DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-6 are pending in this application.
Applicant elected without traverse Species 1 associated with claims 1-2 and 5-6. Claims 3-4 corresponding to Species 2 are withdrawn from further consideration as being drawn to a non-elected invention.
Claim Objections
Claim 6 is objected to because of the following informalities:
Claim 6 recites “includes” in line 4, which maybe a type and should be corrected as “include”.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-2 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claims 1-2 are drafted in means plus function naming elements such as “an AI module configured to ...”, “a blocker module configured to ...”, “a submodule configured to …”, “an information gain module configured to …”, and “a blocker notification module configured to …” which was not properly described in the specification. See the 11(b) rejection below for details.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-2 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claims 1-2, it is noted that the claim elements “an AI module configured to ...”, “a blocker module configured to ...”, “a submodule configured to …”, “an information gain module configured to …”, and “a blocker notification module configured to …” are limitations that invoke 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for the claimed function. Specifically, each limitation that invokes 35 U.S.C. 112, sixth paragraph must be clearly described in terms of specific hardware structures and computer algorithms, however, applicant's specification only discloses such features in a general form of black boxes (e.g., Fig. 1, pages 6-7; the description does not offer enough details but merely repeat in similar words of the claim language).
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112, sixth paragraph; or
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the claimed function without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01 (o) and 2181.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-2 and 5 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Pogorelik et al. (US 12,346,432 B2) (hereinafter, “Pogorelik”).
As to claim 1, Pogorelik discloses an AI system comprising:
an input interface configured to receive input data from at least one user (“Logic flow 1200 may begin at block 1210 “receive input data” the system 1101 can receive input data 1124. For example, hardened system 1101 can receive input data 1124 from input device 1152.” -e.g., see, Pogorelik: col. 16, lines 15-20; herein, input device is equivalent to an input interface which receives an input from a user; see also: col. 26, lines 4-15);
an AI module configured to process the input data and to generate first output data corresponding to the input data (“Continuing to block 1220 “generate, via an inference model, output based on the received input” the system 1101 can generate, via inference model 1122, output data 1126 from input data 1124. For example, circuitry 1110 can execute inference model 1122 to generate output data 1126 from input data 1124.” -e.g., see, col. 16, lines 21-26; herein, output data 1126 is generated based on input data; see also: “At block 1250 “provide generated output” system 1101 can provide the output generate from inference model 1122 and input data 1124. For example, circuitry 1110 can execute inference model 1122 to provide output data 1126 (e.g., to a host system, to a system coupled via an interconnect, or the like).” -e.g., see, col. 16, lines 56-61; see also: “Logic flow 2500 may begin at block 2510 “receive input data” the system 2401 can receive input data 2424. For example, circuitry 2410-1, in executing instructions 2428-1, can receive input data 2424 (e.g., from input device 2452, or the like). Continuing to block 2520 “generate, via an inference model, output data based on the received input data” the hardened system 2401 can generate output data 2426 from inference model 2322 and input data 2424.” -e.g., see, col. 26, lines 4-15);
a blocker module configured to block at least one user (“At block 1260 “provide indication model use is unauthorized” system 1101 can provide an indication that the model usage is unauthorized (e.g., that the model is stolen, or the like). For example, circuitry 1110, in executing instructions 1128, can send an information element to a reporting agency (or the like) including an indication that the model 1122 may be the same as model 1022 (e.g., indicating that the model 1122 is stolen, or the like). From block 1260, logic flow 1200 can continue to block 1250.” -e.g., see, col. 16, lines 62-67 to col. 17, lines 1-3) the blocker module further configured to modify the first output data generated by the AI module (“Continuing to block 2580 “obfuscate output data” hardened system 2401 can obfuscate the output data 2426. For example, TEE circuitry 2411, in executing TEE instructions 2429, can generate obfuscated output data 2427 from output data 2426. Continuing to block 2590 “provide obfuscated output data to an output data consumer (e.g., output device, another computing device, or the like).” -e.g., see, col. 26, lines 52-62);
a submodule configured to identify an attack vector from the input data (“Continuing to decision block 1230 “is input data adversarial?” system 1101 can determine whether the input data 1124 is adversarial (e.g., whether the inputs are inputs 1063-m, or the like). For example, circuitry 1110 can execute instructions 1128 to determine whether inputs 1124 are adversarial.” -e.g., see, col. 16, lines 26-31; herein, identifying input data as adversarial which is equivalent to ‘identify an attack vector from the input data’; see also: “… hardener 140 could be arranged to mitigate against attack vectors generally referred to as adversarial inputs. Adversarial inputs are inputs designed to “fool” an inference system or trigger a specific inference based on the input. Hardener 140 could be arranged to mitigate against input probing attacks, input distortion, input redaction, or the like.” -e.g., see, col. 7, lines 4-10);
an information gain module configured to calculate an information gain value and to send the information gain value to the blocker module (“At block 1260 “provide indication model use is unauthorized” system 1101 can provide an indication that the model usage is unauthorized (e.g., that the model is stolen, or the like). For example, circuitry 1110, in executing instructions 1128, can send an information element to a reporting agency (or the like) including an indication that the model 1122 may be the same as model 1022 (e.g., indicating that the model 1122 is stolen, or the like). From block 1260, logic flow 1200 can continue to block 1250.” -e.g., see, col. 16, lines 62-67 to col. 17, lines 1-3; see also: “At block 2550 “alert monitoring system to potential probing” hardened system 2401 can alert a monitoring system (e.g., server 2403) to potential probing attacks. For example, circuitry 2410-1, in executing instructions 2428-1, can provide probing alert 2482 to server 2403. Continuing to block 2560 “collect forensic data” hardened system 2401 can collect forensic data associated with the potential probing attack.” -e.g., see, col. 26, lines 36-51; herein, “forensic data” is equivalent to information gain value);
a blocker notification module configured to transmit a notification to an owner of the AI system after detecting the attack vector with the submodule (“At block 1260 “provide indication model use is unauthorized” system 1101 can provide an indication that the model usage is unauthorized (e.g., that the model is stolen, or the like). For example, circuitry 1110, in executing instructions 1128, can send an information element to a reporting agency (or the like) including an indication that the model 1122 may be the same as model 1022 (e.g., indicating that the model 1122 is stolen, or the like). From block 1260, logic flow 1200 can continue to block 1250.” -e.g., see, col. 16, lines 62-67 to col. 17, lines 1-3; herein, reporting agency is equivalent to an owner of the AI system); and
an output interface configured to send an output to the at least one user (“Continuing to decision block 1230 “is input data adversarial?” system 1101 can determine whether the input data 1124 is adversarial (e.g., whether the inputs are inputs 1063-m, or the like). For example, circuitry 1110 can execute instructions 1128 to determine whether inputs 1124 are adversarial.” -e.g., see, col. 16, lines 26-31; herein, identifying input data as adversarial which is equivalent to ‘identify an attack vector from the input data’; see also: “… hardener 140 could be arranged to mitigate against attack vectors generally referred to as adversarial inputs. Adversarial inputs are inputs designed to “fool” an inference system or trigger a specific inference based on the input. Hardener 140 could be arranged to mitigate against input probing attacks, input distortion, input redaction, or the like.” -e.g., see, col. 7, lines 4-10).
As to claim 2, the AI system as claimed in claim 1, Pogorelik further discloses wherein the output sent by the output interface comprises the first output data when the submodule does not identify the attack vector from the input data (“At block 1250 “provide generated output” system 1101 can provide the output generate from inference model 1122 and input data 1124. For example, circuitry 1110 can execute inference model 1122 to provide output data 1126 (e.g., to a host system, to a system coupled via an interconnect, or the like).” -e.g., see, col. 16, lines 56-61).
As to claim 5, Pogorelik discloses a method to prevent capturing of an AI module in an AI system, the method comprising:
receiving input data from at least one user through an input interface (“Logic flow 1200 may begin at block 1210 “receive input data” the system 1101 can receive input data 1124. For example, hardened system 1101 can receive input data 1124 from input device 1152.” -e.g., see, Pogorelik: col. 16, lines 15-20; herein, input device is equivalent to an input interface which receives an input from a user);
transmitting the input data through a blocker module to an AI module (“Continuing to block 1220 “generate, via an inference model, output based on the received input” the system 1101 can generate, via inference model 1122, output data 1126 from input data 1124. For example, circuitry 1110 can execute inference model 1122 to generate output data 1126 from input data 1124.” -e.g., see, col. 16, lines 21-26; herein, input data is transmitted to circuitry 1110 to an input to an AI model 1122);
computing a first output data by the AI module executing a first model based on the input data (“Continuing to block 1220 “generate, via an inference model, output based on the received input” the system 1101 can generate, via inference model 1122, output data 1126 from input data 1124. For example, circuitry 1110 can execute inference model 1122 to generate output data 1126 from input data 1124.” -e.g., see, col. 16, lines 21-26; herein, output data 1126 is generated based on input data; see also: “At block 1250 “provide generated output” system 1101 can provide the output generate from inference model 1122 and input data 1124. For example, circuitry 1110 can execute inference model 1122 to provide output data 1126 (e.g., to a host system, to a system coupled via an interconnect, or the like).” -e.g., see, col. 16, lines 56-61);
processing the input data by a submodule to identify an attack vector from the input data (“Continuing to decision block 1230 “is input data adversarial?” system 1101 can determine whether the input data 1124 is adversarial (e.g., whether the inputs are inputs 1063-m, or the like). For example, circuitry 1110 can execute instructions 1128 to determine whether inputs 1124 are adversarial.” -e.g., see, col. 16, lines 26-31; herein, identifying input data as adversarial which is equivalent to ‘identify an attack vector from the input data’; see also: “… hardener 140 could be arranged to mitigate against attack vectors generally referred to as adversarial inputs. Adversarial inputs are inputs designed to “fool” an inference system or trigger a specific inference based on the input. Hardener 140 could be arranged to mitigate against input probing attacks, input distortion, input redaction, or the like.” -e.g., see, col. 7, lines 4-10), the and
sending identification information of the attack vector to an information gain module (“At block 1260 “provide indication model use is unauthorized” system 1101 can provide an indication that the model usage is unauthorized (e.g., that the model is stolen, or the like). For example, circuitry 1110, in executing instructions 1128, can send an information element to a reporting agency (or the like) including an indication that the model 1122 may be the same as model 1022 (e.g., indicating that the model 1122 is stolen, or the like). From block 1260, logic flow 1200 can continue to block 1250.” -e.g., see, col. 16, lines 62-67 to col. 17, lines 1-3; see also: “At block 2550 “alert monitoring system to potential probing” hardened system 2401 can alert a monitoring system (e.g., server 2403) to potential probing attacks. For example, circuitry 2410-1, in executing instructions 2428-1, can provide probing alert 2482 to server 2403. Continuing to block 2560 “collect forensic data” hardened system 2401 can collect forensic data associated with the potential probing attack.” -e.g., see, col. 26, lines 36-51).
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Pogorelik as applied to claim 5 above, and further in view of Molloy et al. (US 2021/0319093 A1) (hereinafter, “Molloy”).
As to claim 6, Pogorelik discloses the method to prevent capturing of an AI module as claimed in claim 5, Pogorelik doesn’t explicitly disclose wherein processing the input data further comprises: executing at least two models with the input data to generate a first model output and a second model output, wherein the at least two models includes the first model; comparing the first and second model outputs; and determining the input data as the attack vector based on the comparison.
However, in an analogous art, Molloy discloses wherein processing the input data further comprises: executing at least two models with the input data to generate a first model output and a second model output, wherein the at least two models includes the first model; comparing the first and second model outputs; and determining the input data as the attack vector based on the comparison (… the system is then configured or provisioned to use multimodal consistency checking 220 to detect adversarial examples for new inputs 222. To this end, and in a testing phase, the system rejects an input sample if the consistency level between two modalities is greater than the defined threshold, where the threshold is decided based on what percentage of clean samples are allowed to pass through the given function. If samples do not pass the consistency check, they are automatically detected and determined to be adversarial samples, and appropriate countermeasures are then undertaken to address the attack.” -e.g., see, Molloy: [0023]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filling date of the claimed invention was to modify the teaching of Pogorelik as taught by Molloy in order to enable ore reliable detection of attack vectors.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Overby et al. (US 2019/0379683 A1)-Overby teaches calculating an information gain information -([0096], [0097]); ML-[0052].
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SUMAN DEBNATH whose telephone number is (571)270-1256. The examiner can normally be reached Mon-Fri; 9:00am-5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at 571-272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
SUMAN DEBNATH
Patent Examiner
Art Unit 2495
/S.D/Examiner, Art Unit 2495
/FARID HOMAYOUNMEHR/Supervisory Patent Examiner, Art Unit 2495