Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Election/Restrictions
Claims 4-5 and 11-18 are withdrawn from further consideration pursuant to 37 CFR 1.142(b) as being drawn to a nonelected invention, there being no allowable generic or linking claim. Election was made without traverse in the reply filed on 1/23/2026.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-3, 6-10 and 19-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea of a mental concept without significantly more. The claims recite determining an output is adversarial, and sending the an indication to a downstream component based on the determination. This judicial exception is not integrated into a practical application because the additional elements of sensor data and sensor inputs only link the idea to the field of adversarial attacks. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claimed processors and downstream components are generic computer parts. Further, paragraph 58 of the specification says that the functions executed by the components or entities may be carried out by only software. Therefore, it is not clear that the claimed components are actually physical parts of a computer.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 6-10 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over US20220261642A1 to Yoshida and US20190238568A1 to Goswami et al.
Claims 2-3 are rejected under 35 U.S.C. 103 as being unpatentable over US20220261642A1 to Yoshida, US20190238568A1 to Goswami et al and US20220405578A1 to Antonides et al.
1. A method, comprising:
generating, using a machine learning model and based at least on a sensor data instance, one or more base outputs and one or more adversarial outputs that represent a likelihood that the sensor data instance is adversarial; (Yoshida fig. 3 input observation data s11. Yoshida para 87 “Next to step S11, the output distribution calculation unit 22 calculates the mean and variance of the output values by class…”)
determining that the sensor data instance is adversarial based on the one or more adversarial outputs; and (Yoshida para 89 “determining for each input observation data whether the observation data is an adversarial example or not, based on the probabilistic margin calculated for each observation data (step S14).”)
Yoshida doesn’t teach downstream action.
However, Goswami teaches sending, to one or more downstream components, an indication that the sensor data instance is adversarial to cause the one or more downstream components to perform one or more operations with respect to the one or more base outputs and in view of the indication. (Goswami fig. 10 does two different things in 1070 and 1080 based on an adversarial indication.)
Yoshida, Goswami and the claims all identify adversarial outputs. It would have been obvious to a person having ordinary skill in the art, at the time of filing, to do something with the adversarial indicator because it’s wasteful to make an indication and do nothing with it. Also, because both references anticipate using these adversarial determinations in a car for safety and authentication. Yoshida para 5 and Goswami para 4.
2. The method of claim 1, further comprising:
generating, using the machine learning model and based at least on a (Yoshida fig. 3 input observation data s11. Yoshida para 87 “Next to step S11, the output distribution calculation unit 22 calculates the mean and variance of the output values by class…”)
determining, using the one or more (Yoshida para 89 “determining for each input observation data whether the observation data is an adversarial example or not, based on the probabilistic margin calculated for each observation data (step S14).”)
Yoshida doesn’t teach the downstream action
However, Goswami teaches sending a (Goswami fig. 10 does two different things in 1070 and 1080 based on an adversarial indication.)
Goswami and Yoshida don’t teach a second sensor and second determination.
However, Antonides teaches a second sensor, second base output and second indication. (Antonides para 46 “data captured within a first window in time by a first sensor may be combined with data captured by a second sensor within a second window in time to be included in the event driven fusion 110. The first window and the second window can be determined based on features of the first sensor and the second sensor as well as features of the surrounding environment. For example, an acoustic sensor of the sensor stack 105 may be able to detect the car 102 before a visual camera of the sensor stack 105 obtains visual data of the car 102.”)
Antonides, Yoshida and Goswami all detect adversarial data. It would have been obvious to a person having ordinary skill in the art, at the time of filing, to use a second sensor because “[a]dvantageous implementations may further provide robustness against adversarial attacks.” Antonides para 35.
3. The method of claim 2, wherein the determining the output type comprises matching a highest confidence included in the one or more (Yoshida para 67 “the mean of the output values calculated for the class with the highest likelihood to which the observation data corresponds is denoted as μa, and the variance of the output values calculated for that class is denoted as σa2.” The likelihood is the confidence.)
Yoshida doesn’t teach a second value.
However, Antonides teaches a second value. (Antonides para 46 “data captured within a first window in time by a first sensor may be combined with data captured by a second sensor within a second window in time to be included in the event driven fusion 110. The first window and the second window can be determined based on features of the first sensor and the second sensor as well as features of the surrounding environment. For example, an acoustic sensor of the sensor stack 105 may be able to detect the car 102 before a visual camera of the sensor stack 105 obtains visual data of the car 102.”)
6. The method of claim 1, wherein the determining that the sensor data instance is adversarial comprises determining that at least one of the one or more adversarial outputs exceeds a threshold value. (Yoshida para 73 “whether the probabilistic margin M calculated by the adversarial example detection unit 24 is less than or equal to a predetermined threshold, and detect the observation data for which the probabilistic margin M is less than or equal to the threshold as an adversarial example. On the other hand, the adversarial example detection unit 24 may determine that the observation data for which the probabilistic margin M is greater than the threshold is normal observation data.”)
7. The method of claim 1, wherein the determining that the sensor data instance is adversarial comprises determining that the one or more adversarial outputs include confidences that are higher than confidences associated with the one or more base outputs. (Yoshida para 73 “whether the probabilistic margin M calculated by the adversarial example detection unit 24 is less than or equal to a predetermined threshold…” The margin is a confidence.)
8. The method of claim 1, wherein the sensor data instance comprises one or more images. (Yoshida para 78 “As described above, when the learning data is an image of a human face, an example of the preprocessing is to delete the background portion from the image stored as the learning data and to crop only the image of the portion corresponding to the face.”)
9. The method of claim 1, wherein the one or more base outputs correspond to a set of classes associated with objects. (Yoshida para 87 “the output distribution calculation unit 22 calculates the mean and variance of the output values by class…”)
10. The method of claim 1, wherein the one or more downstream components are included in at least one of:
a control system for an autonomous or semi-autonomous machine;
a perception system for an autonomous or semi-autonomous machine;
a system for performing simulation operations;
a system for performing digital twin operations;
a system for performing light transport simulation;
a system for performing collaborative content creation for 3D assets;
a system for performing deep learning operations;
a system implemented using an edge device;
a system for generating or presenting at least one of virtual reality content, augmented reality content, or mixed reality content;
a system implemented using a robot;
a system for performing conversational AI operations;
a system for generating synthetic data;
a system incorporating one or more virtual machines (VMs);
a system implemented at least partially in a data center; or
a system implemented at least partially using cloud computing resources. (Goswami para 4 “Computer vision is used in many applications. For example, computer vision is used in safety systems, such as collision warning systems. Computer vision is also used in various security systems used to monitor residential, business, and industrial environments, traffic monitoring systems, satellite-based imaging systems, military systems, and the like.”)
19. A system comprising: one or more processing units to perform, based at least on an indication of an adversarial attack, (Yoshida para 89 “the adversarial example detection unit 24 detects adversarial examples by determining for each input observation data whether the observation data is an adversarial example or not, based on the probabilistic margin calculated for each observation data (step S14).”)
Yoshida doesn’t teach downstream action.
However, Goswami teaches one or more operations with respect to a base output of a neural network. (Goswami fig. 10 does two different things in 1070 and 1080 based on an adversarial indication.)
Yoshida, Goswami and the claims all identify adversarial outputs. It would have been obvious to a person having ordinary skill in the art, at the time of filing, to do something with the adversarial indicator because it’s wasteful to make an indication and do nothing with it. Also, because both references anticipate using these adversarial determinations in a car for safety and authentication. Yoshida para 5 and Goswami para 4.
20. The system of claim 19, wherein the system is comprised in at least one of:
a control system for an autonomous or semi-autonomous machine;
a perception system for an autonomous or semi-autonomous machine;
a system for performing simulation operations;
a system for performing digital twin operations;
a system for performing light transport simulation;
a system for performing collaborative content creation for 3D assets;
a system for performing deep learning operations;
a system implemented using an edge device;
a system for generating or presenting at least one of virtual reality content, augmented reality content, or mixed reality content;
a system implemented using a robot;
a system for performing conversational AI operations;
a system for generating synthetic data;
a system incorporating one or more virtual machines (VMs);
a system implemented at least partially in a data center; or
a system implemented at least partially using cloud computing resources. (Yoshida para 5 “Although a face recognition system is illustrated here, a speaker recognition system, a biometric authentication system, an automatic driving car, and the like can also be cited as examples of determination systems. Each class that is a determination result is defined according to a class determination performed by the determination system.”)
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Austin Hicks whose telephone number is (571)270-3377. The examiner can normally be reached Monday - Thursday 8-4 PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Mariela Reyes can be reached at (571) 270-1006. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/AUSTIN HICKS/Primary Examiner, Art Unit 2142