CTFR 18/244,855 CTFR 91435 DETAILED ACTION Claim Objections Claim 1, 8 and 15 are objected to because of the following informalities: Claim 1 line 6 “for modified image” should read “for the modified image”. Appropriate correction is required. Same rationales apply to claims 8 and 15. Claim Rejections - 35 USC § 103 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claim (s) 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Muehlenstaedt (US 20230410469 A1) in view of Laugros (US 20210374532 A1) . Regarding claim 1, Muehlenstaedt teaches a processor, comprising: one or more circuits to (Fig. 7, Fig. 1, Fig. 6) use one or more neural networks to generate a prediction for an image; and ([0006]: receiving an input image, generating a label prediction corresponding to the input image using a trained neural network, generating a correlation structure based on a comparison of the input image with each of a plurality of reference images. [0052]: if the correlation between the input image and a reference image is determined to be high (i.e., cor(d r,p )→[1] and/or cor(d r,p ) is greater than a threshold such as greater than about 0.8, greater than about 0.9, greater than about 0.95, or the like), the label prediction corresponding to the reference image (y (r) ) will be assigned to the input image.) determine whether to assign a label of the image to the image based, at least in part, on the perturbation amount by which the image was modified and on the prediction; and ([0006]: generating an updated label prediction corresponding to the input image using the label prediction and the correlation structure. [0008]: identifying the label prediction as the updated label prediction in response to determining that there exists a correlation between the input image and each of the plurality of reference images that is less than a threshold. [0011]: Generating the correlation structure can also include identifying a reference image of the plurality of reference images that has a highest correlation with the input image, and identifying a correct label associated with the identified reference image as the updated label prediction. [0051]-[0053].) update the one or more neural networks using the image with the label assigned to the image. ([0011]: identifying a correct label associated with the identified reference image as the updated label prediction. [0040]: The reference dataset may be continually updated to remove (e.g., when the neural network prediction accuracy with respect to image improves) and/or add reference images manually or automatically.) Muehlenstaedt does not explicitly disclose to modify the image by a perturbation amount to generate a modified image, and the modified image is used by the one or more neural network. However, Laugros teaches to modify the image by a perturbation amount to generate a modified image, and the modified image is used by the one or more neural network. (Fig. 1 and 3: Adversarial learning step. [0010]: adversarial learning step, comprising the following operations: supplying, to said neural network, an image , called adversarial image, containing a modification , called adversarial attack.) It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include above limitation into Muehlenstaedt. One would have been motivated to do so because today, neural networks are widely utilized in the field of automated image processing, mainly for automated classification of the images, or for automated recognition of objects in the images. However, it may occur that an image provided to be processed by a neural network contains a modification, sometimes scarcely visible, called “adversarial attack”, introduced into said image intentionally with the aim of disturbing the neural network. The solution traditionally utilized to improve the robustness of a neural network to adversarial attacks is to utilize a learning set comprising images containing adversarial attacks: such learning is called “adversarial learning”. As taught by Laugros, [0004]-[0007]. Regarding claim 2, Muehlenstaedt and Laugros teach the processor of claim 1. Laugros teaches wherein the image was used prior to modification to train the one or more neural networks, and (Fig. 2 and 3: Non-adversarial learning step. [0073]-[0076]: The non-adversarial image can be any type of image. It comprises a content, which in the present example is a dog .) wherein the image was modified based, at least in part, on one or more adversarial attack techniques. (Fig. 1 and 3: Adversarial learning step. [0010]: adversarial learning step, comprising the following operations: supplying, to said neural network, an image , called adversarial image, containing a modification , called adversarial attack.) Regarding claim 3, Muehlenstaedt and Laugros teach the processor of claim 1. Muehlenstaedt teaches wherein the one or more circuits are to assign the label to the modified image from the image in a training dataset based, at least in part, on the perturbation amount by which the image was modified being below a threshold amount. ([0008]: identifying the label prediction as the updated label prediction in response to determining that there exists a correlation between the input image and each of the plurality of reference images that is l ess than a threshold . [0052].) Regarding claim 4, Muehlenstaedt and Laugros teach the processor of claim 1. Muehlenstaedt teaches wherein the one or more circuits are to assign to the modified image, a label indicative of the perturbation amount by which the image was modified being above a threshold amount. ([0052]: if the correlation between the input image and a reference image is determined to be high (i.e., cor(d r,p )→[1] and/or cor(d r,p ) is greater than a threshold such as greater than about 0.8, greater than about 0.9, greater than about 0.95, or the like), the label prediction corresponding to the reference image (y (r) ) will be assigned to the input image.) Regarding claim 5, Muehlenstaedt and Laugros teach the processor of claim 1. Muehlenstaedt teaches wherein the one or more circuits are to obtain the perturbation amount to apply to the image in one or more adversarial attacks. ([0022]: an adversarial attack may include pixels purposely and intentionally perturbed to confuse and deceive a neural network during image classification and object detection. [0008] and [0052]: identifying the label prediction as the updated label prediction in response to determining that there exists a correlation between the input image and each of the plurality of reference images that is less or greater than a threshold.) Regarding claim 6, Muehlenstaedt and Laugros teach the processor of claim 1. Muehlenstaedt teaches wherein the image was used prior to modification to train one or more neural networks, and ([0002]. [0011]. [0040]-[0041].) wherein the one or more circuits are to: determine whether the modified image causes the one or more neural networks to produce one or more incorrect outputs and ([0002]. [0022]: an adversarial attack may include pixels purposely and intentionally perturbed to confuse and deceive a neural network during image classification and object detection, where such pixels are not easily recognizable by a human user. For example, consider a neural network trained to classify road signs. If the network is presented with a new, not previously seen road sign, then the neural network will likely make a confident and probably correct classification. However, if the neural network is presented with an image outside the distribution of images used for training, e.g., an image of a cat, then a conventional neural network is prone to still confidently predict a road sign for the cat image. In another example, a human carrying an object that fits a different object class (such as a bicycle) could be incorrectly classified by an image classification neural network.) generate a label for the modified image that caused the one or more neural networks to produce the one or more incorrect outputs. ([0052]: if the correlation between the input image and a reference image is determined to be high (i.e., cor(d r,p )→[1] and/or cor(d r,p ) is greater than a threshold such as greater than about 0.8, greater than about 0.9, greater than about 0.95, or the like), the label prediction corresponding to the reference image (y (r) ) will be assigned to the input image, irrespective of label predicted by the neural network (nn β )(x p )). However, if the correlation between the input image and a reference image is determined to be low (i.e., cor(d r,p )→0 and/or cor(d r,p ) is less than a threshold such as less than about 0.1, less than about 0.2, less than about 0.05, or the like), the label predicted by the neural network (nn β )(x p )) will be used as the image label prediction. In other words, if an input image is not identical but very similar to a reference image, it will lead to a small distance between the input image and the reference image creating a high correlation, outweighing the neural network prediction. However, if an input image is not similar to any reference image, the reference dataset will not have any effect on the neural network label prediction.) Regarding claim 7, Muehlenstaedt and Laugros teach the processor of claim 6. Muehlenstaedt teaches wherein the one or more circuits are to fine-tune the one or more neural networks using the modified image and the label assigned to the modified image. ([0023]: retraining the neural network to recognize adversarial attacks and/or using additional training data including edge cases can help address the above issues to some extent. [0024]: utilize a combination of a neural network with a correlation structure (e.g., a correlation structure as used in a Gaussian process) corresponding to a reference dataset that enables significantly improved prediction accuracy during, for example, image classification (as discussed below). In case of image classification, the reference dataset can include images known to be associated with adversarial attacks or edge cases where the reference dataset is not used for training of the neural network but for correction of neural network predictions during inference.) Same rationales apply to claim 8 (system) and claim 15 (method) because they are substantially similar to claim 1 (processor). Same rationales apply to claim 9 (system) and claim 16 (method) because they are substantially similar to claim 2 (processor). Same rationales apply to claim 10 (system) and claim 17 (method) because they are substantially similar to claim 3 (processor). Same rationales apply to claim 11 (system) and claim 18 (method) because they are substantially similar to claim 4 (processor). Same rationales apply to claim 12 (system) and claim 19 (method) because they are substantially similar to claim 5 (processor). Same rationales apply to claim 13 (system) and claim 20 (method) because they are substantially similar to claim 6 (processor). Same rationales apply to claim 14 (system) because it is substantially similar to claim 7 (processor). Response to Arguments Applicant’s arguments, see pages 6-8, filed 04/30/2026, with respect to the rejection(s) of claims 1-20 under 35 U.S.C. § 103 have been fully considered but are moot in view of new ground(s) of rejection. Conclusion 07-40 AIA Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL . See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to ZI YE whose telephone number is (571)270-1039. The examiner can normally be reached Monday - Friday, 8:00am - 4:00pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Emmanuel Moise can be reached at 5712723865. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /ZI YE/Primary Examiner, Art Unit 2455 Application/Control Number: 18/244,855 Page 2 Art Unit: 2455 Application/Control Number: 18/244,855 Page 3 Art Unit: 2455 Application/Control Number: 18/244,855 Page 4 Art Unit: 2455 Application/Control Number: 18/244,855 Page 5 Art Unit: 2455 Application/Control Number: 18/244,855 Page 6 Art Unit: 2455 Application/Control Number: 18/244,855 Page 7 Art Unit: 2455 Application/Control Number: 18/244,855 Page 8 Art Unit: 2455 Application/Control Number: 18/244,855 Page 9 Art Unit: 2455
Prosecution Insights