Detailed Action
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1, and 3-19 are pending for examination. Claims 1, 4-5 are independent.
Response to Amendment
The office action is responsive to the amendments filed on 12/23/2025. As
directed by the amendments claims 1, and 4-5 are amended. Claim 2 is canceled. Claims 6-19 are new.
Response to Arguments
Applicant's arguments filed 12/23/2025 have been fully considered but they are not fully persuasive.
Applicant arguments regarding Objection to Specification:
Examiner response: Applicant’s arguments, see pages 6-8 of Remarks, filed 12/23/2025, with respect to Objection to Specification have been fully considered and are persuasive. The Objection to Specification has been withdrawn.
Applicant arguments regarding 35 U.S.C. § 101:
A. The Precedential Framework of Ex parte Desjardins
The Patent Trial and Appeal Board's precedential decision in Ex parte Desjardins, Appeal No. 2024-000567 (PTAB Sept. 26, 2025), established critical guidance for evaluating patent eligibility of claims involving computer-implemented inventions. Applicant respectfully submits that the amended claims are patent-eligible under the Desjardins framework for the following reasons.
Principle 1: Claims Reflecting Technical Improvements Are Patent-Eligible
Ex parte Desjardins holds that claims reflecting technical improvements to computer functionality or other technology are patent-eligible, even when they involve mathematical operations or data processing.
1. The Claims Address a Specific Technical Problem
The Specification identifies a concrete technical problem with conventional adversarial training methods. Specifically, the Specification states: […]
2. The Claims Provide a Specific Technical Solution
The claims recite a specific technical solution to this problem: using the eigenvector corresponding to the maximum eigenvalue of the Fisher information matrix as the initial value of noise in the loss function. The Specification explains: […]
3. The Claims Achieve a Technical Improvement
The Specification demonstrates concrete technical improvements resulting from the claimed invention: […]
Examiner response: Examiner respectfully disagrees, it is unclear how applicants claim relate to Desjardins. Desjardins describe a different invention and improvement and it is unclear how exactly applicant’s claims are similar. Applicants claims broadly describe a loss function for training/learning for a model, which is directed to an abstract idea without significantly more (See 101 rejection below). Example 47 from the “July 2024 Subject Matter Eligibility Examples” also describes generally training and applying a neural network.
Examiner respectfully disagrees, many of the features and details described by the recited specification paragraphs are not incorporated into the claims. MPEP 2106.04(d)(1) states the specification must describe the invention such that the improvement would be apparent to one of ordinary skill in the art. Conversely, if the specification explicitly sets forth an improvement but in a conclusory manner (i.e., a bare assertion of an improvement without the detail necessary to be apparent to a person of ordinary skill in the art), the examiner should not determine the claim improves technology. Second, if the specification sets forth an improvement in technology, the claim must be evaluated to ensure that the claim itself reflects the disclosed improvement.
Under broadest reasonable interpretation, the claims describe searching for a model parameter Θ that minimizes a loss function. This is directed toward mathematical calculations as detailed in the 35 USC 101 rejection below. Applicants claimed improvement is describing an improvement to an abstract idea and not to an improvement to a computer or technical field. MPEP 2106.05(a) says an improvement in the abstract idea itself is not an improvement in technology.
Applicant further argues:
Principle 3: Claims Should Not Be Evaluated at a High Level of Generality
Ex parte Desjardins cautions that examiners should not evaluate claims at an unduly high level of generality that obscures the specific technical features recited.
The Office Action's Characterization Is Overly General […]
The Office Action characterizes the claims as merely "describing a mathematical concept (i.e. mathematical calculation)." This characterization improperly abstracts away the specific technical features of the claims:
The claims do not merely recite "performing a mathematical calculation." Rather, they recite a specific machine learning training process with a particular initialization technique.
The claims recite "search for a model that minimizes a loss function". This is a specific optimization process in machine learning, and is not the mere recitation of abstract mathematics.
Further, the claims recite using "an eigenvector corresponding to a maximum eigenvalue in a Fisher information matrix" as "an initial value of noise to be added to the data in the loss function", This is a specific initialization technique for a specific purpose in the training process.
Proper Characterization of the Claims […]
Examiner response: Examiner respectfully disagrees, the claims broadly describe optimizing a loss function, which is describing a mathematical calculation. The “specific machine learning training process” stated by applicant is describing a loss function calculation.
Applicant further argues:
Principle 4: §§ 102, 103, and 112 Are the Proper Tools for Examination
Ex parte Desjardins emphasizes that§ 101 should not be used to reject claims that are otherwise novel and non-obvious, and that§§ 102, 103, and 112 are the proper statutory provisions for examining the substance of claimed inventions. […]
Examiner response: Examiner respectfully disagrees, the analysis for 35 USC 101 is separate from that regarding the § 102 rejection, and does not contribute to the 35 USC 101 rejection below.
Applicant further argues:
B. Step 2A Prong One: The Claims Are Not Directed to an Abstract Idea […]
The Claims Do Not Recite a Mathematical Concept Standing Alone The claims do not recite a mathematical formula or calculation in the abstract. Rather, they recite a specific machine learning training process that uses mathematical operations as part of a larger technical process. […]
C. Step 2A Prong Two: The Claims Are Integrated into a Practical Application […]
1. The Claims Apply the Alleged Exception with a Particular Machine
2. The Claims Effect a Transformation
3. The Claims Improve Computer Technology […]
D. Step 2B: The Claims Recite Significantly More […]
1. The Eigenvector Initialization Technique Is Not Well Understood, Routine, or Conventional
2. The Ordered Combination of Elements Provides an Inventive Concept
Examiner response: Examiner respectfully disagrees, the claims broadly describe optimizing a loss function, which is describing a mathematical calculation. The “specific machine learning training process” stated by applicant is describing a loss function calculation. It is unclear how applicants claim relate to the claims found in Enfish, LLC v. Microsoft Corp and McRO, Inc. v. Bandai Namco Games, which are describing different inventions and improvements.
Examiner respectfully disagrees, the learning device comprising processing circuitry is understood to be generic computer elements - See MPEP 2106.05(f). The learning device comprising processing circuitry merely describes using a computer as a tool to perform the abstract idea - see MPEP 2106.05(f). Applicants claimed improvement is describing an improvement to an abstract idea and not an improvement to a computer or technical field. MPEP 2106.05(a) says an improvement in the abstract idea itself is not an improvement in technology.
Examiner respectfully disagrees, the Eigenvector Initialization Technique was not addressed in the 35 USC 101 rejection as being well understood, routine and conventional. Instead, the limitation describing acquiring data was addressed as directed to transmitting or receiving information, which is understood to be insignificant extra-solution activity and is well understood, routine and conventional activity of transmitting and receiving data as identified by the court (MPEP2106.05(d)(ll)(i))).
Examiner respectfully disagrees, the claim limitations are a combination of mental steps and math under step 2A Prong 1, and additional elements under steps 2A Prong 2 & 2B as detailed in the 101 rejection below.
Applicant arguments regarding 35 U.S.C. § 102:
The Office Action at page 7 states the following:
"[Section 3.1, Section 3.2, and equations 2-4] describes a loss function for learning that uses an eigenvector corresponding to a maximum eigenvalue (i.e. Amax) in a Fisher information matrix G. Examiner interprets the loss function as being used to train (i.e. learn) a model that represents the probability distribution p(ylx)." Applicant respectfully disagrees. This mapping conflates Shen's attack method with the claimed training method. In particular:
1. Shen' s Sections 3.1 and Equations 2-4 describe the OSSA attack, not model training.
2. Shen's defensive training (Section 3.2) uses the trace, not the eigenvector.
3. Shen explicitly identifies problems with using the eigenvector directly and teaches away from this approach.” […]
Examiner response: Examiner respectfully disagrees, firstly section 3.1 states “The starting work of our defensive scheme is [6]. Its basic idea can be summarized as follows.[…]” which is describing a defensive scheme and training with loss function J.
Secondly, the paper further describes using traces when evaluating loss, but still discloses a loss function calculating with the largest eigenvalue corresponding to an eigenvector in previous sections.
Thirdly, further teaching loss with trace does not exclude the previous teachings of a loss function calculated with a largest eigenvalue corresponding to an eigenvector. 35 U.S.C. § 102 does not exclude a reference because it further teaches away from limitations being taught. Although Shen further describes a loss function using traces, Shen still teaches calculating loss with a largest eigenvalue corresponding to an eigenvector and therefore continues to disclose the claims.
Lastly, applicants claim broadly describe a loss function without any specific formula or specific steps. Under broadest reasonable interpretation, [Sections 3.1-3.2 and equations 1-3], Shen describes a largest eigenvalue of the FIM (i.e. maximum eigenvalue in a Fisher information matrix) and loss function J(y, x+η). Where, x+η in the loss function discloses initial noise (i.e. η) added to the data (i.e. x) in the loss function (i.e. J).)
Applicant's arguments fail to comply with 37 CFR 1.111(b) because they amount to a general allegation that the claims define a patentable invention without specifically pointing out how the language of the claims patentably distinguishes them from the references.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, and 3 -19 rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1
According to the first part of the analysis, in the instant case, claims 1, 3, and 6-19 are directed to a device, claims 4 are directed to a method, and claim 5 is directed to a non-transitory computer-readable recording medium. Thus, each of the claims falls within one of the four statutory categories (i.e., process, machine, manufacture, or composition of matter).
Regarding Claim 1:
2A Prong 1:
search for a model that minimizes a loss function, wherein an eigenvector corresponding to a maximum eigenvalue in a Fisher information matrix for the data in the model is used as an initial value of noise to be added to the data in the loss function; (This step is reciting a mathematical concept (i.e. mathematical calculation) as further specified in Para 0024-0027, 0030-0035, and equation 4-5 of applicant’s specification.) and
learn the model, wherein the model represents a probability distribution of the label of the acquired data. (This step is reciting a mathematical concept (i.e. mathematical calculation) as further specified in Para 0017-0027, 0030-0035, and equation 1-5 of applicant’s specification.)
2A Prong 2: This judicial exception is not integrated into a practical application.
Additional elements:
A learning device, comprising: processing circuitry configured to: (The learning device comprising processing circuitry is understood to be generic computer elements - See MPEP 2106.05(f).)
acquire data with a label to be predicted; (This step is directed to receiving information, which is understood to be insignificant extra-solution activity and data gathering. See MPEP 2106.05(g).)
The additional elements as disclosed above alone or in combination do not integrate the judicial exception into practical application as they are insignificant extra solution activity in combination of generic computer functions that are implemented to perform the disclosed abstract idea above.
2B: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
Additional elements:
A learning device, comprising: processing circuitry configured to: (The learning device comprising processing circuitry is understood to be generic computer elements - See MPEP 2106.05(f).)
acquire data with a label to be predicted; (This step is directed to transmitting or receiving information, which is understood to be insignificant extra-solution activity and is well understood, routine and conventional activity of transmitting and receiving data as identified by the court (MPEP2106.05(d)(ll)(i))))
The additional elements as disclosed above in combination of the abstract idea
are not sufficient to amount to significantly more than the judicial exception as they are
well, understood, routine and conventional activity as disclosed in combination
of generic computer functions that are implemented to perform the disclosed abstract idea above.
Regarding Claim 3
2A Prong 1:
predict the label of the acquired data (This step for predicting a label is practically performable in the human mind and is understood to be a recitation of a mental process (i.e., judgment).)
2A Prong 2 & 2B:
The learning device according to claim 1, wherein the processing circuitry is further configured to (The learning device comprising processing circuitry is understood to be a generic computer element - See MPEP 2106.05(f).)
using the learned model (This step is adding the words “apply it” (or an equivalent) with the judicial exception, or merely applying a generic learning model as a tool to perform the abstract idea (i.e., predicting) - see MPEP 2106.05(f).)
Regarding Claim 4: see the rejection of claim 1 above. Same rationale applies.
2A Prong 2 & 2B: The claim recites another additional element “A learning method executed by a learning device comprising:” (The learning device is understood to be mere instructions to apply the exception using a generic computer component - see MPEP 2106.05(f))
Regarding Claim 5: see the rejection of claim 1 above. Same rationale applies.
2A Prong 2 & 2B: The claim recites another additional element “A non-transitory computer-readable recording medium storing executable instructions which, when executed by a computer, cause the computer to execute a learning process comprising:” (mere instructions to apply the exception using a generic computer component - see MPEP 2106.05(f))
Regarding Claim 6
2A Prong 1:
wherein the processing circuitry is further configured to search for a parameter Θ of the model that minimizes the loss function. (This step is understood to be a recitation of a mental process (i.e., evaluation) or mathematical calculations.)
2A Prong 2 & 2B: The claim does not recite any additional elements.
Regarding Claim 7
2A Prong 1:
wherein the loss function includes a first term representing a loss function for ordinary data and a second term representing a loss function for an adversarial example. (This step is understood to be a recitation of mathematical relationships/calculations.)
2A Prong 2 & 2B: The claim does not recite any additional elements.
Regarding Claim 8
2A Prong 1:
wherein the second term includes a Kullback-Leibler divergence between a probability distribution for the data and a probability distribution for the data with noise added. (This step is understood to be a recitation of mathematical relationships/calculations.)
2A Prong 2 & 2B: The claim does not recite any additional elements.
Regarding Claim 9
2A Prong 1:
wherein the second term is weighted by a constant β. (This step is understood to be a recitation of mathematical relationships/calculations.)
2A Prong 2 & 2B: The claim does not recite any additional elements.
Regarding Claim 10
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2 & 2B:
wherein the model is robust to adversarial examples. (The specification of data to be stored is understood to be a field of use limitation. The limitation further specifies the model - See MPEP 2106.05(h).)
Regarding Claim 11
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2 & 2B:
wherein the processing circuitry is further configured to withstand a blind spot attack using the learned model. (This step is adding the words “apply it” (or an equivalent) with the judicial exception, or merely applying a generic learning model as a tool to perform the abstract idea (e.g., predicting) - see MPEP 2106.05(f).)
Regarding Claim 12
2A Prong 1:
wherein the processing circuitry is further configured to calculate a probability of each label of the acquired data by applying a learned parameter Θ to the model and output the label with the highest probability. (This step is understood to be a recitation of a mental process (i.e., evaluation) or mathematical calculations.)
2A Prong 2 & 2B: The claim does not recite any additional elements.
Regarding Claim 13
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2:
wherein the processing circuitry is further configured to output a correct label for the acquired data when the acquired data is an adversarial example. (This step is directed to transmitting or receiving information, which is understood to be insignificant extra-solution activity and data gathering. See MPEP 2106.05(g).)
2B:
wherein the processing circuitry is further configured to output a correct label for the acquired data when the acquired data is an adversarial example. (This step is directed to transmitting or receiving information, which is understood to be insignificant extra-solution activity and is well understood, routine and conventional activity of transmitting and receiving data as identified by the court (MPEP2106.05(d)(ll)(i))))
Regarding Claim 14
2A Prong 1:
wherein the loss function is transformable using the Fisher information matrix G and an eigen value λ of the Fisher information matrix G such that the loss function includes a term
β
λ
η
2
, where β is a constant and η is the noise. (This step is understood to be a recitation of mathematical relationships/calculations.)
2A Prong 2 & 2B: The claim does not recite any additional elements.
Regarding Claim 15
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2 & 2B:
wherein the data includes image data. (The specification of data to be stored is understood to be a field of use limitation. The limitation further specifies the data - See MPEP 2106.05(h).)
Regarding Claim 16
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2 & 2B:
wherein the model includes a deep learning model. (The specification of data to be stored is understood to be a field of use limitation. The limitation further specifies the model - See MPEP 2106.05(h).)
Regarding Claim 17
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2:
wherein the processing circuitry is further configured to store a parameter of the learned model in a memory. (This step directed to storing information, is understood to be insignificant extra- solution activity and data gathering. See MPEP 2106.05(g).)
2B:
wherein the processing circuitry is further configured to store a parameter of the learned model in a memory. (This step is directed to storing information, which is understood to be insignificant extra-solution activity and is well understood, routine and conventional activity as identified by the court (MPEP 2106.05(d)(ll)(IV)))))
Regarding Claim 18
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2 & 2B:
wherein the learned model is configured to correctly predict a label for data including malicious noise loaded therein. (This step is adding the words “apply it” (or an equivalent) with the judicial exception, or merely applying a generic learning model as a tool to perform the abstract idea (e.g., predicting) - see MPEP 2106.05(f).)
Regarding Claim 19
2A Prong 1: The claim does not recite any Abstract idea.
2A Prong 2 & 2B:
wherein the processing circuitry is further configured to use the learned model as a countermeasure against an adversarial attack. (This step is adding the words “apply it” (or an equivalent) with the judicial exception, or merely applying a generic learning model as a tool to perform the abstract idea (e.g., predicting) - see MPEP 2106.05(f).)
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1, 3-10, 12-16, and 18-19 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Shen et al. (Defending Against Adversarial Attacks By Suppressing The Largest Eigenvalue Of Fisher Information Matrix, hereinafter "Shen").
Regarding Claim 1
Shen discloses: A learning device, comprising: processing circuitry configured to: ([Section 4 Experiments and Conclusion] disclose executing deep neural networks which require some form of processing circuitry to execute.)
acquire data with a label to be predicted ([Page 3 section Adversarial defenses point 1, Section 3.1, and Section 4.2] describes receiving an image as input data x. [Section 3.1] states “Denote the probability that x belongs to the i-th class by p(yi|x), […] The classification label i is determined by i = argmax j pj(x).”); and
search for a model that minimizes a loss function ([Section 3.1, Section 3.2, Section 5, and equations 1-3] discloses searching for optimal parameters for a model based on minimizing a loss function (i.e.
"
θ
*
=
a
r
g
m
i
n
L
~
(
θ
)
”. Section 3.1 also discloses loss function J.), wherein an eigenvector corresponding to a maximum eigenvalue in a Fisher information matrix for the data in the model is used as an initial value of noise to be added to the data in the loss function ([Section 3.1-3.2 and equations 1-3] describes a largest eigenvalue of the FIM (i.e. maximum eigenvalue in a Fisher information matrix) and loss function J(y, x+η). Examiner notes that x+η in the loss function discloses initial noise (i.e. η) added to the data (i.e. x) in the loss function (i.e. J).); and
learn the model, wherein the model represents a probability distribution of the label of the acquired data. ([Section 3.1-3.2, Section 5, and equations 1-3] discloses learning the model with a loss function wherein the model (i.e. p(y|x)) represents a probability distribution of the label of the acquired data. [Section 3.1] states “Denote the probability that x belongs to the i-th class by p(yi|x), […] The classification label i is determined by i = argmax j pj(x).”)
Regarding Claim 3
Shen discloses: The learning device according to claim 1, wherein the processing circuitry is further configured to predict the label of the acquired data using the learned model. ([Sections 1-4 Fig 1] disclose execution of classification using a
deep neural network. Examiner interprets the DNN as predicting a label.)
Regarding Claim 4
Shen discloses: A learning method executed by a learning device, the learning method ([Section 4 Experiments and Conclusion] disclose executing deep neural networks which require some form of processing circuitry to execute (e.g. learning device).) comprising: (Claim 4 is a method claim that corresponds to claim 1 and the rest of the limitations are rejected on the same ground)
Regarding Claim 5
Shen discloses: A non-transitory computer-readable recording medium storing executable instructions which, when executed by a computer, cause the computer to execute a learning process ([Section 4 Experiments and Conclusion] disclose executing deep neural networks which require some form of processing circuitry to execute (e.g. computer).) comprising: (Claim 5 is a non-transitory computer-readable recording medium claim that corresponds to claim 1 and the rest of the limitations are rejected on the same ground)
Regarding Claim 6
Shen discloses: The learning device according to claim 1,wherein the processing circuitry is further configured to search for a parameter Θ of the model that minimizes the loss function. ([Section 3.1, Section 3.2, and equations 1-3] discloses searching for optimal parameters for a model based on minimizing a loss function (i.e.
"
θ
*
=
a
r
g
m
i
n
L
~
(
θ
)
”. Section 3.1 also discloses loss function J.)
Regarding Claim 7
Shen discloses: The learning device according to claim 1,wherein the loss function includes a first term representing a loss function for ordinary data and a second term representing a loss function for an adversarial example. ([Section 3.1, Section 3.2, and equations 1-3] describes a loss function L(Θ)+µ·λmax(Gx), with L(Θ) as a loss function of the original network (i.e. first term) and µ·λmax(Gx) (i.e. second term).)
Regarding Claim 8
Shen discloses: The learning device according to claim 7, wherein the second term includes a Kullback-Leibler divergence between a probability distribution for the data and a probability distribution for the data with noise added. ([Section 3.1, Section 3.2, and equations 1-3] describes the second term of Gx may cause larger difference of KL divergence.)
Regarding Claim 9
Shen discloses: The learning device according to claim 7, wherein the second term is weighted by a constant β. ([Section 3.1, Section 3.2, Section 4.1, and equations 1-3] describes the second term weighted by µ.)
Regarding Claim 10
Shen discloses: The learning device according to claim 1, wherein the model is robust to adversarial examples. ([Abstract, Sections 3.1-3.2, and Conclusion] describes using a neural network for defending against adversarial attacks.)
Regarding Claim 12
Shen discloses: The learning device according to claim 3,wherein the processing circuitry is further configured to calculate a probability of each label of the acquired data by applying a learned parameter Θ to the model and output the label with the highest probability. ([Page 3 section Adversarial defenses point 1, and Sections 3.1-3.2] describes receiving an image as input data x. [Section 3.1] states “Denote the probability that x belongs to the i-th class by p(yi|x), […] The classification label i is determined by i = argmax j pj(x).” Sections 3.1-3.2 and page 6 further describe optimal parameters Θ. )
Regarding Claim 13
Shen discloses: The learning device according to claim 3, wherein the processing circuitry is further configured to output a correct label for the acquired data when the acquired data is an adversarial example. ([Sections 3.1-3.2, and Conclusion] describes probability that x belongs to a class with adversarial example or noise added.)
Regarding Claim 14
Shen discloses: The learning device according to claim 1, wherein the loss function is transformable using the Fisher information matrix G and an eigen value λ of the Fisher information matrix G such that the loss function includes a term
β
λ
η
2
, where β is a constant and η is the noise. ([Section 3.1, Section 3.2, Section 4.1, and equations 1-3] describes a loss function L(Θ)+µ·λmax(Gx), using Fisher information matrix G constant µ, and an eigen value λ, where s.t. ||η||22 =ε .)
Regarding Claim 15
Shen discloses: The learning device according to claim 1, wherein the data includes image data. ([Page 3 section Adversarial defenses point 1, Section 3.1, and Section 4.2] describes receiving an image as input data x.)
Regarding Claim 16
Shen discloses: The learning device according to claim 1, wherein the model includes a deep learning model. ([Abstract, Sections 3.1-3.2, Section 4 Experiments, and Conclusion] disclose a deep neural network (DNN).)
Regarding Claim 18
Shen discloses: The learning device according to claim 1, wherein the learned model is configured to correctly predict a label for data including malicious noise loaded therein. ([Abstract, Sections 3.1-3.2, and Conclusion] describes using a neural network for predicting a label for data including noise (i.e. x +η).)
Regarding Claim 19
Shen discloses: The learning device according to claim 1, wherein the processing circuitry is further configured to use the learned model as a countermeasure against an adversarial attack. ([Abstract, Sections 3.1-3.2, and Conclusion] disclose using a neural network for defending against adversarial attacks.)
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shen in view of Joaristi ("RIBS: Risky Blind-Spots for Attack Classification Model", hereinafter "Joaristi").
Regarding Claim 11
Shen discloses: The learning device according to claim 1,
Shen does not explicitly disclose: wherein the processing circuitry is further configured to withstand a blind spot attack using the learned model.
However, Joaristi discloses in the same field of endeavor: wherein the processing circuitry is further configured to withstand a blind spot attack using the learned model. ([Abstract, Section 4, and Section 6] describes mitigating the problem of blind-spots on classifiers.)
It would have been obvious to a person of ordinary skill in art before the effective filling date of the invention to implement the function of Blind Spot Attacks disclosed by Joaristi into the method of Defending Adversarial Attacks disclosed by Shen to withstand blind spot attacks. The modification would have been obvious because one of the ordinary skills of the art would be motivated to utilize the feature of Blind Spot Attacks disclosed by Joaristi as all the references are in the field of machine learning. A person of ordinary skill of the art would have been motivated to perform the combination for being able to reduce blind-spots and make classifications more robust.
Claim(s) 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shen in view of Tao et al. (US 12033370 B2, hereinafter "Tao").
Regarding Claim 17
Shen discloses: The learning device according to claim 1,
Shen does not explicitly disclose: wherein the processing circuitry is further configured to store a parameter of the learned model in a memory.
However, Tao discloses in the same field of endeavor: wherein the processing circuitry is further configured to store a parameter of the learned model in a memory. ([Col 2 lines 40-55 and Fig 1] describes storage unit 20A (i.e. memory) stores parameters of a learning model.)
It would have been obvious to a person of ordinary skill in art before the effective filling date of the invention to implement the Learning Device disclosed by Tao into the method of Defending Adversarial Attacks disclosed by Shen to store model parameters in memory. The modification would have been obvious because one of the ordinary skills of the art would be motivated to utilize the feature of Learning Device disclosed by Tao as all the references are in the field of machine learning. A person of ordinary skill of the art would have been motivated to perform the combination for being able to track and access model parameters during model training.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Ishii (US 20200193285 A1) describes training with adversarial features.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TEWODROS E MENGISTU whose telephone number is (571)270-7714. The examiner can normally be reached Mon-Fri 9:30-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ABDULLAH KAWSAR can be reached at (571)270-3169. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TEWODROS E MENGISTU/ Examiner, Art Unit 2127