DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 09/15/2026 has been entered. Claims 1-10 are pending. Claim 2 is currently amended.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claim 1 and 7 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1 and 6, respectively, of copending Application No. 18/005,924 (reference application). Although the claims at issue are not identical, they are not patentably distinct from each other because the claims 1 and 6 of copending Application No. 18/005,924 teach every limitation of claims 1 and 7, respectively, of the instant application.
This is a provisional nonstatutory double patenting rejection because the patentably indistinct claims have not in fact been patented.
Claims 1, 3, 7 and 8 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 3, 6 and 8, respectively, of copending Application No. 18/040,536 (reference application). Although the claims at issue are not identical, they are not patentably distinct from each other because 1, 3, 6 and 8 of copending Application No. 18/040,536 teach every limitation of claims 1, 3, 7 and 8, respectively, of the instant application.
This is a provisional nonstatutory double patenting rejection because the patentably indistinct claims have not in fact been patented.
Claims (1-2), 3, 4, 5, 6 and 7-10 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1, 2, 3, 4, 5 and 7-10, respectively, of copending Application No. 18/260,820 (reference application). Although the claims at issue are not identical, they are not patentably distinct from each other because claims 1, 2, 3, 4, 5 and 7-10 of copending Application No. 18/260,820 teach every limitation of claims (1-2), 3, 4, 5, 6 and 7-10, respectively, of the instant application.
This is a provisional nonstatutory double patenting rejection because the patentably indistinct claims have not in fact been patented.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-3 and 7-8 are rejected under 35 U.S.C. 103 as being unpatentable over Stockdale et al. (Stockdale), US Patent Application Publication No. US 2019/0260784 A1, and further in view of Lee et al. (Lee), US Patent Application Publication No. US 2019/0095629 A1.
As to independent claim 1, Stockdale discloses an artificial intelligence (AI) system (paragraph [0027]: the cyber threat defense system may use artificial intelligence (AI) to analyze cyber security threats), comprising:
an input interface configured to receive input from at least one user (paragraph [0006]: a user interface module present to a system user the input data with the privacy alias substituted for that data value in that field);
at least one processor configured to:
process the received input with an AI module and generate first output data corresponding to the received input, the AI module configured to process the received input by executing a first model (paragraph [0138]: the cyber threat defense system can use an autonomous response module configured to select an autonomous response to take in response to the cyber threat, and the autonomous response module can send an alert of the cyber threat with a suggested response to the cyber threat to an internal system administrator; paragraph [0029]: the cyber threat defense system may include components such as artificial intelligence model trained on potential cyber threats);
detect an attack vector on the AI module based on the received input using a submodule, the submodule including the first model and a second model (paragraph [0041]: one or more machine learning models may also be trained by observing vectors for malicious activity, such as network activity or emails; paragraph [0029]: the cyber threat defense system may include components such as a second artificial intelligence model);
calculate an information gain (paragraph [0062]: the cyber threat module may analyze the input data from any probes at a network entity to identify any cyber threats, and the cyber threat module may generate a threat risk parameter listing a set of values describing aspects of a potential cyber threat; paragraph [0061]: the autonomous response module, rather than a human taking an action, can be configured to cause one or more rapid autonomous actions to be taken to contain the cyber threat when the threat risk parameter from the cyber threat module is equal to or above an actionable threshold);
block the at least one user depending on the information gain (paragraph [0138]: the cyber threat defense system can use an autonomous response module configured to select an autonomous response to take in response to the cyber threat, wherein the autonomous response can be, for example, reducing permissions of the network entity or disabling a user account of the network entity);
transmit a notification to an owner of the AI system in response to detecting the attack vector (paragraph [0138]: the autonomous response module can send an alert of the cyber threat with a suggested response to the cyber threat to an internal system administrator); and
an output interface configured to send an output to the at least one user (paragraph [0080]: the user interface and output module may also project the individual alerts and/or events forming the chain of behavior onto the user interface).
Stockdale discloses detect an attack vector and calculate an information gain as shown above. Stockdale, however, does not disclose detect an attack vector for a model stealing attack and calculate an information gain based on the received input.
In the same field of endeavor, Lee discloses end users may utilize the APIs provided by the service provider to submit sets of input data to acquire enough output data to replicate the training of the neural network of the cognitive system such that the end user is able to generate their own trained neural network (paragraph [0021]). Lee further discloses if the end user is utilizing the service provider’s web service to label a set of input data based on a classification operation performed on the input data, after submitting enough input data sets, e.g., 10,000 input data sets (information gain) and obtaining the corresponding output labels, which may be used as a “golden” set or ground truth for training the end user’s own neural network to perform a similar classification operation, and this is referred to herein as a model stealing attack in that end user, referred to as an attacker (paragraph [0021]).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the system of Stockdale to include detect an attack vector for a model stealing attack and calculate an information gain based on the received input, as taught by Lee. Lee suggests that a model stealing attack in that an end user/attacker motivated to create the trained neural network surreptitiously, attempts to steal the neural network model created and trained by the service provider through utilization of the service provider’s APIs.
As to dependent claim 2, Stockdale does not disclose but Lee disclose wherein the processor is further configured to, depending on the information gain, modify the first output data generated by the AI module (Lee, paragraphs [0022], [0024]: any noise may be added to the activation function of the model or neural network to thereby cause ambiguity in the output that will fool a model stealing attacker).
As to dependent claim 3, Stockdale discloses wherein the output sent by the output interface comprises the first output data when the submodule doesn’t identify an attack vector from the received input (paragraph [0054]: the permission module determines a privacy status of the data field by comparing the privacy level of the data field to a permission threshold on a user-by-user basis. The permission level of each system user is configurable to be set on the graphical user interface of the cyber threat appliance. The permission module can reduce the privacy level, when appropriate, by changing the privacy status from, for example, anonymous to public. For example, when the permission module determines that this system user is a system administrator – the highest level of permission, then the privacy status will change from anonymous to public).
As to independent claim 7, Stockdale discloses a method to prevent capturing of an AI module in an AI system (paragraph [0083]: computer 1 on the first computer system has the threat detection system and therefore runs the threat detection method for detecting threats to the first computer system), comprising:
receiving input data from at least one user through an input interface (paragraph [0006]: an aliasing module applies an alias transform to one or more data values in the set of data fields with a privacy alias to anonymize that data value in that data field based on the privacy status…manually entered by a system administrator in the graphical user interface);
computing first output data using the AI module executing a first model based on the received input data (paragraph [0062]: the autonomous response module is configured to identify at least one autonomous response to take in response to the cyber threat based on the threat risk parameter. The autonomous response can be, for example, reducing permissions of the network entity or disabling a user account of the network entity. A communication module can send an alert of the cyber threat with a suggested response to the cyber threat to an internal system administrator); and
detecting an attack vector on the AI module based on the received input by processing received input data using a submodule, the submodule including the first model and a second module (paragraph [0041]: one or more machine learning models may also be trained by observing vectors for malicious activity, such as network activity or emails; paragraph [0029]: the cyber threat defense system may include components such as a second artificial intelligence model);
sending identification information of the attack vector to an gain module (paragraph [0028]: the cyber threat module determines a threat risk parameter that factors in “the likelihood that a chain of one or more unusual behaviors of email activity, network activity, and user activity under analysis fall outside of derived normal benign behavior; paragraph [0032]: a feedback loop of cooperation occurs between the gather module, the ingestion module monitoring network and email activity, the comparison module to apply one or more models trained on different aspects of this process, and the cyber threat module to identify cyber threats based on comparisons by the comparison module).
Stockdale discloses detect an attack vector and calculate an information gain as shown above. Stockdale, however, does not disclose detect an attack vector for a model stealing attack.
In the same field of endeavor, Lee discloses end users may utilize the APIs provided by the service provider to submit sets of input data to acquire enough output data to replicate the training of the neural network of the cognitive system such that the end user is able to generate their own trained neural network (paragraph [0021]). Lee further discloses if the end user is utilizing the service provider’s web service to label a set of input data based on a classification operation performed on the input data, after submitting enough input data sets, e.g., 10,000 input data sets (information gain) and obtaining the corresponding output labels, which may be used as a “golden” set or ground truth for training the end user’s own neural network to perform a similar classification operation, and this is referred to herein as a model stealing attack in that end user, referred to as an attacker (paragraph [0021]).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the system of Stockdale to include detect an attack vector for a model stealing attack, as taught by Lee. Lee suggests that a model stealing attack in that an end user/attacker motivated to create the trained neural network surreptitiously, attempts to steal the neural network model created and trained by the service provider through utilization of the service provider’s APIs.
As to dependent claim 8, Stockdale discloses wherein processing the detecting the attack vector further comprises: executing the first model and the second model to determine outputs; and determining the input data as an attack vector by comparing the outputs of the first model and the second module (paragraph [0029]: the cyber threat defense system may include components such as a comparison module, one or more machine-learning modules such as a first AI model trained on known data fields with identified privacy levels used in the network, a second AI model trained on known sensitive data fields and their data, a third AI model trained on potential cyber threats, and one or more AI models each trained on different users, devices, system activities and interactions between entities in the system, and other aspects of the system; paragraph [0037]: the comparison module is configured to execute a comparison of input data to at least one machine-learning model to spot behavior on the network deviating from a normal benign behavior of that network entity. At least one machine-learning model is trained on a normal benign behavior of a network entity. The machine-learning model uses a normal behavior benchmark describing parameters corresponding to a normal pattern of activity for that network entity. The comparison module can use the comparison to identify whether the network entity is in a breach state of the normal behavior benchmark. The cyber threat module can then determine, in accordance with the analyzed metrics and the moving benchmark of what is considered normal behavior, a cyber-threat risk parameter indicative of a likelihood of a cyber-threat).
Claims 4-6 and 9-10 are rejected under 35 U.S.C. 103 as being unpatentable over Stockdale and Lee as applied to claim 1-3 and 7-8 above, and further in view of Segev et a. (Segev), US Patent Application Publication No. US 2021/0073449 A1.
As to dependent claim 4, Stockdale, however, does not disclose wherein the first model comprises a first set of network parameters and hyper parameters.
In the same field of endeavor, Segev discloses in paragraph [0128] that a structure of the artificial neural network may be selected manually, a type of an artificial neuron of the artificial neural network may be selected manually, a parameter of the artificial neural network (such as a parameter of an artificial neuron of the artificial neural network) may be selected manually, and so forth. In some examples, an artificial neural network may be configured using a machine learning algorithm. For examiner, a user may select hyper-parameters for an artificial neural network and/or the machine learning algorithm.
Since both Stockdale and Segev are from the same field of endeavor as both are directed to AI/ML modeling, which is within the same field of endeavor as the claimed invention, it would have been obvious to one of ordinary skilled in the art, before the effective filing date of the claimed invention to modify and combine the teachings of Stockdale and Segev by incorporating teachings of Segev into Stockdale for providing improved modeling accuracy. The motivation to combine is to improve accuracy and classification of modeling aspects since this implementations offers improved analysis and performance due to the inherent data processing. This reasoning and rationale for combination is equally applicable to subsequent rejections relying on Stockdale and Segev.
As to dependent claim 5, Stockdale, however, does not disclose wherein the second model comprises a second set of network parameters and hyper parameters.
In the same field of endeavor, Segev discloses in paragraph [0128] that an artificial neural network may be created from two or more other artificial neural networks by combining the two or more other artificial neural networks into a single artificial neural network. For example, a structure of the artificial neural network may be selected manually, a type of an artificial neuron of the artificial neural network may be selected manually, a parameter of the artificial neural network (such as a parameter of an artificial neuron of the artificial neural network) may be selected manually, and so forth. In some examples, an artificial neural network may be configured using a machine learning algorithm. For examiner, a user may select hyper-parameters for an artificial neural network and/or the machine learning algorithm.
Since both Stockdale and Segev are from the same field of endeavor as both are directed to AI/ML modeling, which is within the same field of endeavor as the claimed invention, it would have been obvious to one of ordinary skilled in the art, before the effective filing date of the claimed invention to modify and combine the teachings of Stockdale and Segev by incorporating teachings of Segev into Stockdale for providing improved modeling accuracy. The motivation to combine is to improve accuracy and classification of modeling aspects since this implementations offers improved analysis and performance due to the inherent data processing. This reasoning and rationale for combination is equally applicable to subsequent rejections relying on Stockdale and Segev.
Claims 9 and 10 are method claims that contain similar limitations of claims 4 and 5, respectively. Therefore, claims 9-10 are rejected under the same rationale.
As to independent claim 6, Stockdale discloses a method of training a submodule in an artificial intelligence (AI) system to detect an attack vector on an AI module of the AI system, the AI module executing a first model, the submodule executing the first model and a second model, said submodule comprising a comparator configured to compare outputs of the first model and the second model (paragraph [0138]: the cyber threat defense system can use an autonomous response module configured to select an autonomous response to take in response to the cyber threat, and the autonomous response module can send an alert of the cyber threat with a suggested response to the cyber threat to an internal system administrator; paragraph [0029]: the cyber threat defense system may include components such as artificial intelligence model trained on potential cyber threats), a dataset used to train the AI module (paragraph [0006]: an ingestion module collects input data describing network activity executed by the network entity, a clustering module identifies data fields with data values within the input data from the ingestion module as data identifiable to a network entity using one or more machine-learning models trained on known data fields and their data), said submodule executing said first model and at least a second model (paragraph [0041]: one or more machine learning models may also be trained by observing vectors for malicious activity, such as network activity or emails; paragraph [0029]: the cyber threat defense system may include components such as a second artificial intelligence model), said submodule comprising a comparator configured to compare the output of at least two models (paragraph [0006]: a permission module determines a privacy status of each data field by comparing the privacy level to a permission threshold; paragraph [0032]: a comparison module applies one or more models trained on different aspects, and the cyber threat module identifies cyber threats based on comparisons by the comparison module), said method comprising:
receiving a training dataset (paragraph [0006]: an aliasing module applies an alias transform to one or more data values in the set of data fields with a privacy alias to anonymize that data value in that data field based on the privacy status…manually entered by a system administrator in the graphical user interface);
executing the first model and the second model in the submodule with the training dataset (paragraph [0029]: one or more machine-learning models such as a first Artificial Intelligence model trained on known data fields with identified privacy levels used in the network, a second Artificial Intelligence model trained on known sensitive data fields and their data, a third Artificial Intelligence model trained on potential cyber threats, and one or more Artificial Intelligence models each trained on different users, devices, system activities and interactions between entities in the system, and other aspects of the system);
recording behavior of the submodule (paragraphs [0127]-[0129]: detectors are discrete mathematical models that implement a specific mathematical method against different sets of variables with the target network, each detector is specialized to record and make decisions on different environmental factors based on the detectors own internal mathematical model such as a Hidden Markov Models (HMM). The data is in a form suitable for comparing with the model of normal behavior and for updating the model of normal behavior).
Stockdale discloses detect an attack vector and calculate an information gain as shown above. Stockdale, however, does not disclose detect an attack vector for a model stealing attack.
In the same field of endeavor, Lee discloses end users may utilize the APIs provided by the service provider to submit sets of input data to acquire enough output data to replicate the training of the neural network of the cognitive system such that the end user is able to generate their own trained neural network (paragraph [0021]). Lee further discloses if the end user is utilizing the service provider’s web service to label a set of input data based on a classification operation performed on the input data, after submitting enough input data sets, e.g., 10,000 input data sets (information gain) and obtaining the corresponding output labels, which may be used as a “golden” set or ground truth for training the end user’s own neural network to perform a similar classification operation, and this is referred to herein as a model stealing attack in that end user, referred to as an attacker (paragraph [0021]).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the system of Stockdale to include detect an attack vector for a model stealing attack, as taught by Lee. Lee suggests that a model stealing attack in that an end user/attacker motivated to create the trained neural network surreptitiously, attempts to steal the neural network model created and trained by the service provider through utilization of the service provider’s APIs.
Stockdale and Lee, however, do not disclose said first model comprising a first set of network parameters and hyper parameters, said second model comprising a second set of network parameters and hyper parameters.
In the same field of endeavor, Segev discloses in paragraph [0128] that an artificial neural network may be created from two or more other artificial neural networks by combining the two or more other artificial neural networks into a single artificial neural network. For example, a structure of the artificial neural network may be selected manually, a type of an artificial neuron of the artificial neural network may be selected manually, a parameter of the artificial neural network (such as a parameter of an artificial neuron of the artificial neural network) may be selected manually, and so forth. In some examples, an artificial neural network may be configured using a machine learning algorithm. For examiner, a user may select hyper-parameters for an artificial neural network and/or the machine learning algorithm.
Since both Stockdale, Lee and Segev are from the same field of endeavor as both are directed to AI/ML modeling, which is within the same field of endeavor as the claimed invention, it would have been obvious to one of ordinary skilled in the art, before the effective filing date of the claimed invention to modify and combine the teachings of Stockdale, Lee and Segev by incorporating teachings of Segev into the systems of Stockdale and Lee for providing improved modeling accuracy. The motivation to combine is to improve accuracy and classification of modeling aspects since this implementations offers improved analysis and performance due to the inherent data processing. This reasoning and rationale for combination is equally applicable to subsequent rejections relying on Stockdale and Segev.
Response to Arguments
In the Remarks, Applicant argues in substance that:
The proposed combination does not teach detecting an attack vector for a model stealing attack on the AI module.
In reply to this argument, Stockdale discloses in paragraph [0041]: one or more machine learning models may also be trained by observing vectors for malicious activity, such as network activity or emails; paragraph [0029]: the cyber threat defense system may include components such as a second artificial intelligence model. In the same field of endeavor, Lee discloses end users may utilize the APIs provided by the service provider to submit sets of input data to acquire enough output data to replicate the training of the neural network of the cognitive system such that the end user is able to generate their own trained neural network (paragraph [0021]). Lee further discloses if the end user is utilizing the service provider’s web service to label a set of input data based on a classification operation performed on the input data, after submitting enough input data sets, e.g., 10,000 input data sets (information gain) and obtaining the corresponding output labels, which may be used as a “golden” set or ground truth for training the end user’s own neural network to perform a similar classification operation, and this is referred to herein as a model stealing attack in that end user, referred to as an attacker (paragraph [0021]). The combination of Stockdale and Lee would give the result of “detecting an attack vector for a model stealing attack on the AI module”.
B) The proposed combination does not teach calculating an information gain.
In reply to this argument, Stockdale discloses calculate an information gain (paragraph [0062]: the cyber threat module may analyze the input data from any probes at a network entity to identify any cyber threats, and the cyber threat module may generate a threat risk parameter listing a set of values describing aspects of a potential cyber threat; paragraph [0061]: the autonomous response module, rather than a human taking an action, can be configured to cause one or more rapid autonomous actions to be taken to contain the cyber threat when the threat risk parameter from the cyber threat module is equal to or above an actionable threshold). In addition, Lee discloses end users may utilize the APIs provided by the service provider to submit sets of input data to acquire enough output data to replicate the training of the neural network of the cognitive system such that the end user is able to generate their own trained neural network (paragraph [0021]). Lee further discloses if the end user is utilizing the service provider’s web service to label a set of input data based on a classification operation performed on the input data, after submitting enough input data sets, e.g., 10,000 input data sets (information gain) and obtaining the corresponding output labels, which may be used as a “golden” set or ground truth for training the end user’s own neural network to perform a similar classification operation, and this is referred to herein as a model stealing attack in that end user, referred to as an attacker (paragraph [0021]).
Thus, the combination of Stockdale and Lee would give the result of “calculate an information gain based on the received input”.
C) The proposed combination fails to teach training a submodule to detect an attack vector for a model stealing attack on the AI module. This argument is similar to the argument A, which is already addressed above.
Conclusion
Any inquiry concerning this communication should be directed to CHAU T NGUYEN at telephone number (571)272-4092. The examiner can normally be reached on M-F from 8am to 5pm (PT).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/uspto-automated-interview-request-air-form.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Cesar Paula, can be reached at telephone number 5712724128. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/CHAU T NGUYEN/Primary Examiner, Art Unit 2145
Prosecution Insights