, “The goal of defense is to build a network that is robust to adversarial examples, i.e., it can classify adversarial images correctly with little performance loss on non-adversarial (clean) images. Towards this goal, we propose a randomization-based method, as shown in Figure 2, which adds a random resizing layer and a random padding layer to the beginning of the classification networks [modifying, outside of and prior to input to the trained neural network, the test example according to the algorithm and in accordance with the padding parameters recorded in the stored record to form a padded test example]. There is no re-training or fine-tuning needed which makes the proposed method very easy to implement.”)
Xu is considered to be analogous to the claimed invention because they are in the same field of securing neural networks through encryption. Xie is considered to be analogous to the claimed invention because they are reasonably pertinent to the problem faced by the inventor of maintaining robustness of classification accuracy against perturbations to images and applying perturbations to images. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Xu to incorporate the teachings of Xie in order to provide a random padding layer prior to the neural network as a pre-processing step (as Xu discloses in Section III A. that “The client first needs to pre-process the training data as required… Similar pretreatment and encryption are applied to the label”; thus, one of ordinary skills in the art would reason that similar pre-processing should be applied on both the training and test example) (Xie, Abstract, “Convolutional neural networks have demonstrated high accuracy on various tasks in recent years. However, they are extremely vulnerable to adversarial examples. For example, imperceptible perturbations added to clean images can cause convolutional neural networks to fail. In this paper, we propose to utilize randomization at inference time to mitigate adversarial effects. Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner. Extensive experiments demonstrate that the proposed randomization method is very effective at defending against both single-step and iterative at tacks. Our method provides the following advantages: 1) no additional training or fine-tuning, 2) very few additional computations, 3) compatible with other adversarial defense methods. By combining the proposed randomization method with an adversarially trained model, it achieves a normalized score of 0.924 (ranked No.2 among 107 defense teams) in the NIPS 2017 adversarial examples defense challenge, which is far better than using adversarial training alone with a normalized score of 0.773 (ranked No.56).”)
In regards to claim 7 and analogous claim 14,
Xu and Xie teaches The method of claim 3,
Xie teaches where the forming the trained neural network includes using a mathematical representation of the modifying of each training example.
(Xie, Section 3.2.1, “The second randomization layer is the random padding layer, which pads zeros around the resized image in a random manner. Specifically, by padding the resized image Xn into a new image Xn with the size W × H ×3 [using a mathematical representation of the modifying of each training example; ie the image as a tensor (mathematical representation) with size W x H x 3], we can choose to pad w zero pixels on the left, W − W−w zero pixels on the right, h zero pixels on the top and H−H−h zero pixels on the bottom. This results in a total number of (W −W+1)×(H −H+1) different possible padding patterns.”)
In regards to claim 8,
Xu and Xie teaches The method of claim 3,
Xu teaches where the training the neural network is performed by two or more parties.
(Xu, figure 1 teaches training the neural network is performed by the Client and Server wherein the Client provides the first layer of the secure Feed-Forward and cost evaluation)
In regards to claim 9,
Xu and Xie teaches The method of claim 3,
Xu teaches where the forming predictions using the trained neural network is performed by two or more parties.
(Xu, figure 1 teaches training the neural network is performed by the Client and Server wherein the Client provides the first layer of the secure Feed-Forward and cost evaluation; see y hat for the predictions)
In regards to claim 29 and analogous claim 30,
Xu and Xie teaches The method of claim 3,
Xie teaches wherein the padding modifications specifies randomly generated padding values.
(Xie, Abstract, “Specifically, we use two randomization operations: random resizing, which resizes the input images to a random size, and random padding, which pads zeros around the input images in a random manner [wherein the padding modifications specifies randomly generated padding values; wherein the position of the padding is the randomly generated padding value].”)
Claim(s) 2 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Xu and Xie in view of R. Cantoro, N. I. Deligiannis, M. S. Reorda, M. Traiola and E. Valea, "Evaluating Data Encryption Effects on the Resilience of an Artificial Neural Network," 2020 IEEE International Symposium on Defect and Fault Tolerance in VLSI and Nanotechnology Systems (DFT), Frascati, Italy, 2020, pp. 1-4, doi: 10.1109/DFT50435.2020.9250869 (“Cantoro”)
In regards to claim 2 and analogous claims 12,
Xu and Xie teaches The method of claim 3,
Cantoro teaches further comprising: prior to forming the prediction, encrypting the algorithm to form an encrypted algorithm; receiving the encrypted algorithm;
decrypting the encrypted algorithm to recover the algorithm; and
(Cantoro, Section II A., “The most common techniques for the encryption of data stored into memories are based on symmetric cryptography. In this scenario, the software developer loads the encrypted data inside an NVM that is usually external to the target System-on-Chip (SoC). The encryption is performed using a secret key [prior to forming the prediction, encrypting the algorithm (ie encrypting the transformation of Xie) to form an encrypted algorithm; receiving the encrypted algorithm; wherein the encrypted algorithm is stored], which is also stored inside the SoC, in a tamper-proof internal memory. When the device is running, all data fetched from the NVM are decrypted on-the-fly by a dedicated hardware decryption module, which generates the plaintext data that is processed by the CPU [decrypting the encrypted algorithm to recover the algorithm].”)
However, Cantoro does not explicitly teach forming the prediction using the trained neural network
Xu teaches forming the prediction using the trained neural network.
(Xu, Section II A., “Similarly, the data to be used for prediction is also encrypted [forming the prediction using the trained neural network] in the prediction phase, and then the server outputs the prediction using the trained model.”)
Cantoro considered to be analogous to the claimed invention because they are reasonably pertinent to the problem faced by the inventor of protecting valuable IP from attackers. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Xu and Xie to incorporate the teachings of Cantoro in order to provide memory encryption as doing so would protect the neural network from being reverse-engineered (Cantoro, Section II A., “These security techniques aim at protecting the target device against attackers that could tamper with the external NVM, stealing data with the purpose of cloning the system. In an ANN scenario, the network weights are a valuable IP, which could be the target of attacks aiming at the replication of the machine-learning model.”)
Claim(s) 4, 6, 21-22, 26-27, and 31-32 are rejected under 35 U.S.C. 103 as being unpatentable over Xu and Xie in view of AprilPyone, MaungMaung, and Hitoshi Kiya. "Block-wise Image Transformation with Secret Key for Adversarially Robust Defense." arXiv preprint arXiv:2010.00801 (2020). (“Aprilpyone”)
In regards to claim 4,
Xu and Xie teaches The method of claim 3,
Aprilpyone teaches wherein the algorithm further comprises a plurality of perturbation functions, each perturbation function associated with a respective position in the array of values, and wherein: modifying each training example comprises, for each of the respective positions, applying the perturbation function associated with that position to a value at that position in the training example, and modifying the test example further comprises, for each of the respective positions, applying the perturbation function associated with that position to a value at that position in the test example,
(Aprilpyone, Section IV. C., “Bit Flipping: There are four steps to pixel intensity inversion as described in Algorithm 2 [a plurality of perturbation functions]:
1) Generate a random binary vector r = (r0,r1,...,rk ,...,r pb−1), rk ∈ {0, 1} by using key K. To keep the transformation consistent, r is distributed with 50% of “0”s and 50% of “1”s.
2) Convert every pixel value to be in 255 scale with 8 bits (i.e., multiply xb by 255).
3) Perform block-wise negative/positive transformation on the basis of r. Basically, every pixel value in block Bˆij is applied to
PNG
media_image3.png
42
287
media_image3.png
Greyscale
[each perturbation function associated with a respective position ie pixel value in the array of values]
where L is the number of bits used in xb(i, j, k), and L = 8 is used in this paper.
4) Convert every pixel value back to [0, 1] scale (i.e., divide x b by 255).”)
Aprilpyone teaches such that the same perturbation function is applied to corresponding positions of each training example and of the test example.
(Aprilpyone, Section IV. C., “Bit Flipping: There are four steps to pixel intensity inversion as described in Algorithm 2:
1) Generate a random binary vector r = (r0,r1,...,rk ,...,r pb−1), rk ∈ {0, 1} by using key K. To keep the transformation consistent, r is distributed with 50% of “0”s and 50% of “1”s. [such that the same perturbation function is applied to corresponding positions of each training example and of the test example; wherein key K is utilized to keep the same perturbation function ie consistent]
2) Convert every pixel value to be in 255 scale with 8 bits (i.e., multiply xb by 255).
3) Perform block-wise negative/positive transformation on the basis of r. Basically, every pixel value in block Bˆij is applied to
PNG
media_image3.png
42
287
media_image3.png
Greyscale
where L is the number of bits used in xb(i, j, k), and L = 8 is used in this paper.
4) Convert every pixel value back to [0, 1] scale (i.e., divide x b by 255).”)
Aprilpyone is considered to be analogous to the claimed invention because they are in the same field of image encryption for neural networks. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Xu and Xie to incorporate the teachings of Aprilpyone in order to provide a novel defensive transformation that effectively encrypts images while maintaining high classification accuracy (Aprilpyone, Abstract, “In this paper, we propose a novel defensive transformation that enables us to maintain a high classification accuracy under the use of both clean images and adversarial examples for adversarially robust defense. The proposed transformation is a block-wise preprocessing technique with a secret key to input images. The proposed defense obfuscates gradients in the absence of the secret key unlike previously defeated obfuscating defenses. We developed three algorithms to realize the proposed transformation: Pixel Shuffling, Bit Flipping, and FFX Encryption. Experiments were carried out on the CIFAR-10 and ImageNet datasets by using both black-box and white-box attacks with various metrics including adaptive ones. The results show that the proposed defense achieves high accuracy close to that of using clean images even under adaptive attacks for the first time. In the best-case scenario, a model trained by using images transformed by FFX Encryption (block size of 4) yielded an accuracy of 92.30% on clean images and 91.48% under PGD attack with a noise distance of 8/255, which is close to the non-robust accuracy (95.45%) for the CIFAR-10 dataset, and it yielded an accuracy of 72.18% on clean images and 71.43% under the same attack, which is also close to the standard accuracy (73.70%) for the ImageNet dataset. Overall, all three proposed algorithms are demonstrated to outperform state-of-the-art defenses including adversarial training whether or not a model is under attack.”)
In regards to claim 6 and claims 21 and 26,
Xu and Xie teaches The method of claim 3,
Xie teaches wherein the algorithm is a mathematical equivalent to two or more modifications performed sequentially, where the two or more modifications include two or more of: a) one or more paddings each including a pad of values, where the modifying each training example and the modifying the test example includes appending the pad of values to each example or previously modified example; [b) one or more perturbations each including an array of perturbation functions, where each perturbation function corresponds to a position in the array of values of the training example and to a position in the array of values of the test example, where the modifying each training example and modifying the test example applies each perturbation function to the value in the corresponding position in each example or previously modified example;]
(Xie, Section 3.2.1, “The second randomization layer is the random padding layer [one or more paddings each including a pad of values, where the modifying each training example and the modifying the test example includes appending the pad of values to each example or previously modified example… such that the same algorithm modifies each training example and the test example; wherein the random padding is applied to each example], which pads zeros around the resized image in a random manner. Specifically, by padding the resized image Xn into a new image Xn with the size W × H ×3, we can choose to pad w zero pixels on the left, W − W−w zero pixels on the right, h zero pixels on the top and H−H−h zero pixels on the bottom. This results in a total number of (W −W+1)×(H −H+1) different possible padding patterns.”
PNG
media_image2.png
388
823
media_image2.png
Greyscale
)
However, Xie does not explicitly teach and c) one or more index shuffles each including an index shuffling for each index shuffle, where the modifying each training example and the modifying the test example includes applying the index shuffling to each example or previously modified example,
Aprilpyone teaches and c) one or more index shuffles each including an index shuffling for each index shuffle, where the modifying each training example and the modifying the test example includes applying the index shuffling to each example or previously modified example, such that the same algorithm modifies each training example and the test example.
(Aprilpyone, Section IV C., “Pixel Shuffling [index shuffling… such that the same algorithm modifies each training example and the test example; wherein the pixel values of the array are shuffled per a random permutation vector (utilized to shuffle the indices) and the pixel shuffling is applied to each example]: There are two steps to pixel shuffling as described in Algorithm 1:
1) Generate a random permutation vector v = (v0, v1,...,vk ,...,vk,...,v pb−1) that consists of randomly permuted integers from 0 to pb − 1 by using key K. Let k, k ∈ {0,..., pb − 1} and vk = vk if k = k .
2) Perform block-wise shuffling on the basis of v. Basically, positions of pixel values in each block are changed on the basis of v, i.e.,
PNG
media_image4.png
28
227
media_image4.png
Greyscale
”)
Claims 22 and 27 are rejected on the same rationale under 35 U.S.C. 103 as claim 7 as they are substantially similar.
Claim 31 and 32 is rejected on the same rationale under 35 U.S.C. 103 as claim 29 as they are substantially similar.
Claim(s) 10 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Xu and Xie in view of U.S. Pub. No. US20190294956A1 Cheung et al. (“Cheung”)
In regards to claim 10 and analogous claim 15,
Xu and Xie teaches The method of claim 3,
Xu teaches further including storing, [in a ledger], a record of at least one of: an occurrence of the modifying the test example to form the padded test example, and an occurrence of the providing the trained neural network with the padded test example to form the prediction.
(Xu, Section III A., “The authority is responsible for setting up the crypto parameters such as public key mpk and master secret key msk. Then it holds the msk and distributes the public keys to the servers and clients. Besides, it also generates the function derived key for the server to decrypt the function result.
The client first needs to pre-process the training data as required, and then encrypt all the pre-processed training data using the public key, mpk [a record of at least one of: an occurrence of the modifying the test example to form the padded test example; wherein the encryption (occurrence of modifying the example) is determined by the given key provided by the authority; see cropped figure 1 below].”
PNG
media_image5.png
123
370
media_image5.png
Greyscale
)
However, Xu does not explicitly teach a ledger
Cheung teaches storing, in a ledger
(Cheung, “[0031] FIG. 2B illustrates a computing environment that includes a blockchain database 202. The blockchain database 202 may use blockchain technology, as one of skill in the art will understand, to maintain a public ledger of information [storing, in a ledger], such as data transmitted using the secure data processor 120.”)
Cheung is considered to be analogous to the claimed invention because they are in the same field of data security. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Xu and Xie to incorporate the teachings of Cheung in order to provide a different party beneficial analysis of the data without any data transfers to maintain privacy (Cheung, “[0016] In various embodiments of the present disclosure, a first party that owns proprietary data permits a second party to realize a benefit from the data without actually having to transfer the data; the first party shares only an encrypted version of the data. In some embodiments, a secure data processor is disposed between the first and second parties on a computer network; two or more data sources send encrypted versions of their data to the secure data processor, which adds them together and sends the result to the second party. The secure data processor cannot decrypt the data because it lacks the necessary keys, and the second party can decrypt only the sum of the data, not the original data.”)
Claim(s) 17 and 25 are rejected under 35 U.S.C. 103 as being unpatentable over Xu and Xie in view of Aprilpyone in further view of Cantoro.
Claim 17 is rejected on the same rationale under 35 U.S.C. 103 as claim 2 as they are substantially similar.
Claim 25 is rejected on the same rationale under 35 U.S.C. 103 as claim 2 as they are substantially similar.
Aprilpyone is considered to be analogous to the claimed invention because they are in the same field of image encryption for neural networks. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Xu and Xie to incorporate the teachings of Aprilpyone in order to provide a novel defensive transformation that effectively encrypts images while maintaining high classification accuracy (Aprilpyone, Abstract, “In this paper, we propose a novel defensive transformation that enables us to maintain a high classification accuracy under the use of both clean images and adversarial examples for adversarially robust defense. The proposed transformation is a block-wise preprocessing technique with a secret key to input images. The proposed defense obfuscates gradients in the absence of the secret key unlike previously defeated obfuscating defenses. We developed three algorithms to realize the proposed transformation: Pixel Shuffling, Bit Flipping, and FFX Encryption. Experiments were carried out on the CIFAR-10 and ImageNet datasets by using both black-box and white-box attacks with various metrics including adaptive ones. The results show that the proposed defense achieves high accuracy close to that of using clean images even under adaptive attacks for the first time. In the best-case scenario, a model trained by using images transformed by FFX Encryption (block size of 4) yielded an accuracy of 92.30% on clean images and 91.48% under PGD attack with a noise distance of 8/255, which is close to the non-robust accuracy (95.45%) for the CIFAR-10 dataset, and it yielded an accuracy of 72.18% on clean images and 71.43% under the same attack, which is also close to the standard accuracy (73.70%) for the ImageNet dataset. Overall, all three proposed algorithms are demonstrated to outperform state-of-the-art defenses including adversarial training whether or not a model is under attack.”)
Claim(s) 23 and 28 are rejected under 35 U.S.C. 103 as being unpatentable over Xu and Xie in view of Aprilpyone in further view of Cheung.
Claim 23 is rejected on the same rationale under 35 U.S.C. 103 as claim 10 as they are substantially similar.
Claim 28 is rejected on the same rationale under 35 U.S.C. 103 as claim 10 as they are substantially similar.
Aprilpyone is considered to be analogous to the claimed invention because they are in the same field of image encryption for neural networks. Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Xu and Xie to incorporate the teachings of Aprilpyone in order to provide a novel defensive transformation that effectively encrypts images while maintaining high classification accuracy (Aprilpyone, Abstract, “In this paper, we propose a novel defensive transformation that enables us to maintain a high classification accuracy under the use of both clean images and adversarial examples for adversarially robust defense. The proposed transformation is a block-wise preprocessing technique with a secret key to input images. The proposed defense obfuscates gradients in the absence of the secret key unlike previously defeated obfuscating defenses. We developed three algorithms to realize the proposed transformation: Pixel Shuffling, Bit Flipping, and FFX Encryption. Experiments were carried out on the CIFAR-10 and ImageNet datasets by using both black-box and white-box attacks with various metrics including adaptive ones. The results show that the proposed defense achieves high accuracy close to that of using clean images even under adaptive attacks for the first time. In the best-case scenario, a model trained by using images transformed by FFX Encryption (block size of 4) yielded an accuracy of 92.30% on clean images and 91.48% under PGD attack with a noise distance of 8/255, which is close to the non-robust accuracy (95.45%) for the CIFAR-10 dataset, and it yielded an accuracy of 72.18% on clean images and 71.43% under the same attack, which is also close to the standard accuracy (73.70%) for the ImageNet dataset. Overall, all three proposed algorithms are demonstrated to outperform state-of-the-art defenses including adversarial training whether or not a model is under attack.”)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US Pat No. US11651475B2: Lee et al. teaches Image restoration method and device
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JASMINE THAI whose telephone number is (703)756-5904. The examiner can normally be reached M-F 8-4.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Michael Huntley can be reached at (303) 297-4307. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.T.T./Examiner, Art Unit 2129
/MICHAEL J HUNTLEY/Supervisory Patent Examiner, Art Unit 2129