DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is in response to the amendment filed on 12/24/2025. Claims 1, 6, 7, 8 and 10 have been amended. Claims 1-10 are pending and have been examined.
Claim Objections
The objection to Claim 1 is WITHDRAWN in view of Applicant’s amendments.
Claim Rejections - 35 USC § 101
The 101 rejection of Claims 1-10 are WITHDRAWN in view of Applicant’s amendments and/or arguments.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-10 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Jia et al. “MemGuard: Defending against Black-Box Membership Inference Attacks via Adversarial Examples”, from applicant IDS, hereinafter “Jia”.
Regarding Claim 1, Jia teaches:
An inference apparatus comprising;
at least one memory storing instructions, and at least one processor configured to execute the instructions to (The method of MemGuard involves models being trained and used, demonstrating that Jia performs their method on a computer, in which processor, memory, and storage devices are inherent, p. 9, col. 1, ¶2, “We train 200 epochs with a learning rate 0.01”, p. 10, col. 1, ¶5, “The defender itself trains a classifier to perform membership inference”, p. 9, col. 2, Table 3 showing training and testing accuracies of target classifier);
perform inference based on input data using a first machine learning model trained using training data (target classifier is first machine learning model, p. 10, col. 2, ¶1, “The defender calculates the confidence score vector for each data sample in D1 and D3 using the target classifier”);
determine, using second machine learning model, whether input data is the training data or not based on inference data output from the first machine learning model indicating a result of inference when the input data is input to the first machine learning model (defense classifier is second machine learning model, p. 10, col. 2, ¶1, “The defender treats these confidence score vectors as a training dataset to learn a defense classifier, which takes a confidence score vector as an input and predicts member or non-member”); and
output, by the second machine learning model, the inference data as output data based on the second machine learning model determining that the input data is not the training data, and output, by the second machine learning model, an alternative data different from the inference data as the output data based on the second machine learning model determining that the input data is the training data (Alternative data is data plus noise vector, outputs alternative data or original data with probabilities p and 1-p meaning it outputs both during the scenario where the input data is the training data and when the input data is not the training data, p. 8, col. 1, ¶2, “the defender picks the representative noise vectors r and 0 with probabilities p and 1 −p, respectively; and the defender adds the picked representative noise vector to the true confidence score vector”, p. 4, col. 2, ¶4, “defender adds a noise vector to the confidence score vector before returning it to the user”).
Regarding Claim 2, Jia teaches the inference apparatus of Claim 1 as referenced above. Jia further teaches:
wherein the inference data is a score vector including a plurality of scores (p. 1, col. 2, ¶1, “confidence score vector is a probability distribution over the possible labels and the label of the query data sample is predicted as the one that has the largest confidence score”),
the alternative data is a score vector having the same number of dimensions as that of the inference data (p. 4, col. 2, ¶3, “adds a noise vector to the confidence score vector before returning it to the user… s ′ = s + n”, adding vectors does not change dimension),
an order of a component of a top score of the inference data is matched with that of the alternative data (Top score will be the same label for both vectors, p. 11, col. 1, ¶1, “defense is guaranteed to achieve 0 label loss as our Algorithm 1 guarantees that the predicted label does not change when searching for the representative noise vector”).
Regarding Claim 3, Jia teaches the inference apparatus of Claim 2 as referenced above. Jia further teaches:
wherein an order of magnitudes of the scores of the inference data is the same as that of the alternative data (p. 6, col. 2, Equation 6-10 show constraints of noise vector making inference data and alternative data have same magnitude, p. 7, col. 1, ¶1, “For any value of e, the noisy confidence score vector s + r is a probability distribution, i.e., the constraints in Equation 9 and Equation 10 are satisfied”).
Regarding Claim 4, Jia teaches the inference apparatus of Claim 2 as referenced above. Jia further teaches:
wherein an upper limit is set for the top score in the alternative data (p. 7, equation 14 shows noisy confidence vector top score is constrained to original vector z top score, alternative data is constrained to same top score to predict same label, p. 7, Algorithm 1 line 1 “Predicted label” line 2 “l= argmaxj{zj}”, upper limit is set for noisy confidence vector pre softmax).
Regarding Claim 5, Jia teaches the inference apparatus of Claim 1 as referenced above. Jia further teaches:
wherein components of the alternative data are obtained by random numbers (p. 6, col. 2, ¶3, “generate a random vector noise vector…. we first sample a number r ′ 1 from the interval [0,1] uniformly at random as the first entry. Then, we sample a number r ′ 2 from the interval [0, 1-r ′ 1 ] uniformly at random as the second entry. We repeat this process until the last entry is 1 minus the sum of the previous entries”).
Regarding Claim 6, Jia teaches the inference apparatus of Claim 1 as referenced above. Jia further teaches:
further comprising; a third machine learning model trained using non-member data different from the training data (defense classifier is third machine learning model, D3 dataset is non-member data different from training data, p. 10, col. 2, ¶1, “The confidence score vectors for data samples in D1 and D3 have labels “member” and “non-member”, respectively. The defender treats these confidence score vectors as a training dataset to learn a defense classifier, which takes a confidence score vector as an input and predicts member or non-member”).
Regarding Claim 7, Jia teaches the inference apparatus of Claim 1 as referenced above. Jia further teaches:
further comprising: a third machine learning model trained using the training data and non-member data different from the training data (defense classifier is third machine learning model, p. 10, col. 2, ¶1, “The confidence score vectors for data samples in D1 and D3 have labels “member” and “non-member”, respectively. The defender treats these confidence score vectors as a training dataset to learn a defense classifier, which takes a confidence score vector as an input and predicts member or non-member”).
Regarding Claim 8, Jia teaches:
An inference method comprising;
inputting input data to a first machine learning model trained using training data and performing inference by the first machine learning model to output inference data indicating a result of the inference(target classifier is first machine learning model, p. 10, col. 2, ¶1, “The defender calculates the confidence score vector for each data sample in D1 and D3 using the target classifier”);
determining, using a second machine learning model, whether input data is the training data or not based on inference data (defense classifier is second machine learning model, p. 10, col. 2, ¶1, “The defender treats these confidence score vectors as a training dataset to learn a defense classifier, which takes a confidence score vector as an input and predicts member or non-member”); and
outputting, by the second machine learning model, the inference data as output data based on determining that the input data is not the training data, and outputting an alternative data different from the inference data as the output data based on determining that the input data is the training data (Alternative data is data plus noise vector, outputs alternative data or original data with probabilities p and 1-p meaning it outputs both during the scenario where the input data is the training data and when the input data is not the training data, p. 8, col. 1, ¶2, “the defender picks the representative noise vectors r and 0 with probabilities p and 1 −p, respectively; and the defender adds the picked representative noise vector to the true confidence score vector”, p. 4, col. 2, ¶4, “defender adds a noise vector to the confidence score vector before returning it to the user”).
Regarding Claim 9, the rejection of 8 is incorporated and further, the claim is rejected for the same reasons as set forth in Claim 2.
Regarding Claim 10, Jia teaches:
A non-transitory computer-readable storage medium storing a program that causes a computer to execute an inference method:
the method comprising:
inputting input data to a first machine learning model trained using training data and performing inference by the first machine learning model to output inference data indicating a result of the inference (target classifier is first machine learning model, p. 10, col. 2, ¶1, “The defender calculates the confidence score vector for each data sample in D1 and D3 using the target classifier”);
determining, using a second machine learning model, whether input data is the training data or not based on inference data (defense classifier is second machine learning model, p. 10, col. 2, ¶1, “The defender treats these confidence score vectors as a training dataset to learn a defense classifier, which takes a confidence score vector as an input and predicts member or non-member”); and
outputting, by the second machine learning model, the inference data as output data based on determining that the input data is not the training data, and an alternative data different from the inference data as the output data based on determining that the input data is the training data (Alternative data is data plus noise vector, outputs alternative data or original data with probabilities p and 1-p meaning it outputs both during the scenario where the input data is the training data and when the input data is not the training data, p. 8, col. 1, ¶2, “the defender picks the representative noise vectors r and 0 with probabilities p and 1 −p, respectively; and the defender adds the picked representative noise vector to the true confidence score vector”, p. 4, col. 2, ¶4, “defender adds a noise vector to the confidence score vector before returning it to the user”).
Response to Arguments
35 U.S.C. 102
Argument 1: Jia adds the noise vector to the score vector even when the input data is not the training data and therefore fails to teach or suggest the output limitation of Claim 1.
Examiner Response: Examiner respectfully disagrees. The amended Claim 1 recites that outputting inference data is output data based on the second machine learning model determining that the input data is not the training data and outputting alternative data different from inference data as output data based on the machine learning model determining that the input data is the training data. Outputting inference data or alternative data is based on the determining whether input data is training data or not as shown by adding noise based on the decision function, p. 5, col. 2, ¶6, “Given the decision function g of the defense classifier, a confidence score distortion budget ϵ, a true confidence score vector s, the defender aims to find a randomized noise addition mechanism M∗ via solving the following optimization problem”.
Further, both inference data and alternative data are outputted for the two different membership scenarios because adding the noise vector is based on probability 1-p, p. 8, col. 1, ¶2, “the defender picks the representative noise vectors r and 0 with probabilities p and 1 −p, respectively”. This shows that the defender outputs both inference data and alternative data in the scenario where input data is both training data and not training data, and this inference data or alternative data output is based on what the machine learning model predicts as shown in how the randomized noise is generated. Therefore the claim language does not recite anything that would differ the claimed invention for Jia.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JESSE CHEN COULSON whose telephone number is (571)272-4716. The examiner can normally be reached Monday-Friday 8:30-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kakali Chaki can be reached at (571) 272-3719. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JESSE C COULSON/
Examiner, Art Unit 2122
/KAKALI CHAKI/Supervisory Patent Examiner, Art Unit 2122