DETAILED ACTION
Continued Examination Under 37 CFR 1.114
1. Continued Examination Under 37 CFR 1.114A request for continued examination under 37 CFR 1.114, including the fee set forth in37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicants’ submission filed on 5/11/2026 has been entered.
Remarks
2. Pending claims for consideration are claims 1, 3-5, 7-8, 11-12, 14-15, and 17-19, 21-27. Claims 1, 8, 15, and 22 have been amended. Claims 2, 6, 9-10,13,16 and 20 have been cancelled. Claims 25-27 are new.
Response to Arguments
3. Applicant's arguments filed 5/11/2026 have been fully considered but they are not persuasive.
In the remarks, applicant argues in substance:
That- Applicant submits LaFever fails to disclose " determining, by the computing device, whether the data element is a personally identifiable information (PII) data element by querying a PII metadata repository, wherein the PII metadata repository maintains PII data of an organization in a graph database capable of storing one or more data elements and one or more relationships between the one or more data elements " as called for in Applicant's claim 1.
In response to applicant’s arguments- The claims have been examined in their broadest most reasonable interpretation in light of the applicant’s specification. It is the combination of MEDALION, LaFever, and Mumcuyan that teaches the claimed language, neither MEDALION, LaFever, or Mumcuyan alone. As stated in the below office action LaFever teaches in FIG. 1 an example of a machine-learning based PII detection and removal system 100 in data communication with a data repository 120, [par.0050]) and a BiLSTM neural network models which are trained on labelled datasets including PII to identify the PII both directly and by context [par.0034])
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
4. Claims 1, 3-5, 7-8, 11-12, 14-15, and 17-19, 21-27 are rejected under 35 U.S.C. 103 as being unpatentable over Pub.No.: US 2021/0125615 A1 to MEDALION et al (hereafter referenced as Medalion) in view of Patent No.: US 10,043,035 B2 to LaFever et al (hereafter referenced as Lafever), in further view of Pub.No.: US 2021/0287069 A1 to Mumcuyan et al(hereafter referenced as Mumcuyan.
Regarding claim 1, Medalion discloses “a method comprising: receiving, by a computing device, a data access event, wherein the data access event relates to a data element (receiving output from the BILSTM Neural network model, the output indicating one or more text data elements [Fig.4/item 406]) ; “determining, by the computing device, whether the data element is a personally identifiable information (PII) data element by querying a PII metadata repository, wherein the PII metadata repository maintains PII data of an organization in a graph database capable of storing one or more data elements and one or more relationships between the one or more data elements (FIG. 1 depicts an example of a machine-learning based PII detection and removal system 100 in data communication with a data repository 120, [par.0050]) also see The BiLSTM neural network models described herein are trained on labelled datasets including PII to identify the PII both directly and by context [par.0034]) ; “responsive to a determination that the data element is a PII data element: predicting, by the computing device using a machine learning (ML) model”(PI detection and removal system [Fig.1/item 100]).
Medalion does not explicitly disclose “a PII protection policy appropriate for the PII data element, and applying, by the computing device, the PII protection policy to the PII data element to modify or alter the PII data element into an obfuscated state as specified by the applied PII protection policy to anonymize the PII data element; and returning, by the computing device, the data access event including the PII data element in the obfuscated state with the PII protection policy”
However, Lafever in an analogous art discloses “a PII protection policy appropriate for the PII data element” (policy engine Lafever[Fig.1r]); “and applying, by the computing device, the PII protection policy to the PII data element to modify or alter the PII data element into an obfuscated state (data and transmission is encrypted and obfuscated during transmission Lafever [Col.25/lines 48-50]) as specified by the applied PII protection policy to anonymize the PII data element;” In Step ( 2 ) , based at least in part on the determined DLDs , the data 30 elements may be dynamically anonymized by means of Disassociation Lafever[Col.54/lines 28-31]), “returning, by the computing device, the data access event including the PII data element in the obfuscated state with the PII protection policy applied”( Policy external to the system would determine which information may be relevant for different incidents and stages of incidents, as well as what level of obfuscation/transparency is appropriate at different times so not all information would be released at once and so that irrelevant but sensitive information would not be released without cause Lafever [Col.57/lines 4-10]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Medalion’s Machine learning based detection and removal of personally identifiable information with Lafever’s Policy enforcement utilizing PII in order to provide additional security. One of ordinary skill would have been motivated to combine because Medalion discloses a learning-based detection and removal of personally identifiable information, LaFever teaches a policy enforcement process utilizing obfuscation PII data and both are from the same field of endeavor.
Neither Medalion, Lafever explicitly discloses “wherein the ML model includes decision trees with each decision constructed using different multi-dimensional features extracted from different historical PII data elements.”
However, Mumcuyan in an analogous art discloses “wherein the ML model includes decision trees with each decision constructed using different multi-dimensional features extracted from different historical PII data elements” (Mumcuyan explains that different classifiers are trained using different subsets and dimensions of these features to improve classification accuracy and risk assessment Mumcuyan [par.0064-0072] also see (after collecting such a dataset with true / false positives , binary classifier model 320 is built using a Booster classifier , such as the CatBoost , that uses gradient boosting on decision trees Mumcuyan [par.0060]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Medalion’s Machine learning based detection and removal of personally identifiable information and LaFever’s Policy enforcement utilizing PII with Mumcuyan’s classifier model utilized in its machine learning system in order to provide additional security. One of ordinary skill would have been motivated to combine because Medalion discloses a learning-based detection and removal of personally identifiable information, LaFever teaches a policy enforcement process utilizing PII, Mumcuyan discloses a CatBoost classifier model utilized in its machine learning system and all are from the same field of endeavor.
Regarding claim 3 in view of claim 1, neither Medalion nor Lafever explicitly discloses “wherein the ML model includes a CatBoost classifier” (after collecting such a dataset with true / false positives , binary classifier model 320 is built using a Booster classifier , such as the CatBoost , that uses gradient boosting on decision trees Mumcuyan [par.0060]).
Regarding claim 4 in view of claim 1, the references combined disclose “wherein the ML model (machine learning model Medalion[Fig.1/item 108]) is trained with training data comprising historical PII protection data” (To generate even more training data , variations of PII redactions may be introduced Medalion[par.0044]).
Regarding claim 5 in view of claim 1, the references combined disclose “further comprising, responsive to a determination that the data element is not a PII data element, returning, by the computing device, the data access event” (unsupervised and supervised machine learning Medalion[par.0024-par.0025]).
Regarding claim 7 in view of claim 1, the references combined disclose “wherein the data access event is from another computing device” (i/o devices /interfaces Medalion[Fig.5/item 504]).
Regarding claim 8, Medalion discloses “a computing device comprising: one or more non-transitory machine-readable mediums configured to store instructions; and one or more processors configured to execute the instructions stored on the one or more non-transitory machine-readable mediums, wherein execution of the instructions causes the one or more processors to carry out a process comprising: receiving a data access event, wherein the data access event relates to a data element” (receiving output from the BILSTM Neural network model, the output indicating one or more text data elements [Fig.4/item 406]); determining whether the data element is a personally identifiable information (PII) data element by querying a PII metadata repository, wherein the PII metadata repository maintains PII data of an organization in a graph database capable of storing one or more data elements and one or more relationships between the one or more data elements;” (FIG. 1 depicts an example of a machine-learning based PII detection and removal system 100 in data communication with a data repository 120, [par.0050]) also see The BiLSTM neural network models described herein are trained on labelled datasets including PII to identify the PII both directly and by context [par.0034]) ;responsive to a determination that the data element is a PIT data element: predicting, using a machine learning (ML) model” (PI detection and removal system [Fig.1/item 100])
Medalion does not explicitly disclose “a PII protection policy appropriate for the PII data element; and applying the PII protection policy to the PII data element to modify or alter the PII data element into an obfuscated state as specified by the applied PII protection policy to anonymize the PII data element; and returning the data access event including the PII data element into an obfuscated state with the PII protection policy applied.”
However, Lafever in an analogous art discloses “a PII protection policy appropriate for the PII data element” (policy engine Lafever[Fig.1r]);; “and applying the PII protection policy to the PII data element to modify or alter the PII data element into an obfuscated state(data and transmission is encrypted and obfuscated during transmission Lafever [Col.25/lines 48-50]) as specified by the applied PII protection policy to anonymize the PII data element;” In Step ( 2 ) , based at least in part on the determined DLDs , the data 30 elements may be dynamically anonymized by means of Disassociation Lafever[Col.54/lines 28-31]), “and returning the data access event including the PII data element into an obfuscated state with the PII protection policy applied” ( Policy external to the system would determine which information may be relevant for different incidents and stages of incidents, as well as what level of obfuscation/transparency is appropriate at different times so not all information would be released at once and so that irrelevant but sensitive information would not be released without cause Lafever[Col.57/lines 4-10]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Medalion’s Machine learning based detection and removal of personally identifiable information with LaFever’s Policy enforcement utilizing PII in order to provide additional security. One of ordinary skill would have been motivated to combine because Medalion discloses a learning-based detection and removal of personally identifiable information, LaFever teaches a policy enforcement process utilizing obfuscation PII data and both are from the same field of endeavor.
Neither Medalion nor Lafever explicitly discloses “wherein the ML model includes decision trees with each decision constructed using different multi-dimensional features extracted from different historical PII data elements”
However, Mumcuyan in an analogous art discloses “wherein the ML model includes decision trees with each decision constructed using different multi-dimensional features extracted from different historical PII data elements” (Mumcuyan explains that different classifiers are trained using different subsets and dimensions of these features to improve classification accuracy and risk assessment Mumcuyan [par.0064-0072] also see (after collecting such a dataset with true / false positives , binary classifier model 320 is built using a Booster classifier , such as the CatBoost , that uses gradient boosting on decision trees Mumcuyan [par.0060]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Medalion’s Machine learning based detection and removal of personally identifiable information and LaFever’s Policy enforcement utilizing PII with Mumcuyan’s classifier model utilized in its machine learning system in order to provide additional security. One of ordinary skill would have been motivated to combine because Medalion discloses a learning-based detection and removal of personally identifiable information, LaFever teaches a policy enforcement process utilizing PII, Mumcuyan discloses a CatBoost classifier model utilized in its machine learning system and all are from the same field of endeavor.
Regarding claim 11 in view of claim 8, the reference combined disclose “wherein the ML model(machine learning model Medalion[Fig.1/item 108]) is trained with training data comprising historical PII protection data” (To generate even more training data , variations of PII redactions may be introduced Medalion[par.0044]).
Regarding claim 12 in view of claim 8, the reference combined disclose “wherein the process further comprises, responsive to a determination that the data element is not a PII data element, returning the data access event” (unsupervised and supervised machine learning Medalion[par.0024-par.0025]).
Regarding claim 14 in view of claim 8, the reference combined disclose “wherein the data access event is from another computing device” (i/o devices /interfaces Medalion[Fig.5/item 504]).
Regarding claim 15, Medalion discloses “a non-transitory machine-readable medium encoding instructions that when executed by one or more processors cause a process to be carried out, the process including: receiving a data access event, wherein the data access event relates to a data element” (receiving output from the BILSTM Neural network model, the output indicating one or more text data elements [Fig.4/item 406]); “determining whether the data element is a personally identifiable information (PII) data element by querying a PII metadata repository, wherein the PII metadata repository maintains PII data of an organization in a graph database capable of storing one or more data elements and one or more relationships between the one or more data elements; (FIG. 1 depicts an example of a machine-learning based PII detection and removal system 100 in data communication with a data repository 120, [par.0050]) also see PI detection and removal system [Fig.1/item 100]). “responsive to a determination that the data element is a PII data element” (PI detection and removal system [Fig.1/item 100]).
Medalion does not explicitly disclose “predicting, using a machine learning (ML) model, a PII protection policy appropriate for the PII data element; and applying the PII protection policy to the PII data element to modify or alter the PII data element into an obfuscated state as specified by the applied PII protection policy to anonymize the PII data element; and returning the data access event including the PII data element in the obfuscated state with the PII protection policy applied.
However, Lafever in an analogous art discloses ““predicting, using a machine learning (ML) model, a PII protection policy appropriate for the PII data element” (policy engine Lafever[Fig.1r]); “and applying the PII protection policy to the PII data element to modify or alter the PII data element into an obfuscated state (data and transmission is encrypted and obfuscated during transmission Lafever [Col.25/lines 48-50]) as specified by the applied PII protection policy to anonymize the PII data element” In Step ( 2 ) , based at least in part on the determined DLDs , the data 30 elements may be dynamically anonymized by means of Disassociation Lafever[Col.54/lines 28-31]), “and returning the data access event including the PII data element in the obfuscated state with the PII protection policy applied to anonymize the PII data element as specified by the applied PII protection policy.” ( Policy external to the system would determine which information may be relevant for different incidents and stages of incidents, as well as what level of obfuscation/transparency is appropriate at different times so not all information would be released at once and so that irrelevant but sensitive information would not be released without cause Lafever[Col.57/lines 4-10]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Medalion’s Machine learning based detection and removal of personally identifiable information with LaFever’s Policy enforcement utilizing PII in order to provide additional security. One of ordinary skill would have been motivated to combine because Medalion discloses a learning-based detection and removal of personally identifiable information, LaFever teaches a policy enforcement process utilizing obfuscation PII data and both are from the same field of endeavor.
Neither Medalion nor Lafever explicitly disclose “wherein the ML model includes decision trees with each decision constructed using different multi-dimensional features extracted from different historical PII data elements.”
However, Mumcuyan in an analogous art discloses “wherein the ML model includes decision trees with each decision constructed using different multi-dimensional features extracted from different historical PII data elements” (Mumcuyan explains that different classifiers are trained using different subsets and dimensions of these features to improve classification accuracy and risk assessment Mumcuyan [par.0064-0072] also see (after collecting such a dataset with true / false positives , binary classifier model 320 is built using a Booster classifier , such as the CatBoost , that uses gradient boosting on decision trees Mumcuyan [par.0060]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Medalion’s Machine learning based detection and removal of personally identifiable information and LaFever’s Policy enforcement utilizing PII with Mumcuyan’s classifier model utilized in its machine learning system in order to provide additional security. One of ordinary skill would have been motivated to combine because Medalion discloses a learning-based detection and removal of personally identifiable information, LaFever teaches a policy enforcement process utilizing PII, Mumcuyan discloses a CatBoost classifier model utilized in its machine learning system and all are from the same field of endeavor.
Regarding claim 17 in view of claim 15, neither Medalion nor Lang explicitly disclose “wherein the ML model includes a CatBoost classifier” (after collecting such a dataset with true / false positives , binary classifier model 320 is built using a Booster classifier , such as the CatBoost , that uses gradient boosting on decision trees Mumcuyan [par.0060]).
Regarding claim 18 in view of claim 15, the references combined disclose “wherein the ML model (machine learning model Medalion[Fig.1/item 108]) is trained with training data comprising historical PIT protection data” (To generate even more training data , variations of PII redactions may be introduced Medalion[par.0044]).
Regarding claim 19 in view of claim 15, the references combined disclose “wherein the process further comprises, responsive to a determination that the data element is not a PII data element, returning the data access event” (unsupervised and supervised machine learning Medalion[par.0024-par.0025]).
Regarding claim 21 in view of claim 1, the references combined disclose “wherein the ML model is trained with training data comprising historical PII data elements and PII protection policy applied to the historical PII data element to comply with enacted data protection and privacy regulations” (In some cases , pattern - based matchers 106 may be used to create training data for machine learning model ( s ) 108. The pattern - based matchers 106 may be based on regular expressions and / or dictionaries Medalion[par.0056]).
Regarding claim 22 in view of claim 3, the references combined disclose “wherein the CatBoost classifier uses a multi-class classification such that a result of the classification would be one of one or more different PII protection policies and the predicting, by the computing device using a machine learning (ML) model, a PII protection policy appropriate for the PII data element further comprises aggregating a prediction of each decision tree” ( Policy external to the system would determine which information may be relevant for different incidents and stages of incidents, as well as what level of obfuscation/transparency is appropriate at different times so not all information would be released at once and so that irrelevant but sensitive information would not be released without cause Lafever[Col.57/lines 4-10]).
Regarding claim 23 in view of claim 1, the references combined disclose “wherein the obfuscated state is an obscured state, a blurred state, or a blacked out state” ( Policy external to the system would determine which information may be relevant for different incidents and stages of incidents, as well as what level of obfuscation/transparency is appropriate at different times so not all information would be released at once and so that irrelevant but sensitive information would not be released without cause Lafever [Col.57/lines 4-10]).
Regarding claim 24 in view of claim 1, the references combined disclose wherein the multi-dimensional features comprise features extracted from a historical PII data element and a PII protection policy applied to the historical PII data element to comply with enacted data protection and privacy regulations, an element name, a data type, and an access channel” (In some cases , pattern - based matchers 106 may be used to create training data for machine learning model ( s ) 108. The pattern - based matchers 106 may be based on regular expressions and / or dictionaries Medalion[par.0056]).
Regarding claim 25 in view of claim 1, the references combined disclose “(New) The method of claim 1, wherein the graph database is a Resource Description Framework (RDF) graph model”( JITI could be implemented using NoSQL and / or other approaches , including without limitation emerging 10 technologies such as quantum databases , quantum relational databases , graph databases , triple stores ( RDF ) or S3DB ( as a means to represent data on the Semantic Web without the rigidness of relational / XML schema LaFever [Col.65/lines 9-14] also see “JITI keys could harness capabilities of the Semantic Web ( the extension of the Web through standards established by the World Wide Web Consortium ( W3C ) like the Resource Description Framework or RDF ) as a unifying computational environment LaFever [Col.65/lines 9-14]).
Regarding claim 26 in view of claim 25, the references combined disclose “wherein the graph model stores data elements as triple statements comprising a subject, a predicate, and an object” (JITI could be implemented using NoSQL and / or other approaches , including without limitation emerging 10 technologies such as quantum databases , quantum relational databases , graph databases , triple stores ( RDF ) or S3DB ( as a means to represent data on the Semantic Web without the rigidness of relational / XML schema LaFever[Col.65/lines 9-14])
Regarding claim 27 in view of claim 25, the references combined disclose “wherein the graph database is a labeled property graph (LPG) graph model.” (Semi - supervised machine learning algorithms generally use both labeled and unlabeled data for training , which may typically involve a relatively smaller amount of labeled data and a relatively larger amount of unlabeled data . The labeled data generally improves learning accuracy as compared to unsupervised technique Medalion[par.0026]).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL D ANDERSON whose telephone number is (571)270-5159. The examiner can normally be reached Mon-Fri 9am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached at (571) 272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL D ANDERSON/Examiner, Art Unit 2433
/JEFFREY C PWU/Supervisory Patent Examiner, Art Unit 2433
Prosecution Insights