CTFR 18/013,328 CTFR 100919 Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. 12-151 AIA 26-51 12-51 Status of Claims Claims 1, 6, 10, 11, and 23 were amended. Claims 3, 15 – 17, and 22 are cancelled. Claims 1 – 2, 4 – 14, 18 – 21, 23 are pending and examined herein. Claim s 1 – 2, 4 – 14, 18 – 21, 23 rejected under 35 U.S.C. 112(b) Claim 4 rejected under 35 U.S.C. 112(d) Claims 1 – 2, 4 – 14, 18 – 21, 23 are rejected under 35 U.S.C. 101. Claims 1 – 2, 4 – 14, 18 – 21, 23 are rejected under 35 U.S.C. 103. Response to Amendment The amendment filed January 26 th , 2026 has been entered. Claims 1, 6, 10, 11, and 23 were amended. Claims 3, 15 – 17, and 22 are cancelled. Claims 1 – 2, 4 – 14, 18 – 21, 23 are pending and examined herein. Applicant’s amendments to the claims have overcome each and every objection set forth in the Non-Final Rejection Office Action mailed October 27 th , 2025. Response to Arguments Applicant's arguments filed January 26 th , 2026 regarding the 35 U.S.C. § 101 rejection have been fully considered but are not persuasive. Applicant amended the claims to recite additional details regarding labeling the modified dataset, including passing the modified dataset to the first and second private teacher models, receiving first and second classifications, and labeling the modified dataset based on the classifications. However, Applicant has not explained how these amended limitations integrate the abstract idea into a practical application or amount to significantly more than the abstract idea. The amended limitations remain directed to mathematical/evaluate data processing, including applying machine learned models to data, receiving classifications, labeling data based on the classifications, and training another machine learned model using the labeled data. The claims do not recite a specific improvement to computer functionality, a specific improvement to machine learning architecture or training, or a particular technological mechanism that improves computer operation. Accordingly, the rejection under 35 U.S.C. § 101 is maintained. 07-38-02 AIA Applicant’s arguments, see pages 10 – 11 , filed January 26 th , 2026 , with respect to the rejection(s) of claim(s) 1 – 2, 4 – 14, 18 – 21, 23 under 35 U.S.C. 103 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Sung et al. (NPL:”Local Differential Privacy in the Medical Domain to Protect Sensitive Information: Algorithm Development and Real-World Validation”) . Claim Rejections - 35 USC § 112 07-30-02 AIA The following is a quotation of 35 U.S.C. 112(b): (b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention. The following is a quotation of 35 U.S.C. 112 (pre-AIA), second paragraph: The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention. 07-34-01 Claim s 1 – 2, 4 – 14, 18 – 21, 23 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Claims 1, 11, and 23 recites the amended limitation “training a first private teacher model using the first data subset, wherein the first private teacher model comprises a first machine-learned model” and further recites “training a second private teacher model using the second data subset, wherein the first private teacher model comprises a second machine-learned model”. It is unclear whether the first private teacher model is intended to comprise both the first machine learned model and the second machine learned model, or whether the second private teacher model is intended to comprise the second machine learned model. Therefore, the scope of the claimed limitation is unclear. For examination purposes, the amended limitation will refer to “the second private teacher model comprises a second machine learned model”. Claims 1, 11, and 23 further recites “a first classification of the modified dataset” and “a second classification of the input modified dataset”. As both private teacher models received the modified dataset as input in the previous step, it is unclear whether these “the modified dataset” and “the input modified dataset” are same kinds of dataset these private teacher model receive corresponding classification from. For examination purposes, the amended limitation will both refer to “the input modified dataset” to flow along with their previous step. Claims 2, 4 – 10, 12 – 14, 18 – 22 are dependent on claims 1, 11, 23. They do not resolve the issue of indefiniteness and are rejected with the same rationale. Claims 5, 8, 10, 13, 14, 19, 20 and 21 recites “the private dataset,” but the independent claims recite “first private dataset” and “second private dataset.” It is unclear whether “the private dataset” in these claims are referring to the first private dataset, the second private dataset, another dataset, or the combination of these private dataset. There is insufficient antecedent basis for these limitation in the claims. For examination purposes, claims 5,13,14 is interpreted as referring to the second private dataset used to generate the modified dataset. Claim 8 is interpreted as referring to the first private dataset from claim 1 which the first data subset and second data subset are divided. Claims 10 and 19 are interpreted as referring to the second private dataset used to generate the modified dataset. Claims 20 and 21 are interpreted as referring to the first private dataset. Claim 10 further recites “dividing the second private dataset” and claim 19 recites “dividing the private dataset”. The independent claims that they depend on recites dividing the first private dataset into a first data subset and a second data subset. Claims 10 and 19 recites dividing those different private dataset into at least “the first data subset,” “the second data subset,” and “a third data subset.” As “the first data subset” and “the second data subset” appear to refer back to the subsets of the first private dataset recited in the independent claim, it is unclear whether claims require the same first and second data subsets to also be subsets of another private dataset, or whether claims 10 and 19 are intended to recite different first and second subsets of other private dataset. For examination purposes, claims 10 and 19 are interpreted as reciting first, second , and third data subsets of the second private dataset used to generate the modified dataset. 07-36 AIA The following is a quotation of 35 U.S.C. 112(d): (d) REFERENCE IN DEPENDENT FORMS.—Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers. The following is a quotation of pre-AIA 35 U.S.C. 112, fourth paragraph: Subject to the following paragraph [i.e., the fifth paragraph of pre-AIA 35 U.S.C. 112], a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers. 07-36-01 AIA Claim 4 is rejected under 35 U.S.C. 112(d) or pre-AIA 35 U.S.C. 112, 4th paragraph, as being of improper dependent form for failing to further limit the subject matter of the claim upon which it depends, or for failing to include all the limitations of the claim upon which it depends. Claim 4 depends from canceled claim 3 and therefore does not further limit a pending claim . Applicant may cancel the claim(s), amend the claim(s) to place the claim(s) in proper dependent form, rewrite the claim(s) in independent form, or present a sufficient showing that the dependent claim(s) complies with the statutory requirements. Claim Rejections - 35 USC § 101 07-04-01 AIA 07-04 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1 – 2, 4 – 14, 18 – 21, 23 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. MPEP § 2109(III) sets out steps for evaluating whether a claim is drawn to patent-eligible subject matter. The analysis of claims 1 – 2, 4 – 14, 18 – 21, 23 in accordance with these steps, follows. Step 1 Analysis: Step 1 is to determine whether the claim is directed to a statutory category (process, machine, manufacture, or composition of matter. Claims 1 – 2, 4 – 10 are directed to a system, meaning that it is directed to the statutory category of machine. Claims 11 – 14, 18 – 21 are directed to a computer-implemented method, which is the statutory category of process. Claim 23 is directed to a non-transitory computer readable medium, which can be the statutory category of manufacture. Step 2A Prong One, Step 2A Prong Two, and Step 2B Analysis: Step 2A Prong One asks if the claim recites a judicial exception (abstract idea, law of nature, or natural phenomenon). If the claim recites a judicial exception, analysis proceeds to Step 2A Prong Two, which asks if the claim recites additional elements that integrate the abstract idea into a practical application. If the claim does not integrate the judicial exception, analysis proceeds to Step 2B, which asks if the claim amounts to significantly more than the judicial exception. If the claim does not amount to significantly more than the judicial exception, the claim is not eligible subject matter under 35 U.S.C. 101. Regarding claim 1 , the following claim elements are abstract ideas: dividing the first private dataset into at least a first data subset and a second data subset; (Dividing a dataset into subset is practical to perform in the human mind under its broadest reasonable interpretation aside from the recitation of generic computer components or by a human using a pen and paper.) generating an aggregate teacher model based at least in part on the trained first private teacher model and the trained second private teacher model; (Generating an aggregated teacher model from two teacher model is practical to perform in the human mind under its broadest reasonable interpretation aside from the recitation of generic computer components.) modifying the second private dataset in a differentially private way (Modifying in a differentially private way is a mathematical transformation of data, which recites mathematical concept.) labeling the modified dataset based on the first classification and second classification; (This is practical to perform in the human mind under its broadest reasonable interpretation aside from the recitation of generic computer components or by a human using a pen and paper.) The following claim elements are additional elements which, taken alone or in combination with the other additional elements, do not integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception: one or more processors; and one or more computer-readable media storing instructions that are executable to cause the one or more processors to perform operations, the operations comprising: (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) obtaining a first private dataset; (This is mere data gathering, an insignificant extra solution activity, which does not integrate the judicial exception into a practical application. The broadest reasonable interpretation of this claim is storing information in memory, which is a well-understood, routine conventional activity. See MPEP § 2106.05(d)(II)(iv). Therefore, this does not amount to significantly more than the judicial exception.) training a first private teacher model using the first data subset, wherein the first private teacher model comprises a first machine learned model (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) training a second private teacher model using the second data subset, wherein the first private teacher model comprises a second machine learned model (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) obtaining a modified dataset that was generated based on a second private dataset by (This is mere data gathering and outputting, an insignificant extra solution activity, which does not integrate the judicial exception into a practical application. The broadest reasonable interpretation of this claim is storing information in memory, which is a well-understood, routine conventional activity. See MPEP § 2106.05(d)(II)(iv). Therefore, this does not amount to significantly more than the judicial exception.) wherein the second private dataset is at least one of: (i) a third data subset of the first private dataset or (ii) a distinct dataset from the first private dataset; (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) labeling the modified dataset by the aggregate teacher model by; (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) passing the modified dataset as input to the first private teacher model and the second private teacher model; (This is mere transmitting data, which is a well-understood, routine conventional activity. It does not integrate the judicial exception into a practical application. See MPEP § 2106.05(d). Therefore, this does not amount to significantly more than the judicial exception.) receiving from the first private teacher model a first classification of the modified dataset; (This is mere data gathering and outputting, an insignificant extra solution activity, which does not integrate the judicial exception into a practical application. The broadest reasonable interpretation of this claim is storing information in memory, which is a well-understood, routine conventional activity. See MPEP § 2106.05(d)(II)(iv). Therefore, this does not amount to significantly more than the judicial exception.) receiving from the second private teacher model a second classification of the input modified dataset; and (This is mere data gathering and outputting, an insignificant extra solution activity, which does not integrate the judicial exception into a practical application. The broadest reasonable interpretation of this claim is storing information in memory, which is a well-understood, routine conventional activity. See MPEP § 2106.05(d)(II)(iv). Therefore, this does not amount to significantly more than the judicial exception.) and training a publicly available student model using the labeled modified dataset, wherein the publicly available student model comprises a third machine learned model. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 2 , the rejection of claim 1 is incorporated herein. Further, claim 2 recites the following additional element: wherein the publicly available student model is a non-differentially private machine learning algorithm. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 4 , the rejection of claim 3 is incorporated herein. Further, claim 4 recites the following additional element: performing the method to modify the private data subset comprises adding noise to the private data subset. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 5 , the rejection of claim 1 is incorporated herein. Further, claim 5 recites the following abstract idea: performing a differentially private generation algorithm on the private dataset; (Performing a differentially private generation algorithm on the dataset is merely reciting mathematical calculation, which is mathematical concept.) Claim 5 further recites following additional elements: obtaining … output comprising the modified dataset, (This is mere data gathering and outputting, an insignificant extra solution activity, which does not integrate the judicial exception into a practical application. The broadest reasonable interpretation of this claim is storing information in memory, which is a well-understood, routine conventional activity. See MPEP § 2106.05(d)(II)(iv). Therefore, this does not amount to significantly more than the judicial exception.) , from the differentially private generation algorithm, (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) wherein the modified dataset comprises an unlabeled modified dataset. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 6 , the rejection of claim 1 is incorporated herein. Further, claim 6 recites the following additional element: wherein the at least first private teacher model and second private teacher model comprise at least one of regression models, classification models, naive Bayesian models, neural networks, decision trees, random first models, or support vector machines. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 7 , the rejection of claim 1 is incorporated herein. Further, claim 7 recites the following additional element: wherein the publicly available student model comprises at least one of regression models, classification models, naive Bayesian models, neural networks, decision trees, random forest models, or support vector machines. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 8 , the rejection of claim 1 is incorporated herein. Further, claim 8 recites the following additional element: wherein the first data subset and the second data subset are disjoint subsets of the private dataset. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 9 , the rejection of claim 1 is incorporated herein. Further, claim 9 recites the following abstract ideas: determining that there is not a publicly available training dataset; (Determining there is no publicly available dataset is practical to perform in the human mind under its broadest reasonable interpretation aside from the recitation of generic computer components or by a human using a pen and paper.) generating the modified dataset, labeling the modified dataset (Generating and labeling the modified dataset is practical to perform in the human mind under its broadest reasonable interpretation aside from the recitation of generic computer components or by a human using a pen and paper. It could also be performing mathematical calculation to generate and label the modified dataset, which is mathematical concept.) Claim 9 further recites following additional elements: and in response to determining that there is not a publicly available training dataset, (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) and training the publicly available student model using the labeled modified dataset. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 10 , the rejection of claim 1 is incorporated herein. Further, claim 10 recites the following abstract idea: dividing the second private dataset into at least the first data subset, the second data subset, and a third data subset, (Dividing a dataset into subset is practical to perform in the human mind under its broadest reasonable interpretation aside from the recitation of generic computer components or by a human using a pen and paper.) performing a differentially private generation algorithm on the third data subset; (Performing a differentially private generation algorithm on the data subset is merely reciting mathematical calculation, which is mathematical concept.) Claim 10 further recites following additional elements: wherein the first data subset, the second data subset, and the third data subset are disjoint subsets of the private dataset; (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) and obtaining ... output comprising the modified dataset, (This is mere data gathering and outputting, an insignificant extra solution activity, which does not integrate the judicial exception into a practical application. The broadest reasonable interpretation of this claim is storing information in memory, which is a well-understood, routine conventional activity. See MPEP § 2106.05(d)(II)(iv). Therefore, this does not amount to significantly more than the judicial exception.) ,from the differentially private generation algorithm, (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) wherein the modified dataset comprises an unlabeled modified dataset. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Claims 11, 12, 13, 14, 18, 19 recite substantially similar subject matter to claims 1, 2, 5, 4, 9, 10 respectively and are rejected with the same rationale, mutatis mutandis . Regarding claim 20 , the rejection of claim 11 is incorporated herein. Further, claim 20 recites the following additional element: wherein the private dataset contains medical records of a plurality of individuals. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Regarding claim 21 , the rejection of claim 11 is incorporated herein. Further, claim 21 recites the following additional element: wherein the private dataset contains advertisement data associated with a plurality of advertisers. (This falls under mere instructions to apply an exception. See MPEP § 2106.05(f). Therefore, this does not amount to significantly more than the judicial exception.) Claim 23 recites substantially similar subject matter to claim 1 respectively and is rejected with the same rationale, mutatis mutandis . Claim Rejections - 35 USC § 103 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claims 1 – 2, 4 – 8, 10 – 14, 19 – 20, 23 are re jected under 35 U.S.C. 103 as being unpatentable over Pa pernot et al. (NPL: “Semi-supervised knowledge transfer for deep learning from private training data”) in view of Sung et al. (NPL: “Local Differential Privacy in the Medical Domain to Protect Sensitive Information: Algorithm Development and Real-World Validation”). Re garding Claim 1 , Papernot teaches obtaining a first private dataset; (Pg. 3 Figure 1. Overview of the approach of Papernot PNG media_image1.png 256 723 media_image1.png Greyscale describes the obtaining private dataset. ) dividing the first private dataset into at least a first data subset and a second data subset; (Fig. 1. shows private dataset is disjointed into subsets. Pg. 2 I. Introduction of Papernot states “In this strategy, first, an ensemble (Dietterich, 2000) of teacher models is trained on disjoint subsets of the sensitive data.”) training a first private teacher model using the first data subset, wherein the first private teacher model comprises a first machine learned model; (Fig. 1 shows that subset 1 is used for teacher model 1. Pg.4 2.1 Training the ensemble of teachers section of Papernot states “Data partitioning and teachers: Instead of training a single model to solve the task associated with dataset (X, Y ), where X denotes the set of inputs, and Y the set of labels, we partition the data in n disjoint sets (Xn, Yn) and train a model separately on each set.”) training a second private teacher model using the second data subset, wherein the first private teacher model comprises a second machine learned model; (Fig. 1 shows that subset 2 is used for teacher model 2. Pg.4 2.1 Training the ensemble of teachers section of Papernot states “Data partitioning and teachers: Instead of training a single model to solve the task associated with dataset (X, Y ), where X denotes the set of inputs, and Y the set of labels, we partition the data in n disjoint sets (Xn, Yn) and train a model separately on each set.”) generating an aggregate teacher model based at least in part on the trained first private teacher model and the trained second private teacher model; (Fig. 1 shows that teacher model 1, 2 are used to generate aggregated teacher model. Pg.4 2.1 Training the ensemble of teachers section of Papernot states “Aggregation: The privacy guarantees of this teacher ensemble stems from its aggregation”) labeling … dataset by the aggregate teacher model by; passing … dataset as input to the first private teacher model and the second private teacher model; ( Pg.4 2.1 Training the ensembles of teachers section of Papernot states “As evaluated in Section 4.1, assuming that n is not too large with respect to the dataset size and task complexity, we obtain n classifiers fi called teachers. We then deploy them as an ensemble making predictions on unseen inputs x by querying each teacher for a prediction fi(x) and aggregating these into a single prediction.” Papernot teaches querying each teacher model for a prediction on an input and aggregating the teacher predictions into a single label. ) receiving from the first private teacher model a first classification of … dataset; receiving from the second private teacher model a second classification of the input … dataset; (Pg.4 2.1 Training the ensembles of teachers section of Papernot states “The privacy guarantees of this teacher ensemble stems from its aggregation. Let m be the number of classes in our task. The label count for a given class j 2 [m] and an input ~x is the number of teachers that assigned class j to input ~x: nj(~x) = jfi : i 2 [n]; fi(~x) = jgj. If we simply apply plurality—use the label with the largest count—the ensemble’s decision may depend on a single teacher’s vote. Indeed, when two labels have a vote count differing by at most one, there is a tie: the aggregated output changes if one teacher makes a different prediction. We add random noise to the vote counts nj to introduce ambiguity:” Each teacher fi assigns a class to the input) and labeling the modified dataset based on the first classification and second classification; (Pg.4 2.1 Training the ensembles of teachers section of Papernot states “Indeed, when two labels have a vote count differing by at most one, there is a tie: the aggregated output changes if one teacher makes a different prediction. We add random noise to the vote counts nj to introduce ambiguity: f(x) = arg maxj{nj(~x) + Lap(1/lambda)} (1) In this equation, lambda is a privacy parameter and Lap(b) the Laplacian distribution with location 0 and scale b. The parameter lambda influences the privacy guarantee we can prove. Intuitively, a large lambda leads to a strong privacy guarantee, but can degrade the accuracy of the labels, as the noisy maximum f above can differ from the true plurality.” The individual teacher classifications are aggregated through the noisy voting formula in Papernot.) and training a publicly available student model using the labeled … dataset, wherein the publicly available student model comprises a third machine learned model. (Pg. 2 Introduction section of Papernot states “Finally, it is an important advantage that our learning strategy and our privacy analysis do not depend on the details of the machine learning techniques used to train either the teachers or their student. Therefore, the techniques in this paper apply equally well for deep learning methods, or any such learning methods with large numbers of parameters, as they do for shallow, simple techniques.” Pg. 3 Fig. 1 of Papernot states “Figure 1: Overview of the approach: (1) an ensemble of teachers is trained on disjoint subsets of the sensitive data, (2) a student model is trained on public data labeled using the ensemble.” Pg. 10 6. Conclusion section of Papernot states “To protect the privacy of sensitive training data, this paper has advanced a learning strategy and a corresponding privacy analysis. The PATE approach is based on knowledge aggregation and transfer from “teacher” models, trained on disjoint data, to a “student” model whose attributes may be made public.” Papernot teaches training a publicly available student model using data labeled by the teacher ensemble, and that the student model may be any machine learned model whose attributes may be made public. Paper does not teach modified dataset but Sung teaches that in the below.) Papernot does not explicitly teach that obtaining a modified dataset that was generated based on a second private dataset by; modifying the second private dataset in a differentially private way, wherein the second private dataset is at least one of (i) a third data subset of the first private dataset or (ii) a distinct dataset from the first private dataset; … the modified dataset … However, Sung teaches that obtaining a modified dataset that was generated based on a second private dataset by; modifying the second private dataset in a differentially private way, wherein the second private dataset is at least one of (i) a third data subset of the first private dataset or (ii) a distinct dataset from the first private dataset; (Pg. 1 Abstract of Sung states “All data were normalized to a range between –1 and 1, and the bounded Laplacian method was applied to prevent the generation of out-of-bound values after applying the differential privacy algorithm. To preserve the cardinality of the categorical variables, we performed postprocessing via discretization.” Pg. 2 Method section of Sung states “Figure 1 presents the workflow employed to achieve differential privacy in this study. When a user requests data, we perturb the data using the bounded Laplacian method (m1) and discretization postprocessing (m2) to provide high-fidelity data while preserving the privacy of the original data…. Differential privacy upon data request from third party users. The owner perturbs the original data to preserve privacy before sending the data externally.” PNG media_image2.png 212 746 media_image2.png Greyscale Pg. 3 Method section of Sung states “Dwork et al [22] defined ε-differential privacy as a randomized function. For adjacent data Y1 and Y2, function κ is (ε, δ)–differentially private if P[κ(Y1) ∈ S] ≤ ε ∙ P[κ(Y2) ∈ S] + δ where S ⊂ Range(κ). Local differential privacy is a specific case in which the random function or perturbation is applied by data owners, not by central aggregators.” Sung teaches that the data owner holds original private data, perturbs it using local differential privacy and produces a perturbed data. The perturbed data is distinct to the owner’s original private data.) It would have been obvious to one with ordinary skill in the art before the effective filing date of the invention to combine the teachings of Papernot and Sung. Papernot teaches a PATE framework in which private teacher models trained on disjoint subsets of sensitive data label unlabeled input data through aggregated teacher predictions, and a student model is trained using the resulting labels. Sung teaches modifying original private data using local differential privacy, including bounded Laplacian perturbation, before the data is sent externally, while preserving utility for machine learning use. One with ordinary skill in the art would be motivated to incorporate the teachings of Sung into that of Papernot so that private unlabeled data could be used in place of Papernot’s public or non-sensitive unlabeled data for teacher labeling and student model training while protecting the underlying private records. The combination of teachings from these references would have been predictable use of a known differential privacy data perturbation technique in a known privacy preserving teacher student learning framework to accurately do private federated learning. Regarding claim 2 , the rejection of claim 1 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches wherein the publicly available student model is a non-differentially private machine learning algorithm. (Fig. 1 of Papernot shows that student model is accessible by adversary. Pg. 4 2.2 Semi- supervised Transfer of the knowledge from an ensemble to a student section of Papernot states “We train a student on nonsensitive and unlabeled data, some of which we label using the aggregation mechanism. This student model is the one deployed, in lieu of the teacher ensemble, so as to fix the privacy loss to a value that does not grow with the number of user queries made to the student model…Thus, the privacy of users who contributed to the original training dataset is preserved even if the student’s architecture and parameters are public or reverse-engineered by an adversary.”) Regarding claim 4 , the rejection of claim 3 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches performing the method to modify the private data subset comprises adding noise to the private data subset. () Regarding claim 5 , the rejection of claim 1 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches performing a differentially private generation algorithm on the private dataset; (Pg. 16 C Appendix: additional experiments on the UCI adult and Diabetes datasets section of Papernot states “We then use the noisy aggregation mechanism, where vote counts are perturbed with Laplacian noise of scale 0.05 to privately label the first 500 test set inputs.”) obtaining, from the differentially private generation algorithm, output comprising the modified dataset, wherein the modified dataset comprises an unlabeled modified dataset. (Pg. 16 C Appendix: additional experiments on the UCI adult and Diabetes datasets section of Papernot states “We train the student random forest on these 500 test set inputs and evaluate it on the last 11,282 test set inputs for the Adult dataset, and 6,352 test set inputs for the Diabetes dataset. These numbers deliberately leave out some of the test set, which allowed us to observe how the student performance- privacy trade-off was impacted by varying the number of private labels, as well as the Laplacian scale used when computing these labels.”) Regarding claim 6 , the rejection of claim 1 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches wherein the at least first private teacher model and second private teacher model comprise at least one of regression models, classification models, naive Bayesian models, neural networks, decision trees, random first models, or support vector machines. (Pg. 16 C Appendix: additional experiments on the UCI adult and Diabetes datasets section of Papernot states “For both datasets, we train ensembles of n = 250 random forests on partitions of the training data”) Regarding claim 7 , the rejection of claim 1 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches wherein the publicly available student model comprises at least one of regression models, classification models, naive Bayesian models, neural networks, decision trees, random forest models, or support vector machines. (Pg. 16 C Appendix: additional experiments on the UCI adult and Diabetes datasets section of Papernot states “We train the student random forest on these 500 test set inputs and evaluate it on the last 11,282 test set inputs for the Adult dataset, and 6,352 test set inputs for the Diabetes dataset”) Regarding claim 8 , the rejection of claim 1 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches wherein the first data subset and the second data subset are disjoint subsets of the private dataset. (Fig. 1 of Papernot shows using disjoint subsets of the private dataset. Pg. 2 I. Introduction of Papernot states “In this strategy, first, an ensemble (Dietterich, 2000) of teacher models is trained on disjoint subsets of the sensitive data”) Regarding claim 10 , the rejection of claim 1 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches dividing the second private dataset into at least the first data subset, the second data subset, and a third data subset, wherein the first data subset, the second data subset, and the third data subset are disjoint subsets of the private dataset; (Fig. 1 of Papernot shows using disjoint subsets of the private dataset. Pg. 2 I. Introduction of Papernot states “In this strategy, first, an ensemble (Dietterich, 2000) of teacher models is trained on disjoint subsets of the sensitive data”) performing a differentially private generation algorithm on the third data subset; (Pg. 16 C Appendix: additional experiments on the UCI adult and Diabetes datasets section of Papernot states “We then use the noisy aggregation mechanism, where vote counts are perturbed with Laplacian noise of scale 0.05 to privately label the first 500 test set inputs.” Differentially private generation algorithm is done on subset of the data. Therefore, it could be just done on third data subset to accomplish performing algorithm.) and obtaining, from the differentially private generation algorithm, output comprising the modified dataset, wherein the modified dataset comprises an unlabeled modified dataset. (Pg. 16 C Appendix: additional experiments on the UCI adult and Diabetes datasets section of Papernot states “We train the student random forest on these 500 test set inputs and evaluate it on the last 11,282 test set inputs for the Adult dataset, and 6,352 test set inputs for the Diabetes dataset. These numbers deliberately leave out some of the test set, which allowed us to observe how the student performance-privacy trade-off was impacted by varying the number of private labels, as well as the Laplacian scale used when computing these labels.”) Claim 11 recites substantially similar subject matter as claim 1 respectively, and is rejected with the same rationale, mutatis mutandis . Regarding claims 12 – 14 , the rejection of claim 11 is incorporated herein. Claims 12 – 14 recite substantially similar subject matter as claims 2, 5, 4 respectively, and are rejected with the same rationale, mutatis mutandis . Regarding claim 19 , the rejection of claim 11 is incorporated herein. Claim 19 recites substantially similar subject matter as claim 10 respectively, and is rejected with the same rationale, mutatis mutandis . Regarding claim 20 , the rejection of claim 11 is incorporated herein. Furthermore, the combination of Papernot and Sung teaches wherein the private dataset contains medical records of a plurality of individuals. (Pg. 16 C Appendix: additional experiments on the UCI adult and Diabetes datasets section of Papernot states “The UCI Diabetes dataset includes de-identified records of diabetic patients and corresponding hospital outcomes.”) Claim 23 recites substantially similar subject matter as claim 1 respectively, and is rejected with the same rationale, mutatis mutandis . 07-21-aia AIA Claim s 9, 18 are rejected under 35 U.S.C. 103 as being unpatentable over Papernot et al. (NPL: “Semi-supervised knowledge transfer for deep learning from private training data”) in view of Sung et al. (NPL: “Local Differential Privacy in the Medical Domain to Protect Sensitive Information: Algorithm Development and Real-World Validation”), further in view of Jordan et al. (NPL:“PATE-GAN: generating synthetic data with differential privacy guarantees”) . Regarding Claim 9 , the rejection of claim 1 is incorporated herein. The combination of Papernot and Sung does not explicitly teach determining that there is not a publicly available training dataset; and in response to determining that there is not a publicly available training dataset, generating the modified dataset, labeling the modified dataset, and training the publicly available student model using the labeled modified dataset. Jordan teaches that determining that there is not a publicly available training dataset; (Pg. 4 4 Proposed Method: PATE-GAN section of Jordan states “We replace the GAN discriminator with a PATE mechanism so that our discriminator is differentially private, but require the (differentiable) student version to allow back-propagation to the generator. We modify the implementation of the student, noting that the training paradigm presented in [25] is not appropriate for this setting due to the lack of publicly available data.” Pg. 5 4.2.2 Student-Discriminators section of Jordan states “In our setting, where the entire focus is on generating synthetic data because no data is publicly available, we must propose a novel methodology to train the student without public data.”) and in response to determining that there is not a publicly available training dataset, generating the modified dataset, labeling the modified dataset, and training the publicly available student model using the labeled modified dataset. (Pg. 5 4.2.2 Student-Discriminators section of Jordan states “We first note, that the student training paradigm described in [25] would involve training the student using data similar to that used to train the generator - i.e. by taking an equal number of samples from each and then labelling those using the standard PATEλ mechanism (where here “labelling” refers to assigning them a real/fake label - not the label y present in the data). We consider the implications of training the student on teacher-labelled generated samples only.”) It would have been obvious to one with ordinary skill in the art before the effective filing date of the invention to combine the teachings of Jordan with Papernot and Sung. Papernot teaches a PATE framework in which private teacher models trained on disjoint subsets of sensitive data label unlabeled input data through aggregated teacher predictions, and a student model is trained using the resulting labels. Sung teaches modifying original private data using local differential privacy, including bounded Laplacian perturbation, before the data is sent externally, while preserving utility for machine learning use. Jordan teaches that access to public data is often an unreasonable assumption in privacy preserving synthetic data and PATE based training, so recognizing the need for an alternative when a publicly available training dataset is unavailable. One with ordinary skill in the art would be motivated to incorporate the teachings of Jordan into the combination of Papernot and Sung so when public training data is determined to be not available, private data may be differentially modified and used for teacher labeling and student model training while preserving privacy. The combination of teachings from these references would have been predictable use of a known differential privacy data perturbation technique in a known privacy preserving teacher student learning framework to manage edge cases when public training data are unavailable. Regarding claims 18 , the rejection of claim 11 is incorporated herein. Claim 18 recites substantially similar subject matter as claim 9 respectively, and is rejected with the same rationale, mutatis mutandis . 07-21-aia AIA Claim 21 is rejected under 35 U.S.C. 103 as being unpatentable over Papernot et al. (NPL: “Semi-supervised knowledge transfer for deep learning from private training data”) in view of Sung et al. (NPL: “Local Differential Privacy in the Medical Domain to Protect Sensitive Information: Algorithm Development and Real-World Validation”), further in view of Cao et al. (U.S. Pub. 2022/0108213 A1) . Regarding Claim 21 , the rejection of claim 11 is incorporated herein. The combination of Papernot and Sung does not explicitly teach wherein the private dataset contains advertisement data associated with a plurality of advertisers. Cao teaches that wherein the private dataset contains advertisement data associated with a plurality of advertisers. ([0062] section of Cao states “In various embodiments, the private datasets 102A, 102B, and 102C include a variety of different data such as images, data objects, databases, source code, medical information, personal information, payment information, metadata, user data, personal identification information, user activity, network traffic, social media data, or any other information that an entity (e.g., data curators 110A, 110B, and 110C) attempts to control or limit access thereto.”) It would have been obvious to one with ordinary skill in the art before the effective filing date of the invention to combine the teachings of Cao with Papernot and Sung. Papernot teaches a PATE framework in which private teacher models trained on disjoint subsets of sensitive data label unlabeled input data through aggregated teacher predictions, and a student model is trained using the resulting labels. Sung teaches modifying original private data using local differential privacy, including bounded Laplacian perturbation, before the data is sent externally, while preserving utility for machine learning use. Cao teaches applying privacy preserving techniques in the context of advertisement related data. One with ordinary skill in the art would be motivated to incorporate the teachings of Cao into the combination of Papernot and Sung so that advertisement data associated with advertisers could be used for machine learning training while protecting private information. The combination of teachings from these references would have been predictable use of a known differential privacy data perturbation technique in a known privacy preserving teacher student learning framework in a field of dealing with advertisement data. Conclusion 07-40 AIA Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL . See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to BYUNGKWON HAN whose telephone number is (571)272-5294. The examiner can normally be reached M-F: 9:00AM-6PM PST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Li B Zhen can be reached at (571)272-3768. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /BYUNGKWON HAN/ Examiner, Art Unit 2121 /Li B. Zhen/ Supervisory Patent Examiner, Art Unit 2121 Application/Control Number: 18/013,328 Page 2 Art Unit: 2121 Application/Control Number: 18/013,328 Page 3 Art Unit: 2121 Application/Control Number: 18/013,328 Page 4 Art Unit: 2121 Application/Control Number: 18/013,328 Page 5 Art Unit: 2121 Application/Control Number: 18/013,328 Page 6 Art Unit: 2121 Application/Control Number: 18/013,328 Page 7 Art Unit: 2121 Application/Control Number: 18/013,328 Page 8 Art Unit: 2121 Application/Control Number: 18/013,328 Page 9 Art Unit: 2121 Application/Control Number: 18/013,328 Page 10 Art Unit: 2121 Application/Control Number: 18/013,328 Page 11 Art Unit: 2121 Application/Control Number: 18/013,328 Page 12 Art Unit: 2121 Application/Control Number: 18/013,328 Page 13 Art Unit: 2121 Application/Control Number: 18/013,328 Page 14 Art Unit: 2121 Application/Control Number: 18/013,328 Page 15 Art Unit: 2121 Application/Control Number: 18/013,328 Page 16 Art Unit: 2121 Application/Control Number: 18/013,328 Page 17 Art Unit: 2121 Application/Control Number: 18/013,328 Page 18 Art Unit: 2121 Application/Control Number: 18/013,328 Page 19 Art Unit: 2121 Application/Control Number: 18/013,328 Page 20 Art Unit: 2121 Application/Control Number: 18/013,328 Page 21 Art Unit: 2121 Application/Control Number: 18/013,328 Page 22 Art Unit: 2121 Application/Control Number: 18/013,328 Page 23 Art Unit: 2121 Application/Control Number: 18/013,328 Page 24 Art Unit: 2121 Application/Control Number: 18/013,328 Page 25 Art Unit: 2121 Application/Control Number: 18/013,328 Page 26 Art Unit: 2121 Application/Control Number: 18/013,328 Page 27 Art Unit: 2121 Application/Control Number: 18/013,328 Page 28 Art Unit: 2121
Prosecution Insights