DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claim 20 is objected to because of the following informalities:
The claim recites the limitation:
“… one or more computer memory devices interoperably coupled with the one or more computers …” (emphasis added).
The bolded feature appears to be misspelled and therefore, the limitation is interpreted as the following:
“… one or more computer memory devices and interoperable with the one or more computers …”.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claims 1, 14, 20 recite the limitation “… processing sample data of the initial samples to obtain transform samples that form a transform sample set, wherein each of the transform samples comprises an exogenous feature absent from sample data of the initial samples; …” (emphasis added to accentuate insufficient antecedent basis). It is unclear if the second instance of “sample data” refers to the first instance or refers to a new instance separate from the first instance.
For the purposes of examination, the limitation is interpreted as the following:
“… processing sample data of the initial samples to obtain transform samples that form a transform sample set, wherein each of the transform samples comprises an exogenous feature absent from the processed sample data of the initial samples; …”.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 13-15, 20 are rejected under 35 U.S.C. 103 as being unpatentable over Gu et al., hereinafter referred to as Gu (US 2019/0370440 A1) in view of Ateniese et al., hereinafter referred to as Ateniese (“Hacking Smart Machines with Smarter Ones: How to Extract Meaningful Data from Machine Learning Classifiers”; Published: 2013; Pgs. 30; URL: https://arxiv.org/pdf/1306.4447).
As per claim 1, Gu discloses a computer-implemented method (Gu: Abstract.) comprising:
selecting initial samples from an initial sample set to form a selected sample set (Gu: Para. [0056] discloses “the algorithm samples a data item [selecting initial samples] from the training dataset [initial sample set] … In this way, the algorithm generates both watermarks and crafted labels Dwm [to form a selected sample set]”.);
processing sample data of the initial samples to obtain transform samples that form a transform sample set (Gu: Para. [0056] discloses “generates corresponding watermarked data item [processing sample data of the initial samples to obtain transform samples] based on the training dataset … In this way, the algorithm generates both watermarks and crafted labels Dwm [that form a transform sample set]”), wherein each of the transform samples comprises an exogenous feature absent from sample data of the initial samples (Gu: Para. [0049] discloses “the owner takes an image from training data as an input and adds a sample logo 'TEST' on it [wherein each of the transform samples comprises an exogenous feature] … images that lack the watermark [absent from sample data of the initial samples]”.);
(Gu: Para. [0056] discloses “The DNN model [claimed target model] is trained with both original training data Dtrain [claimed remaining sample set] and Dwm [claimed transform sample set]”.),
determining, (Gu: Para. [0041] discloses “verify whether the service t' comes from (i.e., utilizes) the model m [claimed determining … whether the suspicious model is stolen from a deployment model].”; and Gu: Para. [0049] discloses “any DNN model that can be triggered by this string should be a reproduction or derivation of the protected model [claimed wherein the deployment model has feature knowledge of the exogenous feature].”).
However, Gu does not explicitly disclose “… training a meta-classifier based on a target model, an auxiliary model, and the transform sample set, wherein the auxiliary model is trained by using the initial sample set … and the meta-classifier identifies feature knowledge of the exogenous feature; inputting data associated with a suspicious model into the meta-classifier; determining, based on an output result of the meta-classifier …”.
Further, Ateniese is in the same field of endeavor and teaches training a meta-classifier based on a target model, an auxiliary model, and the transform sample set, wherein the auxiliary model is trained by using the initial sample set […] and the meta-classifier identifies feature knowledge of the exogenous feature (Ateniese: Page 5 discloses “We define the training dataset D … C is a generic machine learning classifier trained on D … Each classifier C can be encoded in a set of feature vectors that can be used as input to train a meta-classifier MC. and Ateniese: Page 6, Figure 1 illustrates building the meta-classifier training set using classifiers trained on datasets with or without property P. This maps to training a meta-classifier using classifiers with the specific property (i.e., target model with the exogenous feature) and without the property (i.e., auxiliary model trained on initial samples). Furthermore, Ateniese: Page 17 discloses “The training samples of the classifier MC [claimed meta-classifier] are composed of all the support vectors [which encompass the claimed transform sample set] of the 70 classifiers, labeled according to the property P or not P [claimed meta-classifier identifies feature knowledge of the exogenous feature].” Therefore, training the meta-classifier using data points (such as support vectors) from the underlying classifiers, corresponding to the use of the transform sample set.);
inputting data associated with a suspicious model into the meta-classifier (Ateniese: Page 6 discloses “Next, the adversary uses the meta-classifier MC on Fcx [claimed inputting data associated with a suspicious model] to predict which class lx the classifier Cx belongs to.”); and
determining, based on an output result of the meta-classifier (Ateniese: Page 6 discloses using the meta-classifier to “predict which class lx the classifier Cx belongs to [claimed determining, based on an output result of the meta-classifier].”).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, and having the teachings of Gu and Ateniese before him or her, to modify the watermark-based model ownership verification system of Gu to include the meta-classifier evaluation framework feature as described in Ateniese. The motivation for doing so would have been to improve model protection by providing a configuration that reliably detects meaningful data from machine learning classifiers.
As per claim 2, Gu-Ateniese disclose the computer-implemented method according to claim 1,
wherein before the training a meta-classifier, the computer-implemented method further comprises:
determining the deployment model as the target model;
determining whether a model structure of the suspicious model is same as a model structure of the deployment model; and
in response to determining that the suspicious model is the same as the model structure of the deployment model, training the auxiliary model based on the model structure of the suspicious model; or
in response to determining that the model structure of the suspicious model is different from the model structure of the deployment model, training the target model and the auxiliary model based on the model structure of the suspicious model (Gu: Para. [0049] discloses “any DNN model that can be triggered by this string should be a reproduction or derivation of the protected model. [i.e., determining the deployment model as the target model]”).
As per claim 13, Gu-Ateniese disclose the computer-implemented method according to claim 1, wherein the sample data of the initial samples in the initial sample set are sample images, and wherein the processing sample data of the initial samples comprises:
performing style conversion on sample images of the initial samples in the selected sample set by using an image style converter to obtain a specified image style, wherein the exogenous feature is related to the specified image style (Gu: Paras. [0038], [0046] disclose digital watermarking is a technique that embeds certain watermarks in images and the framework assigns predefined labels [to obtain a specified image style] for different watermarks.).
As per claim 14, Gu discloses a non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations (Gu: Abstract) comprising:
selecting initial samples from an initial sample set to form a selected sample set (Gu: Para. [0056] discloses “the algorithm samples a data item [selecting initial samples] from the training dataset [initial sample set] … In this way, the algorithm generates both watermarks and crafted labels Dwm [to form a selected sample set]”.);
processing sample data of the initial samples to obtain transform samples that form a transform sample set (Gu: Para. [0056] discloses “generates corresponding watermarked data item [processing sample data of the initial samples to obtain transform samples] based on the training dataset … In this way, the algorithm generates both watermarks and crafted labels Dwm [that form a transform sample set]”), wherein each of the transform samples comprises an exogenous feature absent from sample data of the initial samples (Gu: Para. [0049] discloses “the owner takes an image from training data as an input and adds a sample logo 'TEST' on it [wherein each of the transform samples comprises an exogenous feature] ... images that lack the watermark [absent from sample data of the initial samples]”.);
(Gu: Para. [0056] discloses “The DNN model [claimed target model] is trained with both original training data Dtrain [claimed remaining sample set] and Dwm [claimed transform sample set]”.),
determining, (Gu: Para. [0041] discloses “verify whether the service t' comes from (i.e., utilizes) the model m [claimed determining … whether the suspicious model is stolen from a deployment model].”; and Gu: Para. [0049] discloses “any DNN model that can be triggered by this string should be a reproduction or derivation of the protected model [claimed wherein the deployment model has feature knowledge of the exogenous feature].”).
However, Gu does not explicitly disclose “… training a meta-classifier based on a target model, an auxiliary model, and the transform sample set, wherein the auxiliary model is trained by using the initial sample set … and the meta-classifier identifies feature knowledge of the exogenous feature; inputting data associated with a suspicious model into the meta-classifier; determining, based on an output result of the meta-classifier …”.
Further, Ateniese is in the same field of endeavor and teaches training a meta-classifier based on a target model, an auxiliary model, and the transform sample set, wherein the auxiliary model is trained by using the initial sample set […] and the meta-classifier identifies feature knowledge of the exogenous feature (Ateniese: Page 5 discloses “We define the training dataset D … C is a generic machine learning classifier trained on D … Each classifier C can be encoded in a set of feature vectors that can be used as input to train a meta-classifier MC. and Ateniese: Page 6, Figure 1 illustrates building the meta-classifier training set using classifiers trained on datasets with or without property P. This maps to training a meta-classifier using classifiers with the specific property (i.e., target model with the exogenous feature) and without the property (i.e., auxiliary model trained on initial samples). Furthermore, Ateniese: Page 17 discloses “The training samples of the classifier MC [claimed meta-classifier] are composed of all the support vectors [which encompass the claimed transform sample set] of the 70 classifiers, labeled according to the property P or not P [claimed meta-classifier identifies feature knowledge of the exogenous feature].” Therefore, training the meta-classifier using data points (such as support vectors) from the underlying classifiers, corresponding to the use of the transform sample set.);
inputting data associated with a suspicious model into the meta-classifier (Ateniese: Page 6 discloses “Next, the adversary uses the meta-classifier MC on Fcx [claimed inputting data associated with a suspicious model] to predict which class lx the classifier Cx belongs to.”); and
determining, based on an output result of the meta-classifier (Ateniese: Page 6 discloses using the meta-classifier to “predict which class lx the classifier Cx belongs to [claimed determining, based on an output result of the meta-classifier].”).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, and having the teachings of Gu and Ateniese before him or her, to modify the watermark-based model ownership verification system of Gu to include the meta-classifier evaluation framework feature as described in Ateniese. The motivation for doing so would have been to improve model protection by providing a configuration that reliably detects meaningful data from machine learning classifiers.
As per claim 15, The non-transitory, computer-readable medium according to claim 14, wherein before the training a meta-classifier, the operations further comprise:
determining the deployment model as the target model;
determining whether a model structure of the suspicious model is same as a model structure of the deployment model; and
in response to determining that the suspicious model is the same as the model structure of the deployment model, training the auxiliary model based on the model structure of the suspicious model; or
in response to determining that the model structure of the suspicious model is different from the model structure of the deployment model, training the target model and the auxiliary model based on the model structure of the suspicious model (Gu: Para. [0049] discloses “any DNN model that can be triggered by this string should be a reproduction or derivation of the protected model. [i.e., determining the deployment model as the target model]”).
As per claim 20, Gu discloses a computer-implemented system, comprising:
one or more computers (Gu: Para. [0073] discloses “techniques described herein are implemented in a special purpose computer, preferably in software executed by one or more processors”.); and
one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising (Gu: Paras. [0071]-[0073] disclose one or more computer memory devices interoperable and coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations.):
selecting initial samples from an initial sample set to form a selected sample set (Gu: Para. [0056] discloses “the algorithm samples a data item [selecting initial samples] from the training dataset [initial sample set] … In this way, the algorithm generates both watermarks and crafted labels Dwm [to form a selected sample set]”.);
processing sample data of the initial samples to obtain transform samples that form a transform sample set (Gu: Para. [0056] discloses “generates corresponding watermarked data item [processing sample data of the initial samples to obtain transform samples] based on the training dataset … In this way, the algorithm generates both watermarks and crafted labels Dwm [that form a transform sample set]”), wherein each of the transform samples comprises an exogenous feature absent from sample data of the initial samples (Gu: Para. [0049] discloses “the owner takes an image from training data as an input and adds a sample logo 'TEST' on it [wherein each of the transform samples comprises an exogenous feature] ... images that lack the watermark [absent from sample data of the initial samples]”.);
(Gu: Para. [0056] discloses “The DNN model [claimed target model] is trained with both original training data Dtrain [claimed remaining sample set] and Dwm [claimed transform sample set]”.),
determining, (Gu: Para. [0041] discloses “verify whether the service t' comes from (i.e., utilizes) the model m [claimed determining … whether the suspicious model is stolen from a deployment model].”; and Gu: Para. [0049] discloses “any DNN model that can be triggered by this string should be a reproduction or derivation of the protected model [claimed wherein the deployment model has feature knowledge of the exogenous feature].”).
However, Gu does not explicitly disclose “… training a meta-classifier based on a target model, an auxiliary model, and the transform sample set, wherein the auxiliary model is trained by using the initial sample set … and the meta-classifier identifies feature knowledge of the exogenous feature; inputting data associated with a suspicious model into the meta-classifier; determining, based on an output result of the meta-classifier …”.
Further, Ateniese is in the same field of endeavor and teaches training a meta-classifier based on a target model, an auxiliary model, and the transform sample set, wherein the auxiliary model is trained by using the initial sample set […] and the meta-classifier identifies feature knowledge of the exogenous feature (Ateniese: Page 5 discloses “We define the training dataset D … C is a generic machine learning classifier trained on D … Each classifier C can be encoded in a set of feature vectors that can be used as input to train a meta-classifier MC. and Ateniese: Page 6, Figure 1 illustrates building the meta-classifier training set using classifiers trained on datasets with or without property P. This maps to training a meta-classifier using classifiers with the specific property (i.e., target model with the exogenous feature) and without the property (i.e., auxiliary model trained on initial samples). Furthermore, Ateniese: Page 17 discloses “The training samples of the classifier MC [claimed meta-classifier] are composed of all the support vectors [which encompass the claimed transform sample set] of the 70 classifiers, labeled according to the property P or not P [claimed meta-classifier identifies feature knowledge of the exogenous feature].” Therefore, training the meta-classifier using data points (such as support vectors) from the underlying classifiers, corresponding to the use of the transform sample set.);
inputting data associated with a suspicious model into the meta-classifier (Ateniese: Page 6 discloses “Next, the adversary uses the meta-classifier MC on Fcx [claimed inputting data associated with a suspicious model] to predict which class lx the classifier Cx belongs to.”); and
determining, based on an output result of the meta-classifier (Ateniese: Page 6 discloses using the meta-classifier to “predict which class lx the classifier Cx belongs to [claimed determining, based on an output result of the meta-classifier].”).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, and having the teachings of Gu and Ateniese before him or her, to modify the watermark-based model ownership verification system of Gu to include the meta-classifier evaluation framework feature as described in Ateniese. The motivation for doing so would have been to improve model protection by providing a configuration that reliably detects meaningful data from machine learning classifiers.
Allowable Subject Matter
Claims 3-12, 16-19 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure and can be viewed in the list of references.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PEET DHILLON whose telephone number is (571)270-5647. The examiner can normally be reached M-F: 5am-1:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sath V. Perungavoor can be reached at 571-272-7455. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PEET DHILLON/Primary Examiner
Art Unit: 2488
Date: 06-09-2026
Prosecution Insights