DETAILED ACTION
This Action is responsive to Claims filed 02/04/2026.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of the Claims
Claims 1-2, 6-8, 11-13, 16-18, and 20 have been amended. Claims 4-5 and 14-15 have been cancelled. Claims 1-3, 6-13, and 16-20 are currently pending.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 04/01/2026 was filed after the mailing date of the Non-Final Office Action on 11/04/2025. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Amendment
The amendments to the Specification have overcome the Objections to the Minor Informalities.
The amendments to Claims 1, 7-8, 13, and 17-18 have overcome the Objections to the Minor Informalities.
Response to Arguments
Applicant's arguments, see Pages 8-11, filed 02/04/2026, regarding the 35 U.S.C. 101 Rejection of Claims 1-20 have been fully considered but they are not persuasive.
The Applicant argues on Page 9 that the independent claims represent eligible subject matter because the additional elements of the claim integrate the alleged abstract idea mental process steps into a practical application. The Examiner respectfully disagrees with the Applicant. The Applicant makes reference to “multiple, specific, detailed, unique steps” and Paragraphs [75] and [96] of the Specification with regards to the alleged integration into a practical Application. The Examiner respectfully disagrees with the Applicant’s assertions.
The system, user computing device, security platform, processor, and memory are recited highly generally and amount to generic computer components; these elements are not specific, detailed, or unique. The BRI of the “receive…” step is mere data gathering; this element is not specific, detailed, or unique. The “identify…” and “set…” steps are not recited in such a way as to preclude a human mind with the aid of pen and paper from performing them. The ”set…” step may also be interpreted as generic instructions to apply the “identify…” step; this element is not specific, detailed, or unique. The BRI of the “provide…” and “generate…” steps are mere data input and output to a generically recited neural network; these elements are not specific, detailed, or unique. The “determine…” and “modify…” steps are not recited in such a way to preclude a human mind with the aid of pen and paper from performing them. The BRI of the next “provide…” and “generate…” steps are mere data input and output to a generically recited neural network; these elements are not specific, detailed, or unique. The “determine…” and “reset…” steps are not recited in such a way to preclude a human mind with the aid of pen and paper from performing them. The “iteratively update…” step and subsequent conditional setting steps are not recited in such a way to preclude a human mind with the aid of pen and paper from performing them. The “retrain…” and subsequent “send…” step amount to instructions to apply the alleged abstract idea mental process “iteratively update…” step and are recited highly generally; these elements are not specific, detailed, or unique. When taken as a whole, ordered combination, the steps generically describe modifying model parameters iteratively before generically retraining and sending an updated model to a generic user device, the steps of which are broadly indicated by at least the prior art rejection(s); this is not specific, detailed, or unique. The two blurbs cited by the Applicant from paragraphs [75] and [96] recite no specific structure or implementation reflected in the claims indicating integration into a practical application. In fact, the blurbs specifically cited are arguably achieved by the human mind with the aid of pen and paper (generically modifying generic model parameters). The instant claims are distinct from Example 48, Claims 2 and 3 because the instant claims do not recite sufficient structure or implementation, as the Example’s claims recite. Given the highly general recitation of the additional elements of the claims, the Examiner contends the bulk of the proposed improvement to the functioning of a computer or other technological field is contained within the abstract idea mental process step(s), per MPEP 2106.05(a), the improvement cannot come from the abstract idea mental process(es). See the updated 35 U.S.C. 101 Rejection below.
Applicant’s arguments with respect to the prior art Rejection(s) of claim(s) 1-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
The Examiner respectfully disagrees with the Applicant the cited references do not teach some aspects of the submitted amendments. Karam teaches, in at least Paragraph [0009], Page 2: “Generating the update file for the received CNN model can include retraining the received CNN model with the updated weights;” (pertinent to the retraining amendments) and “Modifying the original weights of the parameters associated with the received CNN model can include shifting the original weights by a predetermined threshold value. The predetermined threshold value can be 1%.” (pertinent to the perturbation value amendments). See the updated 103 Rejection(s) below.
Claim Rejections - 35 USC § 101
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claims 1-3, 6-13, and 16-20 rejected under 35 U.S.C. 101 because Claims 1-20 rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more; and because the claims as a whole, considering all claim elements both individually and in combination, do not amount to significantly more than the abstract idea, see Alice Corporation Pty. Ltd. v. CLS Bank International, et al, 573 U.S. (2014). In determining whether the claims are subject matter eligible, the Examiner applies the 2019 USPTO Patent Eligibility Guidelines. (2019 Revised Patent Subject Matter Eligibility Guidance, 84 Fed. Reg. 50, Jan. 7, 2019.)
Step 1:
Claims 1-3 and 6-10 recite a system comprising a user computing device and security platform, which falls under the statutory category of a machine. Claims 11-13 and 16-19 recite a method, which falls under the statutory category of a process. Claim 20 recites a non-transitory computer readable medium storing computer executable instructions, which falls under the statutory category of a manufacture.
Step 2A – Prong 1:
Claim 1 recites an abstract idea, law of nature, or natural phenomenon. The limitations of “identify a first subset of weights having a value below a threshold;”, “set the identified subset of weights to zero;”, “determine a first error value based on the first output, an expected output, the input, and a loss function;”, “for one or more non-zero weights, iteratively: modify a non-zero weight by a perturbation value to generate a second weight, wherein the perturbation value is a fixed fraction of the non-zero weight,”, “determine a second error based on the second output, the expected output, the input, and the loss function,”, “and reset the non-zero weight to an original value of the non-zero weight;”, “iteratively update the one or more non-zero weights to generate a second subset of weights,”, “when a difference between the first error and a second error for the non-zero weight does not exceed a threshold, setting the non-zero weight to zero,”, and “or when the difference between the first error and the second error exceeds the threshold, retaining an original value of the non-zero weight;” under the broadest reasonable interpretation, covers a mental process including an observation, evaluation, judgment or opinion that could be performed in the human mind or with the aid of pencil and paper. This limitation therefore falls within the mental process group.
The aforementioned steps, but for the recitation of generic computer components performing generic computing functions, amount to a series of abstract idea mental process steps. The setting, modifying, re-setting, and updating of weights based on a threshold is practically performed within the human mind or with the aid of pen and paper. The determination of error value(s) based on loss function(s) is practically performed within the human mind or with the aid of pen and paper.
Step 2A – Prong 2:
The additional elements of claim 1 do not integrate the abstract idea into a judicial exception. Claim 1 recites the additional elements “a system”, “a user computing device”, “a security platform”, “a processor”, and “memory storing computer-readable instructions” are recognized as generic computer components recited at a high level of generality. Although it has and executes instructions to perform the abstract idea itself, this also does not serve to integrate the abstract idea into a practical application as it merely amounts to instructions to "apply it." (See MPEP 2106.04(d)(2) indicating mere instructions to apply an abstract idea does not amount to integrating the abstract idea into a practical application).
The additional elements recited in the limitations “a neural network”, “output nodes”, “error value(s)”, and “a loss function” are recognized as non-generic computer components, however, they are found to generally link the abstract idea to a particular technological environment or field of use (See MPEP 2106.05(h)).
The additional elements recited in the limitations of “receive, from the user computing device, weights of a neural network;”, “provide an input to a plurality of input nodes of the neural network;”, “generate, from one or more output nodes, a first output based on the input;”, “provide the input to the plurality of input nodes of the neural network,”, “generate, from the one or more output nodes, a second output based on the input,” and “after retraining the neural network, send, to the user computing device, the first subset of weights and the second subset of weights.” is recognized as a mere insignificant pre- or post-extra-solution activity data gathering or transmittal step recited at a high level of generality without significantly more (See MPEP 2106.05(g)).
The additional elements recited in the limitation “retrain the neural network;” are recited highly generally and found to be merely instructions to apply the aforementioned data manipulation abstract idea mental process steps (See MPEP 210605(f)).
Step 2B:
The only limitation on the performance of the described method is a limitation reciting “a system”, “a user computing device”, “a security platform”, “a processor”, and “memory storing computer-readable instructions” These elements are insufficient to transform a judicial exception to a patentable invention because the recited elements are considered insignificant extra-solution activity (generic computer system, processing resources, links the judicial exception to a particular, respective, technological environment). The claim thus recites computing components only at a high-level of generality such that it amounts to no more than mere instructions to apply the exception using generic computer components; mere instructions to apply an exception using a generic computer component cannot provide an inventive concept (see MPEP 2106.05(f)).
The additional elements recited in the limitations “a neural network”, “output nodes”, “error value(s)”, and “a loss function” are recognized as non-generic computer components, however, they are found to generally link the abstract idea to a particular technological environment or field of use (See MPEP 2106.05(h)).
The additional elements recited in the limitation of “receive, from the user computing device, weights of a neural network;”, “provide an input to a plurality of input nodes of the neural network;”, “generate, from one or more output nodes, a first output based on the input;”, “provide the input to the plurality of input nodes of the neural network,”, “generate, from the one or more output nodes, a second output based on the input,” and “after retraining the neural network, send, to the user computing device, the first subset of weights and the second subset of weights.” is recognized well-understood, routine, or conventional activity (See WURC examples 2106.05(d)(II)(i) first list).
The additional elements recited in the limitation “retrain the neural network;” are recited highly generally and found to be merely instructions to apply the aforementioned data manipulation abstract idea mental process steps (See MPEP 210605(f)).
Taken alone or in ordered combination, these additional elements do not amount to
significantly more than the above-identified abstract idea. There is no indication that the
combination of elements improves the functioning of a computer or improves any other
technology. Their collective functions merely provide conventional computer implementation.
For the reasons above, claim 1 is rejected as being directed to non-patentable subject matter under §101. This rejection applies equally to independent claims 11 and 20.
Claim 11 recites similar limitations to claim 1, with the exception of “A method comprising:” (generic computer components). Therefore, both claims are similarly rejected.
Claim 20 recites similar limitations to claim 1, with the exception of “A non-transitory computer readable medium storing computer executable instructions that, when executed by a processor, causes a security platform to:” (generic computer components). Therefore, both claims are similarly rejected.
Dependent Claims:
Claim 2 (claim 12) recites instructions to apply the abstract idea mental process steps (“retraining the neural network comprises not modifying weights that were set to zero.”) (See MPEP 2106.05(f)).
Claim 3 (claim 13) recites pre- or post-extra-solution activity (“wherein a database storing, for the retraining the neural network, a plurality of inputs and corresponding expected outputs”) (See MPEP 2106.05(g)).
Claim 6 (claim 16) recites refinements to the weights of the independent claims.
Claim 7 (claim 17) recites refinements to the loss function(s) of the independent claims.
Claim 8 (claim 18) recites refinements to the threshold of the independent claims.
Claim 9 (claim 19) recites an abstract idea mental process step (“the threshold is selected such that non-zero weights for which differences are within a bottom quartile is set to zero.”).
Claim 10 recites refinements to the threshold of the independent claims.
Claim Rejections - 35 USC § 103
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 1-6, 8-16, and 18-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Karam et al. (US 20220303286), hereinafter Karam; Yu et al. (US 2013/0138589 A1), hereinafter Yu; and Chan et al. (US 20230289604 A1), hereinafter Chan.
In regards to claim 1: The present invention claims: “A system comprising: a user computing device; and a security platform comprising: a processor; and memory storing computer-readable instructions that, when executed by the processor, cause the security platform to:” Karam teaches “The processor 1352 can provide, for example, for coordination of the other components of the mobile computing device 1350, such as control of user interfaces, applications run by the mobile computing device 1350, and wireless communication by the mobile computing device 1350." ([0091], mapping to a user computing device); “The attacker system 104 can include processor(s) 1402, a model data modifier 1404, a Trojan injection module 1406, and a communication interface 1408. The processor(s) 1402 can be configured to perform or execute any one or more of the operations of the attacker system 104. The model data modifier 1404 can receive or extract a training dataset or other data that is used by a network model of the target system 106A. The modifier 1404 can then maliciously change or update that data. The Trojan injection module 1406 can then inject the maliciously updated data back into the target system 106A. The module 1406 can also attempt to inject the maliciously updated data into other similar or same systems as the target system 106A in an ecosystem or environment, as described throughout this disclosure.” ([0104], mapping to a security platform comprising a processor); and “The computing device 1300 includes a processor 1302, a memory 1304, a storage device 1306, a high-speed interface 1308 connecting to the memory 1304 and multiple highspeed expansion ports 1310, and a low-speed interface 1312 connecting to a lowspeed expansion port 1314 and the storage device 1306” ([0085], mapping to memory and instructions).
“receive, from the user computing device, weights of a neural network;” Karam teaches “The attack identification computing system is configured to: receive, from the target computing system, the CNN model and parameters associated with the CNN model;” ([0008])
“provide an input to a plurality of input nodes of the neural network;” Karam teaches “Generating the update file for the received CNN model can include retraining the received CNN model with the updated weights;” ([0009]).
“generate, from one or more output nodes, a first output based on the input;” Karam teaches “generate, based on the received CNN model and the parameters, an ecosystem of CNN models, wherein generating the ecosystem comprises modifying original weights of the parameters associated with the CNN model” ([0008]).
“determine a first error value based on the first output, an expected output, the input, and a loss function;” Karam teaches “FIGS. 10A-C depict distribution of accuracy across each ecosystem using the techniques described herein. FIG. 10A depicts a graph for distribution of the entire ecosystem for each threshold percentage at 32-bit precision. FIG. 108 depicts a graph for distribution of the entire ecosystem for each threshold percentage at 16-bit precision. FIG. 10C depicts a graph of average trial accuracy of the ecosystem at each threshold level. The cutoff (99%) can be the base accuracy that the model started with, and the optimum (5%) can be the largest value for tp before the accuracy can degrade from the original model. Anything under the cutoff value can be an undesirable result.” ([0071]).
“for one or more non-zero weights, iteratively: modify a non-zero weight by a perturbation value to generate a second weight, wherein the perturbation value is a fixed fraction of the non-zero weight, provide the input to the plurality of input nodes of the neural network, generate, from the one or more output nodes, a second output based on the input, determine a second error based on the second output, the expected output, the input, and the loss function, and reset the non-zero weight to an original value of the non-zero weight;” Karam teaches “Such a system can optionally include one or more of the following features. The neural attacks can include Neural Trojan attacks that involved injecting malicious data into the training dataset. The parameters associated with the CNN model can include the training dataset of the CNN model. Generating the ecosystem of CNN models can include applying stochastic parameter mutation to the parameters associated with the received CNN model. The generating the ecosystem of CNN models can further include shifting, at a first time and based on user-defined values, weights of the parameters associated with the received CNN model; and shifting, at a second time and using a random number generator, the weights of the parameters associated with the received CNN model. Updating the original weights of the parameters associated with the CNN model can include adding the modified weights to the original weights. Generating the update file for the received CNN model can include retraining the received CNN model with the updated weights; determining, based on the retraining, matrices of the updated weights before and after the retraining; and XOR'ing, based on the matrices, the updated weights in the update file. Updating the received CNN model can include transmitting, to the target computing system, deltas of the updated weights.” ([0009], these various steps read generally on generating multiple sets of weights with the addition of some value and training the CNN on those weights (but not necessarily updating the weights as the target device would)). The first shift by user-defined value(s) is taught in at least “Modifying the original weights of the parameters associated with the received CNN model can include shifting the original weights by a predetermined threshold value. The predetermined threshold value can be 1%.” ([0009], Page 2, which generally reads on a generic perturbation value being a fixed fraction of the weight).
“iteratively update the one or more non-zero weights to generate a second subset of weights, wherein the updating a non-zero weight comprises:” Karam teaches “Modifying the original weights of the parameters associated with the received CNN model can include shifting the original weights by a predetermined threshold value. The predetermined threshold value can be 1 %. The attack identification computing system may further be configured to encrypt the update file; and transmit, to the target computing system, the encrypted update file. The target computing system can be configured to: receive, from the attack identification computing system, the encrypted update file; decrypt the encrypted data file; and update the CNN model using the decrypted data file.” ([0009]).
“retrain the neural network;” Karam teaches “Generating the update file for the received CNN model can include retraining the received CNN model with the updated weights;” ([0009], Page 2).
“after retraining the neural network, send, to the user computing device, the first subset of weights and the second subset of weights.” Karam teaches “Updating the received CNN model can include transmitting, to the target computing system, deltas of the updated weights." ([0009]) Also see "The computer system 102 can also generate an update file in 1516. This can include retraining the received network model with the updated weights (1518). This can also include determining matrices of weights before and after the retraining (1520). In so doing, the computer system 102 can XOR the weights in an update file (1522). The update file can then be used to update the network model for the target system and also other similar or same systems in the same environment or ecosystem.” ([0114]).
Although Karam figures 4A/4B show a majority of weight values being 0, and a person of ordinary skill in the art would reasonably start training or retraining a CNN with pretrained or zero weights. Karam fails to explicitly teach:
“identify a first subset of weights having a value below a threshold;” and “set the identified subset of weights to zero;” However, Yu teaches. In paragraphs [0030]-[0031], identifying a subset of interconnection weights below a threshold and setting the interconnection weights to 0 in order to enforce a sparseness constraint.
Yu highlights the efficiency and convergence speed improvements of enforcing a sparsity constraint on continually training a neural network (Abstract, paragraphs [0028]-[0029]). It would have obvious to one of ordinary skill in the art at the time of the Applicant’s filing, in combining elements of Karam and Yu, to implement the sparseness constraints of Yu, especially when such a combination would require retraining the neural network, as Karam recites.
While the combination of Karam and Yu reads on the above limitations, the combination fails to explicitly teach:
“when a difference between the first error and a second error for the non-zero weight does not exceed a threshold, setting the non-zero weight to zero, or when the difference between the first error and the second error exceeds the threshold, retaining an original value of the non-zero weight;” However, Chan, in a similar field of endeavor of securing machine learning models, teaches “The pruning heuristics 176 include one or more heuristics to at least partially control iterative pruning ( e.g., compression) of the pre-trained ML model. For example, the pruning heuristics 176 may be based on weights of the ML model, activations of neurons (in neural networks), model compression, model accuracy, or the like. As a particular example, the pruning heuristics 176 may include or be based on average percentage of zero activations (APoZ). The stop criteria 178 include thresholds and/or other criteria used to determine whether to stop (e.g., terminate) the iterative pruning. For example, the stop criteria 178 may include one or more thresholds that correspond to, or may otherwise be based on, model compression ratios, model size, model accuracy, pruning duration ( e.g., durations of time and/or numbers of iterations), or the like. As particular, nonlimiting examples, the stop criteria 178 may include one or more success rates corresponding to the one or more attack models, a compression ratio, a pruning duration threshold, an accuracy threshold, or a combination thereof.” ([0031]) and “In some implementations, values and configurations of the pruned (e.g. , discarded) weights and/or nodes may be stored or otherwise maintained such that the pruned nodes may be added back during a later iteration if the candidate ML model is rejected or to improve responsiveness of the candidate ML model to cybersecurity attacks associated with the attack models 118. Although described in the context of neural networks, the pruning may include any operation that corresponds to reducing the complexity and size of the input ML model (e.g., setting an activation function to a null value, etc., nullifying weights or nodes in a decision tree, nullifying vector values or weights, etc.). ([0034]).
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art, having the teachings of Karam, Yum and Chan before him or her, to modify the system of claim 1 to include attributes of criteria of exceeding a threshold to stop retraining in order to determine whether to perform another iteration of pruning and testing, or to stop the pruning process (see [0056]: "Information (e.g., the risk assessment metrics 344, the baseline risk assessment metrics 346, the pruned model test results 352, and/or the model performance data 354) may be gathered to evaluate model performance of the candidate model 322 and to determine the heuristic feedback data 356 used to update the dynamic heuristics 324. Some or all of the information may also used to determine whether to perform another iteration of pruning and testing, or to stop the pruning process, based on results of the stop criteria comparison 360. After possibly multiple rounds (e.g., iterations) of pruning and testing, output is generated that may include the compressed ML model 370, the model report 372, or both.").
In regards to claim 2: The present invention claims: “wherein the retraining the neural network comprises not modifying weights that were set to zero.” The combination of Karam and Chan reads on not modifying weights that have been nulled or set to 0 as the model is retrained.
In regards to claim 3: The present invention claims: “further comprising a database storing, for the retraining the neural network, a plurality of inputs and corresponding expected outputs.” Karam teaches “As shown, the final network M can be trained. Stochastic parameter mutation can be applied to the weights to derive n copies of the model M. These weights can then be stored in a secure database for future deployment. Thus, the ecosystem can be derived from M and the weights for each network in the ecosystem can be stored." ([0056]). Also see "Next, each model can be mapped from the new ecosystem to each model in the old ecosystem by XOR'ing their parameters. This can derive an update for each model that can be deployed to the ecosystem. The new parameters can overwrite what currently exists in the database or data store described herein.” ([0061]).
In regards to claim 6: The present invention claims: “wherein the perturbation value for a non-zero weight is a based on an initial value of the non-zero weight.” Karam teaches “Modifying the original weights of the parameters associated with the received CNN model can include shifting the original weights by a predetermined threshold value. The predetermined threshold value can be 1%.” ([0009]).
In regards to claim 8: The present invention claims: “wherein the threshold is based on an average value of differences between second errors and the first error.” See above where Chan teaches pruning thresholds may be based on model accuracy ([0031], mapping to differences or an average of error values).
In regards to claim 9: The present invention claims: “wherein the threshold is selected such that non-zero weights for which differences are within a bottom quartile is set to zero.” See above where Chan teaches pruning stop conditions may be based on a model compression ratio ([0031], a compression ratio may be 75%, for example, eliminating the bottom 25%).
In regards to claim 10: The present invention claims: “wherein the threshold is a predefined fraction of the first error.” See above where Chan could reasonably read on the threshold being an average on error values, which would necessitate the threshold being a fraction of the first error value.
In regards to claim 11-13, 16, and 18-19: Claims 11-13, 16, and 19 recite similar limitations to claims 1-3, 6, and 8-9, with the exception of “A method comprising:” in claim 11; therefore, both sets of claims are similarly rejected.
In regards to claim 20: Claim 20 recites similar limitations to claim 1, with the exception of “A non-transitory computer readable medium storing computer executable instructions that, when executed by a processor, causes a security platform to:” therefore, both claims are similarly rejected.
Claim(s) 7 and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Karam, Yu, and Chan as applied to claims 1 and 11 above, and further in view of Doan et al. (Februus: Input Purificiation Defense Against Trojan Attacks on Deep Neural Network Systems, ), hereinafter Doan.
In regards to claim 7: The present invention claims: “wherein the loss function is one of: a mean squared error loss function, a binary cross-entropy loss function, or a categorical cross-entry loss function.” The combination of Karam and fails to explicitly teach the limitations of claim 7. However, Doan, in a similar field of endeavor, teaches “An attacker can augment the original objective (binary cross entropy loss) used for classification with a new objective to minimize the score of GradCAM for Trojaned inputs.” (Page 10, VII B).
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art, having the teachings of Karam, Yu, Chan, and Doan before him or her, to modify the system of claim 6 to include attributes of a loss function being one of a mean squared error loss function, a binary cross-entropy loss function, or a categorical cross-entry loss function in order to minimize the score (see section 7.2 'Attacks Targeting Trojan Removal' subsection 'Adaptive Trojan Training Attack': "An attacker can augment the original objective (binary cross entropy loss) used for classification with a new objective to minimize the score of GradCAM for Trojaned inputs. Intuitively, this discourages the network from focusing on the trojaned area").
In regards to claim 17: Claim 17 recites similar limitations to claim 7, with the exception of “A method comprising:” of claim 11; therefore, both sets of claims are similarly rejected.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GRIFFIN T BEAN whose telephone number is (703)756-1473. The examiner can normally be reached M - F 7:30 - 4:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Li Zhen can be reached at (571) 272-3768. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GRIFFIN TANNER BEAN/Examiner, Art Unit 2121
/Li B. Zhen/Supervisory Patent Examiner, Art Unit 2121
Prosecution Insights