DETAILED ACTION
Claims 1-16 and 21-24 are presented for examination.
This office action is in response to submission of application on 29-JANUARY-2026.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 03-JUNE-2022 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Amendment
The amendment filed 29-JANUARY-2026 in response to the non-final office action mailed 29-OCTOBER-2025 has been entered. Claims 1-16 and 21-24 remain pending in the application.
With regards to the non-final office action’s rejection under 103, the amendment to the claims have overcome the original rejection. However, upon a new search for the amended limitations, a new 103 rejection over Sternby in view of Zhang, further in view of Yu has been written. In light of the new art, the arguments for the amendment are moot.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-16 and 21-24 are rejected under 35 U.S.C. 103 as being unpatentable over Sternby et al. (Pub. No. WO 2021197600 A1, filed April 1st 2020, hereinafter Sternby) in view of Zhang et al. (Pub. No. US 20210224605 A1, filed January 17th 2020, hereinafter Zhang) further in view of Yu et al. (Pub No. CN 112613001 A, published April 6th 2021, hereinafter Yu).
Regarding claim 1:
Claim 1 recites:
A system, said system comprising: a memory; and a processor in communication with said memory, said processor being configured to perform operations, said operations comprising: procuring a model; obtaining hyperparameters for watermarking said model; embedding a watermark in said model using said hyperparameters to achieve a watermarked model, wherein said hyperparameters control target metrics; and delivering said watermarked model and a watermark verification mechanism to a user, wherein said watermark is verifiable using only application programming interface access to said model.
Sternby procuring a model; obtaining hyperparameters for watermarking said model; embedding a watermark in said model using said hyperparameters to achieve a watermarked model, wherein said hyperparameters control target metrics
Sternby teaches the procuring of a model as it teaches the training of a neural network (Page 3, lines 8-9), which is a form of procurement. Furthermore, Sternby teaches obtaining a hyperparameter in the form of a classification confidence threshold by deciding upon its value when creating a watermark (Page 22, lines 12-14).
Sternby teaches a neural network with an embedded watermark (Page 3, lines 24-26) wherein the watermarking is confirmed through a classification confidence above a certain threshold (Page 17, lines 27-28). A classification confidence threshold would be a hyperparameter. This hyperparameter is used to confirm key samples for the watermark (Page 22, lines 1-10) and therefore increases robustness (Page 29, lines 5-15) as key samples are able to be identified correctly with the proper confidence threshold. Robustness would be a target metric that is controlled by the hyperparameter confidence threshold.
Sternby discloses a watermark verification mechanism:
Sternby teaches an classification confidence threshold (Page 17, lines 27-28) that acts as a watermark verification mechanism as it verifies that the watermark is present within the model.
Zhang discloses delivering said watermarked model and a watermark verification mechanism to a user:
Zhang in the same field of endeavor of machine learning, particularly neural networks, teaches a user using a machine learning model through an input device (Paragraph 37), which would prove the delivery of a model to a user. Furthermore, Zhang teaches that one or more model components may be located at a client device, which further supports this rationale (Paragraph 36). These model components may comprise a metric component (Paragraph 6) which may be substituted with the watermark verification mechanism of Sterny as it is a form of metric.
Furthermore, a watermarked model and a watermark verification mechanism has been previously taught by Sternby, above.
Sternby, Zhang, and the present application are all analogous art because they are all in the same field of endeavor of machine learning.
Yu in the same field of endeavor of neural network watermarking discloses wherein said watermark is verifiable using only application programming interface access to said model:
Yu recites: “The black box watermark method changes the decision boundary of the model by a certain method, and embeds the watermark into the model only having the access authority of the application programming interface (API).”
Yu discloses that the black box watermark is only accessible via the API, which would include its verification.
Yu and the present application are analogous art because they are all in the same field of endeavor of neural network watermarking.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang and the teachings of Yu. This would have provided the advantage of enabling joint optimization of multiple metrics with the input of a policy maker (Zhang, Paragraph 31) as well as “the safety protection of the model” (Yu, Background).
Furthermore, Zhang combines prior art elements according to known method to yield predictable results. It can be seen above that Zhang discloses the only limitation of the above claim which Sternby lacks. Furthermore, delivery of a model and mechanism to a user is taught by Zhang, wherein the delivery of the model and mechanism as described above may be the delivery of the model and mechanism of Sternby, and is a form of predictable transmit and output.
Yu uses a known technique to improve similar systems. Using Sternby as the base system and comparing it against the claimed invention, at a minimum the claimed invention teaches that the watermark is verifiable using only application programming interface access to said model. Furthermore, Yu teaches a system that uses this API improvement. It would be obvious the limiting access to the watermarked model would result in an improvement to security, and would have been predictable to one of ordinary skill in the art.
Regarding claim 2, which depends upon claim 1:
Claim 2 recites:
The system of claim 1, wherein: said model is a deep generative model.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 2 depends. However, Sternby does not teach the limitation of claim 2:
Zhang teaches the use of generative adversarial networks (Paragraph 33), which are a type of deep generative model.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang. This would have provided the advantage of enabling joint optimization of multiple metrics with the input of a policy maker (Paragraph 31).
Regarding claim 3, which depends upon claim 1:
Claim 3 recites:
The system of claim 1, wherein: said target metrics include targets for model utility, watermark fidelity, and watermark robustness.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 3 depends. Furthermore, Sternby discloses watermark fidelity and watermark robustness:
Sternby teaches that watermarking is confirmed through a classification confidence above a certain threshold (Page 17, lines 27-28). This threshold would be the target metric for watermark fidelity as it is the required threshold in order for the model to be considered watermarked. Furthermore, Sternby also teaches watermark robustness as the amount of key samples that make it past the threshold help to determine the robustness of the model (Page 29, lines 5-15).
Zhang discloses target metrics include targets for model utility:
Zhang teaches that a model utility threshold can be defined by one or more policy makers (Paragraph 43), as the constraint thresholds would include the model utility constraints (Paragraph 31).
It would be obvious to use the metric of Sternby in the manner that Zhang includes a target for its metrics through substitution of the metrics of Sternby in the system of Zhang, including for watermark fidelity and watermark robustness.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang. This would have provided the advantage of enabling joint optimization of multiple metrics with the input of a policy maker (Paragraph 31).
Regarding claim 4, which depends upon claim 1:
Claim 4 recites:
The system of claim 1, said embedding said watermark further comprising: training said model using an architecture specification, a training routine, and training data.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 4 depends. Furthermore, regarding the limitation of claim 4:
Sternby teaches determining a network architecture and trainable parameters for the neural network (Page 18, lines 19-20). The trainable parameters would be a training routine as it determines what the model is trained using. Furthermore, the model uses training data (Page 11, lines 29-30).
Regarding claim 5, which depends upon claim 1:
Claim 5 recites:
The system of claim 1, said operations further comprising: computing a set of metrics to assess said watermarked model for model utility and watermark fidelity.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 5 depends. Furthermore, regarding the limitation of claim 5:
Sternby teaches that determining a confidence value associated with a specific key sample can be compared against the confidence threshold, or the watermark fidelity threshold to assess the fidelity (Page 22, lines 3-6), as if the fidelity is insufficient the key sample with not pass the threshold.
However, Sternby does not teach a set of metrics to assess said watermarked model for model utility:
Zhang teaches an optimization of model utility (Paragraph 86), which would be the computation of metrics to assess a model for model utility.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang. This would have provided the advantage of enabling joint optimization of multiple metrics with the input of a policy maker (Paragraph 31).
Regarding claim 6, which depends upon claim 1:
Claim 6 recites:
The system of claim 1, said operations further comprising: selecting a mechanism for embedding said watermark based on said model and said hyperparameters.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 6 depends. Furthermore, regarding the limitation of claim 6:
Sternby teaches different methods of selecting watermark key samples, such as training samples in rarely explored regions or new samples unrelated to a particular classification task (Page 16, lines 21-25). These would be examples of mechanisms for embedding a watermark based on the model and hyperparameters as the model would be determined by the classification task and the hyperparameters would influence what were rarely explored regions.
Regarding claim 7, which depends upon claim 1:
Claim 7 recites:
The system of claim 1, wherein: said watermark includes a trigger-target pair for said model.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 7 depends. Furthermore, regarding the limitation of claim 7:
Sternby teaches that prior art uses a trigger-target pair for watermarked models, as it describes a model trained to give an unexpected result for particular samples used as key samples (Page 10, lines 5-10).
Claims 8-11 recite a method that parallels the system of claims 1-4 respectively. Therefore, the analysis discussed above with respect to claims 1-4 also applies to claims 8-11 respectively. Accordingly, claims 8-11 are rejected based on substantially the same rationale as set forth above with respect to claims 1-4 respectively.
Regarding claim 12, which depends upon claim 8:
Claim 12 recites:
The method of claim 8, said embedding said watermark further comprising: modifying said model to embed said watermark, wherein said model is pre-trained.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 8 upon which claim 12 depends. Furthermore, regarding the limitation of claim 12:
Sternby teaches splitting training data into two sets, one which trains the model as a pre-training stage, and the second of modifying the model by embedding the watermark within the model (Pages 12-13, lines 23-30, lines 1-6).
Claims 13-15 recite a method that parallels the system of claims 5-7 respectively. Therefore, the analysis discussed above with respect to claims 5-7 also applies to claims 13-15 respectively. Accordingly, claims 13-15 are rejected based on substantially the same rationale as set forth above with respect to claims 5-7 respectively.
Claim 16 recites a computer program product that parallels the system of claim 1. Therefore, the analysis discussed above with respect to claim 1 also applies to claim 16. Accordingly, claim 16 is rejected based on substantially the same rationale as set forth above with respect to claim 1.
Regarding claim 21, which depends upon claim 1:
Claim 21 recites:
The system of claim 1, wherein: said hyperparameters are determined using auto-AI techniques
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 21 depends. However, Sternby does not teach the limitation of claim 21:
Zhang teaches the use of machine learning, which it defines as an application of AI technologies that can automatically learn and improve from experience (Paragraph 32). As this would include the hyperparameters as part of machine learning, hyperparameters are determined using auto-AI techniques.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang. This would have provided the advantage of enabling joint optimization of multiple metrics with the input of a policy maker (Paragraph 31).
Regarding claim 22, which depends upon claim 1:
Claim 22 recites:
The system of claim 1, further comprising: determining said hyperparameters using auto-AI techniques
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 22 depends. However, Sternby does not teach the limitation of claim 22:
Zhang teaches the use of machine learning, which it defines as an application of AI technologies that can automatically learn and improve from experience (Paragraph 32). As this would include the hyperparameters as part of machine learning, this would be determining said hyperparameters using auto-AI techniques.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang. This would have provided the advantage of enabling joint optimization of multiple metrics with the input of a policy maker (Paragraph 31).
Regarding claim 23, which depends upon claim 1:
Claim 23 recites:
The system of claim 1, further comprising: determining said hyperparameters based on one selected from the group consisting of a computation budget, an architecture parameter, and a number of architecture parameter
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 23 depends. However, Sternby does not teach the limitation of claim 23:
Zhang teaches a cloud computing system wherein the system has knowledge of cloud computing environment intrastructure, which would include an architecture parameter as an architecture parameter may describe the available architecture for the user (Paragraph 105). Furthermore, the system may provision computing capabilities, which would be a computation budget (Paragraph 90). In combination with Sternby’s hyperparameters, the cloud computing system of Zhang’s architecture parameters and computation budget could be used to determine the hyperparameters of Sternby in an automatic fashion, as the cloud computing system can manage individual application capabilities (Paragraph 96) which would include hyperparameters.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang. This would have provided the advantage of automatically adjusting resources without the need for human interactions (Zhang, Paragraph 90).
Regarding claim 24, which depends upon claim 1:
Claim 24 recites:
The system of claim 1, wherein: said hyperparameters are determined based on a computation budget and an architecture parameter.
Sternby in view of Zhang, further in view of Yu disclose the system of claim 1 upon which claim 24 depends. However, Sternby does not teach the limitation of claim 24:
Zhang teaches a cloud computing system wherein the system has knowledge of cloud computing environment intrastructure, which would include an architecture parameter as an architecture parameter may describe the available architecture for the user (Paragraph 105). Furthermore, the system may provision computing capabilities, which would be a computation budget (Paragraph 90). In combination with Sternby’s hyperparameters, the cloud computing system of Zhang’s architecture parameters and computation budget could be used to determine the hyperparameters of Sternby in an automatic fashion, as the cloud computing system can manage individual application capabilities (Paragraph 96) which would include hyperparameters.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to implement a system that utilized the teachings of Sternby and the teachings of Zhang. This would have provided the advantage of automatically adjusting resources without the need for human interactions (Zhang, Paragraph 90).
Response to Arguments
Applicant’s arguments filed 29-JANUARY-2026 have been fully considered, but the examiner believes that not all are fully persuasive.
Regarding the applicant’s remarks on the non-final office action’s 103 rejection of the claims, the applicant argues that Sternby in view of Zhang does not teach the amended limitations of these claims. As such, the applicant argues that all claims dependent on the above would additionally not be obvious under 103. The examiner has introduced new art Yu to address some of the amended limitations. Furthermore, the examiner believes that Sternby and Zhang do teach the previously presented limitations, as well as the amended limitations of claims 3 and 10:
Regarding the applicant’s argument that “the prior art fails to teach of suggest this element [said watermark is verifiable using only application programming interface access to said model] of the claims”, the examiner believes new art Yu discloses this aspect of claims 1, 8, and 16:
Yu recites: “The black box watermark method changes the decision boundary of the model by a certain method, and embeds the watermark into the model only having the access authority of the application programming interface (API).”
Yu discloses that the black box watermark is only accessible via the API, which would include its verification.
Yu and the present application are analogous art because they are all in the same field of endeavor of neural network watermarking.
Regarding the applicant’s arguments of improper combination and failure to present a prima facie case of obviousness:
The applicant argues that “Zhang is non-analogous art, and a person having ordinary skill in the art no motivation to combine Zhang with Sternby”:
In response to applicant's argument that Zhang is nonanalogous art, it has been held that a prior art reference must either be in the field of the inventor’s endeavor or, if not, then be reasonably pertinent to the particular problem with which the inventor was concerned, in order to be relied upon as a basis for rejection of the claimed invention. See In re Oetiker, 977 F.2d 1443, 24 USPQ2d 1443 (Fed. Cir. 1992). In this case, the present application’s specification states “the present disclosure related to artificial content generation, and more specifically to generative models and neural networks”. Generative models and neural networks therefore may be taken as the field of endeavor. Sternby is regarded as analogous art to the present application as it explicitly “relates generally to the field of neural networks” (Page 1, lines 4-5). Zhang is regarded as analogous art to the present application as it relates to “artificial intelligence models” (Paragraph 1), wherein it can be seen that these models maybe neural networks (Paragraph 33) therefore relating it the field of endeavor of neural networks.
The applicant argues that “there is no motivation or suggestion to combine the references”.
In response to applicant’s argument that there is no teaching, suggestion, or motivation to combine the references, the examiner recognizes that obviousness may be established by combining or modifying the teachings of the prior art to produce the claimed invention where there is some teaching, suggestion, or motivation to do so found either in the references themselves or in the knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988), In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992), and KSR International Co. v. Teleflex, Inc., 550 U.S. 398, 82 USPQ2d 1385 (2007). In this case, the introduction of Zhang combined prior art elements according known method to yield predictable results. Specifically in the case of independent claims 1, 8, and 16, Zhang combines prior art elements according to known method to yield predictable results. (MPEP 2143.I.A) It can be seen above that Zhang discloses the only limitation of the above claim which Sternby lacks. Furthermore, delivery of a model and mechanism to a user is taught by Zhang, wherein the delivery of the model and mechanism as described above may be the delivery of the model and mechanism of Sternby, and is a form of predictable transmit and output.
The applicant argues that “the prior art fails to teach or suggest each and every element of the claims”. This argument has been addressed in the sections directed to specific arguments regarding alleged deficiencies of the prior art.
The applicant argues that “neither Sternby nor Zhang, whether taken individually or in combination, teach or suggest the following features of claims 1, 8, and 16”:
“Obtaining hyperparameters for watermarking said model”:
As previously addressed in the advisory action, Sternby teaches a confidence threshold, which is considered a hyperparameter as it is a set parameter that governs the training process of a machine learning model (page 17, lines 27-28). Furthermore, that it is used by Sternby indicates it being obtained, but this is explicitly taught (page 21, line 12) wherein the confidence threshold is decided, which is manner of obtaining said hyperparameter.
“Embedding a water in said model using said hyperparameters to achieve a watermarked model, wherein hyperparameter control target metrics” as “the assertion that classification confidence controls the target metric of ‘robustness of the learning’ does not result thereform”:
Regarding the assertion that the classification confidence controls the target metric of robustness, as previously argued, the examiner believes that Sternby teaches a neural network with an embedded watermark (Page 3, lines 24-26) wherein the watermarking is confirmed through a classification confidence above a certain threshold (Page 17, lines 27-28). A classification confidence threshold would be a hyperparameter. This hyperparameter is used to confirm key samples for the watermark (Page 22, lines 1-10) and therefore increases robustness (Page 29, lines 5-15) as key samples are able to be identified correctly with the proper confidence threshold. Robustness would be a target metric that is controlled by the hyperparameter confidence threshold.
The applicant argues that regarding claims 3 and 10, Sternby’s teaching “does not disclose, teach, or suggest ‘said target metrics include targets for… watermark robustness’ as required” by the claim:
As addressed in the advisory action, the examiner believes that a target for watermark robustness would at a minimum be disclosed through the consideration of Sternby in view of Zhang, further in view of Yu, wherein Zhang disclosed a target for a target metric (Paragraph 31, 43) and Sternby disclosed a measure of watermark robustness (Page 29, lines 5-15). It would be obvious to use the metric of Sternby in the manner that Zhang includes a target for its metrics for reasons of the improvement previously provided by Zhang, which is the joint optimization of multiple metrics (Paragraph 31). The combination of these reference is addressed above in the arguments.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ALEXANDRIA JOSEPHINE MILLER whose telephone number is (703)756-5684. The examiner can normally be reached Monday-Thursday: 7:30 - 5:00 pm, every other Friday 7:30 - 4:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Mariela Reyes can be reached at (571) 270-1006. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/A.J.M./
Examiner, Art Unit 2142
/Mariela Reyes/Supervisory Patent Examiner, Art Unit 2142
Prosecution Insights