DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1, 3, 4, 6-8, 10, 11, 13-15, 17, 18, and 20 have been examined.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 01/15/2026 has been entered.
Response to Amendment
Claims 2, 9, and 16 have been cancelled.
Applicant’s arguments with respect to claims 1, 8, and 15 regarding the new limitations: “wherein processing the training data comprises restructuring, sorting, normalizing, deleting, and changing format of the data” and “wherein validating the one or more data points comprises comparing the one or more data points associated with the predictive output with one or more patterns associated with the historical data” have been considered but are moot in view of the new grounds of rejection presented in the current office action.
As per the applicant’s arguments that prior art of record Ezrielev does not teach: “determine, via the Huber loss estimator module, that the training data has been manipulated by a malfeasant actor based on validating the one or more data points associated with the predictive output, wherein validating the one or more data points comprises comparing the one or more data points associated with the predictive output with one or more patterns associated with the historical data”, the examiner respectfully disagrees. Ezrielev teaches: [0126] The quantification may be obtained by obtaining a difference between the first set of outputs and the second set of outputs. To obtain the difference: (i) a first output of the first set of outputs may be obtained from a listing of the first set of outputs, (ii) a first output of the second set of outputs corresponding to the first output of the first set of outputs (e.g., obtained using the same input value from the set of inputs) may be obtained from a listing of the second set of outputs, (iii) the first output of the second set of outputs may be subtracted from the first output of the first set of outputs to obtain a first difference, and (iv) repeat steps i-iii for each output value of the first set of outputs and each corresponding output value of the second set of outputs. The difference may include multiple differences corresponding to the number of input values in the set of inputs. The difference may be treated as the quantification. [0134] At operation 324 it is determined whether the quantification exceeds a quantification threshold. If the quantification exceeds the quantification threshold, the method may proceed to operation 326. [0135] At operation 326, the suspect set of training data is treated as including poisoned training data. Treating the suspect set of training data as including poisoned training data may include: (i) treating the suspect set of training data as being part of a malicious attack. It was well known to one of ordinary skill in the art before the effective filing date of the claimed invention that producing poisoned training data as part of a malicious attack is performed by malfeasant actors. Prior art Zhang teaches: In the LightGBM model, the Huber loss function is used as the loss function of the model.
As per the applicant’s arguments that prior art of record Ezrielev does not teach: in response to determining that the training data has been manipulated, perform one or more actions comprising: “automatically altering the training data; performing machine unlearning associated with the training data on the local linear model to generate a data model secure from malfeasant manipulation; isolating the training data and transmitting a notification to a user; and automatically performing analysis on the training data and generating a report associated with the analysis”, the examiner respectfully disagrees. Ezrielev teaches: [0141] The suspect set of training data may be discarded by deleting all copies of the suspect set of training data (automatically altering the training data). [0137] Remediating the impact of the suspect set of training data on the second instance of the AI model may include: (i) identifying the second portion of the second instance of the AI model as a poisoned portion of the second instance of the AI model, (ii) remediating the poisoned portion to obtain an un-poisoned portion, and/or (iii) obtaining an un-poisoned instance of the AI model using the un-poisoned portion (performing machine unlearning to generate a secure model).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claims 1, 3, 4, 6-8, 10, 11, 13-15, 17, 18, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over prior art of record US 20240220608 to Ezrielev et al (hereinafter Ezrielev), prior art of record CN 115310683 to Zhang et al (hereinafter Zhang), and JP2002366394A to Fujino et al (hereinafter Fujino).
Examiner’s Note: The examiner used an English translation of CN 115310683 that was provided in the previous office action.
Examiner’s Note: The examiner used an English translation of JP2002366394A that is attached to the end of the original document.
As per claims 1, 8 and 15, Ezrielev teaches:
A system for generating data models secure from malfeasant manipulation for use in predictive modeling, comprising:
at least one processing device; at least one memory device; and a module stored in the at least one memory device comprising executable instructions that when executed by the at least one processing device, cause the at least one processing device (Ezrielev: [0158]-[0159]) to:
retrieve training data associated with predictive modeling from a data source (Ezrielev: [0062] As discussed with respect to FIG. 1, training data used for training AI models may be obtained from any number of data sources 100. [0114] The suspect set of training data may be obtained by requesting the suspect set of training data from a data source (e.g., any of data sources 100) and/or any other entity);
transmit the training data to a local linear model to generate a predictive output (Ezrielev: [0113] At operation 320, a second AI model instance is obtained using a suspect set of training data. Obtaining the second AI model instance may include: (i) obtaining the suspect set of training data and (ii) performing a transfer learning process using the suspect set of training data and a first instance of the AI model to obtain the second instance of the AI model. [0125] The second set of outputs may be obtained by: (i) obtaining the second instance of the AI model as described in operation 320, (ii) obtaining the set of inputs as previously described, and (ii) treating the set of inputs as ingest for the second instance of the AI model. To treat the set of inputs as ingest for the second instance of the AI model, the set of inputs may be fed into the second instance of the AI model as an ingest to obtain the second set of outputs);
retrieve historical data from the data source (Ezrielev: [0123] The historical training data set may include known good (e.g., not poisoned) training data and may be obtained by obtaining metadata associated with a snapshot of a known good instance of the AI model. [0124]: To obtain the set of inputs, a listing of the input values and output values associated with the historical training data set may be obtained. The input values associated with the historical training data set may be treated as the set of inputs. To treat the set of inputs as ingest for the first instance of the AI model, the set of inputs may be fed into the first instance of the AI model as an ingest to obtain the first set of outputs);
validate, wherein validating the one or more data points comprises comparing the one or more data points associated with the predictive output with one or more patterns associated with the historical data (Ezrielev: [0126] The quantification may be obtained by obtaining a difference between the first set of outputs and the second set of outputs. To obtain the difference: (i) a first output of the first set of outputs may be obtained from a listing of the first set of outputs, (ii) a first output of the second set of outputs corresponding to the first output of the first set of outputs (e.g., obtained using the same input value from the set of inputs) may be obtained from a listing of the second set of outputs, (iii) the first output of the second set of outputs may be subtracted from the first output of the first set of outputs to obtain a first difference, and (iv) repeat steps i-iii for each output value of the first set of outputs and each corresponding output value of the second set of outputs. The difference may include multiple differences corresponding to the number of input values in the set of inputs. The difference may be treated as the quantification. [0134] At operation 324 it is determined whether the quantification exceeds a quantification threshold. If the quantification exceeds the quantification threshold, the method may proceed to operation 326. [0135] At operation 326, the suspect set of training data is treated as including poisoned training data. Treating the suspect set of training data as including poisoned training data may include: (i) treating the suspect set of training data as being part of a malicious attack. It was well known to one of ordinary skill in the art before the effective filing date of the claimed invention that producing poisoned training data as part of a malicious attack is performed by malfeasant actors); and
in response to determining that the training data has been manipulated, perform one or more actions comprising: automatically altering the training data; performing machine unlearning associated with the training data on the local linear model to generate a data model secure from malfeasant manipulation; isolating the training data and transmitting a notification to a user; and automatically performing analysis on the training data and generating a report associated with the analysis (Ezrielev: [0141] The suspect set of training data may be discarded by deleting all copies of the suspect set of training data (automatically altering the training data). [0137] Remediating the impact of the suspect set of training data on the second instance of the AI model may include: (i) identifying the second portion of the second instance of the AI model as a poisoned portion of the second instance of the AI model, (ii) remediating the poisoned portion to obtain an un-poisoned portion, and/or (iii) obtaining an un-poisoned instance of the AI model using the un-poisoned portion (performing machine unlearning to generate a secure model)).
Ezrielev does not teach: process the training data retrieved from the data source, wherein processing the training data comprises restructuring, sorting, normalizing, deleting, and changing format of the data. Also, Ezrielev teaches validating the training data using a quantification and determining that the training data has been manipulated by a malfeasant actor but does not teach: transmit the predictive output from the local linear model and the historical data retrieved from the data source to a Huber loss estimator module; validate, via the Huber loss estimator module, the predictive output received from the local linear model based on the historical data retrieved from the data source; determine, via the Huber loss estimator module, that the training data has been manipulated.
process the training data retrieved from the data source, wherein processing the training data comprises (Zhang: [0036]: Normalizing the original data to obtain normalized data; [0039]: The normalized data, the encoded data and the wind direction list are used as data to be trained);
transmit the predictive output from the local linear model and the historical data retrieved from the data source to a Huber loss estimator module; validate, via the Huber loss estimator module, the predictive output received from the local linear model based on the historical data retrieved from the data source (Zhang: [0110]: It can be understood that the error of the loss function refers to the degree of deviation between the historical real data corresponding to the training data calculated by the loss function and the predicted value obtained by the prediction model. [0111]: the historical real data corresponding to the training data is first obtained, and then the predicted value obtained according to the prediction model is obtained. Because the historical real data corresponding to the training data is an objective data and will not change, the historical real data corresponding to the training data can be used to measure the reliability of the obtained predicted value. In the LightGBM model, the Huber loss function is used as the loss function of the model).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Zhang in the invention of Ezrielev in view of Lin to include the above limitations. The motivation to do so would be to enhance the robustness to outliers (Zhang: [0111]).
Ezrielev in view of Zhang teaches normalizing the training data but does not teach: wherein processing the training data comprises restructuring, sorting, normalizing, deleting, and changing format of the data. However, Fujino teaches:
wherein processing the training data comprises restructuring, sorting, normalizing, deleting, and changing format of the data (Fujino: [0006]: creating and storing normalized log data in which the values of the defined data items are arranged. [0046]: For storage, the normalized log data is stored according to the data structure shown in Figure 22. The normalized log data is arranged in order of correction time 630, so the normalized log data is merged according to this order (restructuring). [0048]: If normalized log data older than the retention period is stored, the old normalized log data is deleted. [0057]: the normalized log data in the normalized log file 40 is sorted in order of correction time 323. [0061]: the agent monitors multiple log files, inputs log data output in various formats, and then performs normalization to convert it into a common data format).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to employ the teachings of Fujino in the invention of Ezrielev in view of Zhang to include the above limitations. The motivation to do so would be to enable operators to analyze log data from multiple computers on the network based on a unified data format and time (Fujino: [0061]).
As per claims 3, 10 and 17, Ezrielev in view of Zhang and Fujino teaches:
The system according to claim 1, wherein the executable instructions cause the at least one processing device to determine that the training data has been manipulated based on determining, via the Huber loss estimator module, a deviation in the predictive output based on comparing the one or more data points associated with the predictive output with the one or more patterns associated with the historical data (Zhang: [0110]: It can be understood that the error of the loss function refers to the degree of deviation between the historical real data corresponding to the training data calculated by the loss function and the predicted value obtained by the prediction model. Ezrielev: [0022]: making a determination regarding whether the quantification exceeds a quantification threshold; in a first instance of the determination in which the quantification exceeds the quantification threshold: treating the suspect set of training data as comprising the poisoned training data).
As per claims 4, 11 and 18, Ezrielev in view of Zhang and Fujino teaches:
The system according to claim 3, wherein the executable instructions cause the at least one processing device to: extract real-time external data associated with the predictive modeling from the data source; transmit the real-time external data through a pseudo free model to generate a pseudo free output; analyze the pseudo free output generated by the pseudo free model and the deviation determined by the Huber loss estimator module; and revalidate that the training data has been manipulated based on analyzing the pseudo free output generated by the pseudo free model and the deviation determined by the Huber loss estimator module (Ezrielev: [0076]: The second portion of the second instance of the AI model may have been trained using the suspect set of training data. [0077] A snapshot of the first instance of the AI model and a snapshot of the second instance of the AI model may be retrieved from snapshot database 212 and used for analysis process 214 to obtain a quantification. The quantification may also include a difference between inferences generated by the first instance of the AI model and inferences generated by the second instance of the AI model (given identical ingest data). [0079] The quantification may exceed the quantification threshold and, therefore, the suspect set of training data may be treated as including poisoned training data.).
As per claims 6, 13 and 20, Ezrielev in view of Zhang and Fujino teaches:
The system according to claim 1, wherein the executable instructions cause the at least one processing device to: receive actual data in real-time associated with the predictive modeling; and run the actual data through the data model secure from malfeasant manipulation to generate a real-time predictive modeling output (Ezrielev: [0087]: untainted trained AI model 218 may be used to generate a replacement inference for a poisoned inference (e.g., generated by the tainted trained AI model) by ingesting a portion of ingest data 202. The resulting trained updated instance of the AI model may be used to obtain unpoisoned inferences (e.g., replacement inferences and/or new inferences)).
As per claims 7 and 14, Ezrielev in view of Zhang and Fujino teaches:
The system according to claim 6, wherein the pseudo free model is the data model secure from malfeasant manipulation at a previous instance (Ezrielev: [0050]: When a poisoned data notification is identified, AI model manager may use the snapshots to (i) revert an existing AI model instance to a previous AI model instance that is not tainted by the poisoned data, (ii) update the previous AI model instance to obtain an updated AI model instance that is not tainted by the poisoned data, (iv) obtain replacement inferences using the updated AI model instance).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MADHURI R HERZOG whose telephone number is (571)270-3359. The examiner can normally be reached 8:30AM-4:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi Arani can be reached at (571)272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
MADHURI R. HERZOG
Primary Examiner
Art Unit 2438
/MADHURI R HERZOG/Primary Examiner, Art Unit 2438
Prosecution Insights