DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17 (e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17 (e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 06/11/2026 has been entered.
This office Action is in response to the RCE filed on 06/11/2026. As per instant Amendment, Claims 1, 9, and 16 have been amended; Claims 4-5 and 17 were previously cancelled. Claims 1, 9, and 16 are independent Claims; Claims 1-3, 6-16, and 18-20 have been examined and are pending. This Office Action is made Non-Final.
Response to Arguments
Applicant’s arguments in the instant Amendment, filed on 06/11/2026, with respect to the prior-art rejections to claims 1, 9, and 16, and limitation listed below, have been fully considered but they are not persuasive.
As to independent claims 1, 9, and 16, Applicants stated in arguments that Ganz does not teach or suggest determining whether a prompt is estimated to cause an ML model to generate source code that contains a vulnerability (Applicant Arguments/Remarks, 06/11/2026, pages 8-9).
The Examiner disagrees with the applicants. The Examiner respectfully that Ganz does disclose the cited limitations. For example, Ganz discloses receiving a potentially vulnerable prompt that is estimated to cause a source code generation machine learning model to generate a security vulnerability (par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [i.e., potentially vulnerable prompt could be a source code] and outputting [i.e., to generate a security vulnerability] a probability that each of a set of vulnerabilities exists in the source code).
In attempts to promote principle of compact prosecution, on 9/11/2026, the Examiner contacted the Applicants to discuss possible amendments to move the case forward. However, the Examiner and the Applicants could not come up with an agreement.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 6, 8-12, 16, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Ganz et al. (“Ganz,” US 20240184892, filed on 12/12/2022) in view of YANG et al. (“YANG,” CN 112685315 A, published on 04/20/2021), and further in view of Dinh et al. (“Dinh,” US 20210124830, published on 04/29/2021).
Regarding Claim 1;
Ganz discloses a method comprising:
receiving a potentially vulnerable prompt that is estimated to cause a source code generation machine learning model to generate a security vulnerability (par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input and outputting a probability that each of a set of vulnerabilities exists in the source code);
providing the potentially vulnerable prompt to the source code generation machine learning model (par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified);
receiving a confirmation that the potentially vulnerable piece of source code includes the security vulnerability (par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted).
Ganz discloses generating a secure prompt as recited above, but do not explicitly disclose wherein the potentially vulnerable prompt comprises a description of a source code functionality; receiving, from the source code generation machine learning model, a potentially vulnerable piece of source code that performs the source code functionality; generating a secure prompt that generates a secure source code that performs the source code functionality, wherein the generated secure source code does not include the security vulnerability.
However, in an analogous art, YANG discloses verification tool system/method that includes:
wherein the potentially vulnerable prompt comprises a description of a source code functionality (YANG: page 3, par 3; using natural language to compile the function requirement description document of C source code; C source code function requirement description document comprises target C source code function specification description and safety description);
receiving, from the source code generation machine learning model, a potentially vulnerable piece of source code that performs the source code functionality (YANG: page 3, par 3; using natural language to compile the function requirement description document of C source code; C source code function requirement description document comprises target C source code function specification description and safety description; page 5, par 13; guiding the middle verification language standard generated in the step S03 and the code into the automatic verifier module; page 5, par 13; verifying the intermediate verification language specification and code by the automation verifier [] outputting the function call condition of the execution path, comprising the input parameter of the function and the return value to the verification report; giving a verification failure verification report, which indicates that the C source code corresponding function does not meet the function requirement given by the user; the function of the source code does not meet the expectation);
generating a secure prompt that generates a secure source code that performs the source code functionality, wherein the generated secure source code does not include the security vulnerability (YANG: page 3, par 3; using natural language to compile the function requirement description document of C source code; C source code function requirement description document comprises target C source code function specification description and safety description; page 5, par 13; guiding the middle verification language standard generated in the step S03 and the code into the automatic verifier module; page 5, par 13; verifying the intermediate verification language specification and code by the automation verifier [] outputting the function call condition of the execution path, comprising the input parameter of the function and the return value to the verification report [] representing the verification is successful, giving the verification success verification report).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of YANG with the method/system of Ganz to include wherein the potentially vulnerable prompt comprises a description of a source code functionality; receiving, from the source code generation machine learning model, a potentially vulnerable piece of source code that performs the source code functionality; generating a secure prompt that generates a secure source code that performs the source code functionality, wherein the generated secure source code does not include the security vulnerability. One would have been motivated to insert the compiled code function specification into C source code, then automatically converting the function specification and C source code into intermediate representation capable of being processed by the program verifier, then the program verifier converts the intermediate representation into intermediate authentication language code (YANG: abstract).
The combination of Ganz and YANG disclose the potentially vulnerable prompt and the secure prompt as recited above, but do not explicitly disclose storing an association between the potentially vulnerable prompt and the secure prompt in a prompt store, wherein a user-supplied prompt is matched to the potentially vulnerable prompt in the prompt store and replaced at least in part with the secure prompt, wherein providing the secure prompt to an individual source code generation machine learning model generates an individual secure source code that is incorporated into a source code file.
However, in an analogous art, Dinh discloses code vulnerability remediation system/method that includes:
storing an association between the potentially vulnerable prompt and the secure prompt in a prompt store, wherein a user-supplied prompt is matched to the potentially vulnerable prompt in the prompt store and replaced at least in part with the secure prompt, wherein providing the secure prompt to an individual source code generation machine learning model generates an individual secure source code that is incorporated into a source code file (Dinh: par 0030; the code corpus, is configured to store and record information relating to known vulnerabilities and actions taken to resolve the vulnerabilities; par 0038; receives programming code (e.g., source code) from one or more user devices [] determine whether the code includes vulnerabilities; par 0051; the code repair/building component of the platform uses the solution associated the matching code vector representation from the code corpus to remove the vulnerability from the inputted code. The matching code vector representation in the code corpus will have a solution code snippet associated therewith that eliminates the code vulnerability. The code repair/building component uses this associated solution to modify the incoming code to remove the vulnerability and build new code that does not include the vulnerability; par 0052; if the building of the new code is successful, a CD pipeline is executed where a final version of the code is reviewed, staged and produced).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Dinh with the method/system of Ganz and YANG to include storing an association between the potentially vulnerable prompt and the secure prompt in a prompt store, wherein a user-supplied prompt is matched to the potentially vulnerable prompt in the prompt store and replaced at least in part with the secure prompt, wherein providing the secure prompt to an individual source code generation machine learning model generates an individual secure source code that is incorporated into a source code file. One would have been motivated to determine whether at least a portion of the code comprises at least one vulnerability, and comparing at least the portion of the code comprising the at least one vulnerability to a knowledge base (Dinh: abstract).
Regarding Claim 2;
The combination of Ganz, YANG, and Dinh disclose the method of claim 1,
Ganz discloses wherein the potentially vulnerable prompt comprises a plurality of potentially vulnerable prompts, wherein generating the potentially vulnerable piece of source code comprises generating a plurality of potentially vulnerable pieces of source code from the plurality of potentially vulnerable prompts (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified), and wherein the confirmation that the potentially vulnerable piece of source code includes the security vulnerability comprises identifying combinations of the plurality of potentially vulnerable prompts and the plurality of potentially vulnerable pieces of source code that cause the source code generation machine learning model to generate the security vulnerability (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted).
Regarding Claim 3;
The combination of Ganz, YANG, and Dinh disclose the method of claim 2,
Ganz discloses wherein generating the secure prompt comprises generating secure prompts for the combinations of the plurality of potentially vulnerable prompts and the plurality of potentially vulnerable pieces of source code (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified).
Regarding Claim 6;
The combination of Ganz, YANG, and Dinh disclose the method of claim 1,
Ganz discloses wherein the potentially vulnerable prompt is generated by providing the source code generation machine learning model with a piece of source code that includes the security vulnerability, pieces of vulnerable source code, and prompts that caused the source code generation machine learning model to generate the pieces of vulnerable source code (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted).
Regarding Claim 8;
The combination of Ganz, YANG, and Dinh disclose the method of claim 1,
Ganz discloses wherein the potentially vulnerable piece of source code is confirmed to include the security vulnerability based on an analysis from a security analyzer (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted);
Regarding Claim 9;
This Claim recites a system that perform the same steps as method of Claim 1, and has limitations that are similar to Claim 1, thus are rejected with the same rationale applied against claim 1.
Regarding Claim 10;
The combination of Ganz, YANG, and Dinh disclose the system of claim 9,
Ganz discloses wherein the reflection technique provides the code generation machine learning model with the potentially vulnerable prompt and a prompt to identify security vulnerabilities that would be generated by the potentially vulnerable prompt (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted);
Regarding Claim 11;
The combination of Ganz, YANG, and Dinh disclose the system of claim 10,
Dinh discloses wherein generating the secure prompt comprises providing the code generation machine learning model with a prompt to fix the potentially vulnerable prompt (Dinh: par 0073; identifying, based on the comparing, a code fragment of the plurality of code fragments matching at least the portion of the code comprising the at least one vulnerability. The method includes executing a solution of the plurality of solutions corresponding to the identified code fragment to prevent the at least one vulnerability in at least the portion of the code. Executing the solution include generating new code without the at least one vulnerability. One or more machine learning algorithms may be applied to update the knowledge base with data corresponding to the generation of the new code. The method can also include determining a programming language of the code, and sanitizing at least the portion of the code comprising the at least one vulnerability. Sanitizing at least the portion of the code comprising the at least one vulnerability can include removing one or more comments from at least the portion of the code comprising the at least one vulnerability).
The motivation is the same that of claim 9 above.
Regarding Claim 12;
The combination of Ganz, YANG, and Dinh disclose the system of claim 11,
Dinh discloses wherein fixing the potentially vulnerable prompt comprises creating a prompt that generates a piece of source code without the security vulnerability that performs a same functionality as a piece of source code generated by the potentially vulnerable prompt (Dinh: par 0073; identifying, based on the comparing, a code fragment of the plurality of code fragments matching at least the portion of the code comprising the at least one vulnerability. The method includes executing a solution of the plurality of solutions corresponding to the identified code fragment to prevent the at least one vulnerability in at least the portion of the code. Executing the solution include generating new code without the at least one vulnerability. One or more machine learning algorithms may be applied to update the knowledge base with data corresponding to the generation of the new code. The method can also include determining a programming language of the code, and sanitizing at least the portion of the code comprising the at least one vulnerability. Sanitizing at least the portion of the code comprising the at least one vulnerability can include removing one or more comments from at least the portion of the code comprising the at least one vulnerability; 0052; if the building of the new code is successful, a CD pipeline is executed where a final version of the code is reviewed, staged and produced).
The motivation is the same that of claim 9 above.
Regarding Claim 16;
This Claim recites a computer-readable storage medium that perform the same steps as method of Claim 1, and has limitations that are similar to Claim 1, thus are rejected with the same rationale applied against claim 1.
Regarding Claim 18;
The combination of Ganz, YANG, and Dinh disclose the computer-readable storage medium of claim 16,
Ganz discloses wherein the user-supplied prompt comprises a portion of the source code file before a location in the source code file where the generated individual secure source code is inserted (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted).
Regarding Claim 19;
The combination of Ganz, YANG, and Dinh disclose the computer-readable storage medium of claim 16,
Ganz discloses wherein the user-supplied prompt matches the potentially vulnerable prompt based on a string comparison, a string distance algorithm, or a distance comparison of embeddings of the user- supplied prompt and the potentially vulnerable prompt generated by a machine learning model (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted; par 0081; wherein the empirical identification of the subset of the target locations is based on a mean crash distance between the one or more target locations and locations where the source code crashes).
Regarding Claim 20;
The combination of Ganz, YANG, and Dinh disclose the computer-readable storage medium of claim 16,
Ganz discloses wherein the confirmation that the potentially vulnerable piece of source code includes the security vulnerability is based on a determination that a combination of the potentially vulnerable piece of source code and the potentially vulnerable prompt includes the security vulnerability (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted), and wherein the potentially vulnerable prompt is combined with the potentially vulnerable piece of source code by appending the potentially vulnerable piece of source code to the potentially vulnerable prompt (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified);
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Ganz et al. (US 20240184892) in view of YANG et al. (CN 112685315 A), and further in view of Dinh et al. (US 20210124830) and ZHANG et al. (“ZHANG,” CN 111722998 B, filed on 03/21/2019).
Regarding Claim 7;
The combination of Ganz, YANG, and Dinh disclose the method of claim 6,
Ganz discloses wherein the potentially vulnerable prompt is generated by providing the source code generation machine learning model with pieces of vulnerable source code and corresponding prompts followed by the piece of source code that includes the security vulnerability (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0019; the machine-learning models are trained using a training set. Each element of the training set is an input for the machine learning model (e.g., an input data object). By processing the training set, the internal variables of the machine learning model are adjusted so that the error rate of the machine learning model is minimized).
The combination of Ganz and Dinh disclose wherein the potentially vulnerable prompt is generated as recited above, but do not explicitly disclose pairs of pieces of vulnerable code.
However, in an analogous art, ZHANG discloses code quality control system/method that includes:
pairs of pieces of vulnerable code (ZHANG: page 8, par 2; pair of defect codes and repair codes in the change codes, and when there are multiple modified code segments).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of ZHANG with the method/system of Ganz and Dinh to include pairs of pieces of vulnerable code. One would have been motivated to match result of the code to be evaluated and the code defect template, providing the code repairing template corresponding to the code defect template, so as to repair the code to be evaluated (ZHANG: abstract).
Claims 13-14 are rejected under 35 U.S.C. 103 as being unpatentable over Ganz et al. (US 20240184892) in view of YANG et al. (CN 112685315 A), and further in view of Dinh et al. (US 20210124830) and Kolychev et al. (“Kolychev,” US 20190377880, published on 12/12/2019).
Regarding Claim 13;
The combination of Ganz, YANG, and Dinh disclose the system of claim 9,
Dinh disclose discloses wherein the source code generation machine learning model comprises a model trained on a corpus source code training data (Dinh: par 0033; the code corpus is a dynamic knowledge base which is continuously updated and modified based on input from an AI/ML engine which, as described further herein below, uses AI/ML techniques to learn code vulnerabilities not previously in the code corpus and the corresponding solutions to remove the code vulnerabilities).
The combination of Ganz and Dinh disclose wherein the source code generation machine learning model comprises a model trained on a corpus source code training data as recited above, but do not explicitly disclose a multimodal model.
However, in an analogous art, Kolychev discloses machine learning system/method that includes:
a multimodal mode (Kolychev: par 0066; multimodal systems can enable a user to provide multiple types of input/output to communicate with computing system. Computing system can include communications interface, which can generally govern and manage the user input and system output).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Kolychev with the method/system of Ganz and Dinh to include a multimodal mode. One would have been motivated to automate verifications of potential vulnerabilities of one or more sites or code utilizing one or more neural networks (Kolychev: abstract).
Regarding Claim 14;
The combination of Ganz, YANG, Dinh, and Kolychev disclose the system of claim 13,
Ganz discloses wherein the source code training data contains the security vulnerability (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified; par 0069; indicates on a user interface the subset of the target locations at which the vulnerability was empirically determined to exist. For example, a user interface provided that shows the source code 400 of FIG. 4 with the lines of code that were confirmed to contain vulnerabilities in operation 730 highlighted);
Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Ganz et al. (US 20240184892) in view of YANG et al. (CN 112685315 A), and further in view of Dinh et al. (US 20210124830) and MATROSOV et al. (“MATROSOV,” US 20190370473, published on 12/05/2019).
Regarding Claim 15;
The combination of Ganz, YANG, and Dinh disclose the system of claim 9,
Ganz discloses wherein the potentially vulnerable prompt comprises a user-provided portion (Ganz: par 0018; user input inserted into a string used for a database query without checking if the input contains control characters that modify the expected operation of the database. Machine-learning models trained to detect these vulnerabilities by accepting source code as input [] identify one or more locations within the source code that are likely to cause the vulnerability. Directed fuzzing provides a range of inputs to source code. The inputs that cause the source code to fail are detected and the portions of the source code that were vulnerable are identified);
The combination of Ganz and Dinh disclose wherein the potentially vulnerable prompt comprises a user-provided portion recited above, but do not explicitly disclose a hidden portion.
However, in an analogous art, MATROSOV discloses detecting vulnerabilities system/method that includes:
a hidden portion (MATROSOV: par 0033; the developer could provide one or more independent portions of source code and avoid providing all of source code. if the source code for a given application (or any portions thereof) is confidential or otherwise unavailable, code analyzer can still, in some embodiments, detect vulnerabilities based on other portions of that source code and/or the associated compiled binary).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of MATROSOV with the method/system of Ganz and Dinh to include a hidden portion. One would have been motivated to implement machine learning to detect vulnerabilities in computer code. The code analyzer trains a machine learning model using training vectors that characterize vulnerable programming patterns (MATROSOV: abstract).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHAO WANG whose telephone number is (313)446-6644. The examiner can normally be reached on Monday-Friday 7:30-4:30PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached on (571)270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/C.W./Examiner, Art Unit 2439
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439
