Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION. The specification shall conclude with one or more claims particularly pointingout and distinctly claiming the subject matter which the inventor or a joint inventor regards as theinvention.
Claim 9 are rejected under 35 U.S.C. 112(b), as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim 9 recites ‘’programmed to only have access to an output or loss of the machine model” whereby it is unclear how to construe ‘have access to loss of machine-language model’ or how to construe ‘programmed to only have access to an output’. Appropriate clarification is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
Claims 1, 7, 9, 13, 15, 19-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over SUN et al. (US Pub. No: 2022-0100850) in view of XU et al. (US Pub. No: 2022-0058815).
As per Claim 1 SUN discloses A computer-implemented method for attacking a machine-learning model, comprising (Figs. 1-5, 8-9, 11 attack [0061-0063] [0070] [0073-0074] [0076-0078]):
(i) establishing a connection between a processor that is utilizing the machine-learning model, wherein the processor is in communication with a sensor located in a physical scene (Figs. 1-5, 8-9, 11 memory unit 306, processor 302 and models 310 [0031, 0043] sensor 16 for physical scenes as depicted [0061-0063] [0070] [0073-0074] [0076-0078]);
(ii) outputting, on a display device in the physical scene, an adversarial pattern, wherein the display device including the adversarial pattern is located in a sensor range of the sensor (Figs. 1-5, 8-9, 11 [0061-0062] [0070] [0073-0074] display 254 and sensor 16 – trigger pattern [0076-0078]);
(iii) obtaining, from the machine-learning model, a classification associated with the physical scene that includes the adversarial pattern (Figs. 1-5, 8-9, 11 [0042, 0044-0046] [0061-0062] classifier 24 [0070] [0073-0078]);
(iv) determining if a target classification has been met with a classification output from the machine-learning model (Figs. 1-5, 8-9, 11 determine for possible misclassification [0042, 0044-0046 [0061-0062] [0073-0074] classification of at least the classification of suspicious [0076-0078]);
(v) in response to the target classification not being met (Figs. 1-5, 8-9, 11 [0042, 0044-0046 [0061-0062] [0073-0074] [0076-0078]); and repeat steps (iii) through (iv) until the target classification has been met (Figs. 1-5, 8-9, 11 as depicted in Fig. 3 [0042, 0044-0046 [0061-0062] [0070] [0073-0074] [0076-0078])
SUN does not disclose but XU discloses outputting additional adversarial patterns at the display device (Figs. 3-5, 8, 10-11 display of additional patterns [0036, 0038] [0040-0041] [0048])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include outputting additional adversarial patterns at the display device as taught by XU into the system of SUN because of the benefit taught by XU to include track potential adversarial articles/scenarios and to further display additional adversarial related data to assist a user for training/machine-learning for LLM systems and to improve the system related features of SUN in the same field of endeavor.
As per Claim 7 SUN discloses The computer-implemented method of claim 1, wherein the adversarial pattern is located on a display (Fig. 2, 9-11 [0061-0062] [0077-0078]), monitor (either or), or speaker (either or) in a scene within the sensor range (Fig. 2, 9-11 sensor 16 display 254/302 [0061-0062] [0077-0078]).
As per Claim 9 SUN discloses The computer-implemented method of claim 1, wherein the processor is programmed to only have access to an output (Figs. 1-5, 8-9, 11 processor 302 – single output processing [0031, 0043] [0061-0063] [0070] [0073-0074] [0076-0078])
or loss of the machine-learning model for a given input associated with the machine-learning model (either or).
As per Claim 13 SUN discloses A system including an attack for a machine-learning network, comprising (Figs. 1-5, 8-9, 11 attack [0061-0063] [0070] [0073-0074] [0076-0078]):
a sensor, wherein the sensor includes either a camera, a microphone (one of), a radar (one of), a LiDar (one of), or any combination thereof (Figs. 1-5, 8-9, 11 [0031, 0043] sensor 16 camera [0061-0063] [0070] [0073-0074] [0076-0078]);
a display device located in the physical scene and configured to output one or more images (Figs. 1-5, 8-9, 11 [0061-0062] [0070] [0073-0074] display 254 and sensor 16 – trigger pattern [0076-0078]);
one or more processors in communication with the sensor and the display device, wherein the one or more processors are collectively programmed to (Figs. 1-5, 8-9, 11 memory unit 306, processor 302 and models 310 [0031, 0043] sensor 16 for physical scenes as depicted [0061-0063] [0070] [0073-0074] [0076-0078]):
(i) establish a connection with a machine-learning model (See said analysis for Claim 1); (ii) output, on the display device, an adversarial pattern (Figs. 1-5, 8-9, 11 memory unit 306, processor 302 and models 310 [0031, 0043] [0061-0063] [0070] [0073-0074] [0076-0078]), wherein the display device including the adversarial pattern is located in a sensor range of the sensor (See said analysis for Claim 1): (iii) obtain, from the machine-learning model, a classification associated with the physical scene that includes the adversarial pattern (See said analysis for Claim 1), wherein the classification is associated with both the sensor and the machine-learning model (Figs. 1-5, 8-9, 11 determine for possible misclassification [0042, 0044-0046 [0061-0062] [0073-0074] classification of suspicious [0076-0078]); (iv) determine if a target classification has been met with the classification output from the machine-learning model (See said analysis for Claim 1); (v) in response to the target classification not being met, and repeat steps (iii) through (iv) until the target classification has been met (See said analysis for Claim 1)
SUN does not disclose but XU discloses output additional adversarial patterns at the display device (See said analysis for Claim 1)
As per Claim 15 SUN discloses The system of claim 13, wherein an acoustic signal and the sensor is the microphone (Figs. 1-5, 8-9, 11 [0003, 0005] [0043]).
SUN does not disclose but XU discloses the adversarial pattern is an acoustic signal (Figs. 3-5, 8, 10-11 – Fig. 8 patterns [0029] [0036, 0038] patterns may be of audio [0080]) (The motivation that applied in Claim 1 applies equally to Claim 15)
As per Claim 19 SUN discloses The system of claim 13, wherein the one or more processors are programmed to (See said analysis for Claim 13)
SUN does not disclose but XU discloses create the adversarial pattern utilizing a black-box algorithm (Figs. 3-5, 8, 10-11 types used [0048]) (The motivation that applied in Claim 1 applies equally to Claim 19).
As per Claim 20 SUN discloses The system of claim 13, wherein the
SUN does not disclose but XU discloses adversarial pattern is generated to facilitate in regression, detection, segmentation, and recognition (Figs. 3-5, 8, 10-11 segment, tracking detection and recognition, regression [0040-0041]) (The motivation that applied in Claim 1 applies equally to Claim 20).
Allowable Subject Matter
REASON FOR ALLOWANCE
As per Claim 10, the following is an Examiner’s statement of reasons for allowance: the closest prior art obtained from an Examiner’s search (SUN, US Pub. No: 2022-0100850; XU, US Pub. No: 2022-0058815) does not teach nor suggest in detail the limitations:
“A computer-implemented method for attacking a machine-learning model, comprising: (i) establishing a connection between a processor that is utilizing the machine-learning model, wherein the processor is in communication with a sensor located in a scene; (ii) outputting, on a speaker located in the physical scene, an adversarial acoustic pattern, wherein the speaker that outputs the adversarial acoustic pattern is located in a sensor range of the sensor; (iii) obtaining, from the machine-learning model, a classification associated with the scene that includes the adversarial acoustic pattern; (iv) determining if a target classification has been met with a classification output from the machine-learning model; (v) in response to the target classification not being met, outputting additional adversarial acoustic patterns at the speaker and repeat steps (iii) through (iv) until the target classification has been met”
as well as the combination of all the limitations within the independent claims and the enabling portions of the specification.
The closest prior art of record SUN does not teach or suggest at least outputting on a speaker located in the physical scene, an adversarial acoustic pattern, or outputting an adversarial acoustic pattern located in a sensor range of the sensor. The prior art is also silent as to obtaining, from the machine-learning model, a classification associated with the scene that includes the adversarial acoustic pattern as presented by the Applicant.
SUN only discloses establishing a connection between a processor that is utilizing the machine-learning model, wherein the processor is in communication with a sensor located in a scene and determining if a target classification has been met with a classification output from the machine-learning model.
Whereas, as stated above, Applicant’s claimed invention recites a computer-implemented method for attacking a machine-learning model that includes establishing a connection between a processor that is utilizing the machine-learning model, wherein the processor is in communication with a sensor located in a scene as well as outputting, on a speaker located in the physical scene, an adversarial acoustic pattern, wherein the speaker that outputs the adversarial acoustic pattern is located in a sensor range of the sensor. Further, the invention claims obtaining, from the machine-learning model, a classification associated with the scene that includes the adversarial acoustic pattern and determining if a target classification has been met with a classification output from the machine-learning model. Finally, the claims recite that in response to the target classification not being met, outputting additional adversarial acoustic patterns at the speaker and repeating the above obtaining and above outputting until the target classification has been met.
So as indicated by the above statements, Applicant’s arguments and amendment have been considered persuasive, in light of the claim limitations as well as the enabling portions of the specification.
The dependent claims further limit the independent claims and are considered allowable on the same basis as the independent claims as well as for the further limitations set forth.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee. Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Claims 10-12 are allowed.
Claims 2-6, 8, 14, 16-18 is/are objected to as being dependent upon the rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claims 2-6, 8, 14, 16-18 is/are allowed. The following is an examiner’s statement of reasons for allowance:
As per Claim 2 the prior art of record either alone or in reasonable combination fails to teach or suggest “The computer-implemented method of claim 1, wherein the adversarial pattern is a red-green-blue image” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 3 the prior art of record either alone or in reasonable combination fails to teach or suggest “The computer-implemented method of claim 1, update the adversarial pattern with Bayesian optimization utilizing the objective function” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 4 the prior art of record either alone or in reasonable combination fails to teach or suggest “The computer-implemented method of claim 1, wherein the method includes adding a pause for a threshold pause time period after step (ii) ” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 5 the prior art of record either alone or in reasonable combination fails to teach or suggest “The computer-implemented method of claim 4, wherein the pause time period is dependent on whether a renderer is moving or static” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 6 the prior art of record either alone or in reasonable combination fails to teach or suggest “The computer-implemented method of claim 1, wherein the processor is programmed to not have knowledge of weights or parameters associated with the machine learning model” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 8 the prior art of record either alone or in reasonable combination fails to teach or suggest “The computer-implement method of claim 1, wherein the target classification includes a loss differential between the classification and the target classification indicating a class of the object established by an attacker” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 14 the prior art of record either alone or in reasonable combination fails to teach or suggest “The system of claim 13, wherein the one or more processors are programmed to not have access to parameters or weights associated with the machine-learning model” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 16 the prior art of record either alone or in reasonable combination fails to teach or suggest “The system of claim 13, wherein the adversarial pattern is an RGB image and the sensor is the camera” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 17 the prior art of record either alone or in reasonable combination fails to teach or suggest “The system of claim 16, wherein the RGB image includes video” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
As per Claim 18 the prior art of record either alone or in reasonable combination fails to teach or suggest “The system of claim 13, wherein the one or more processors are collectively programmed to pause for a pause period prior to obtaining the classification” These limitations in combination with the other limitations of the independent claim are thus deemed allowable.
The closest prior art of record SUN for Claims 2-6, 8, 14, 16-18 does not teach all the elements in combination with the other limitations of the independent claim. SUN only discloses establishing a connection between a processor that is utilizing the machine-learning model, wherein the processor is in communication with a sensor located in a scene and determining if a target classification has been met with a classification output from the machine-learning model.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee. Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to EILEEN M ADAMS whose telephone number is 571-270-3688. The examiner can normally be reached on Monday-Friday from 8:30am-5:00pm EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, William Vaughn can be reached on (571) 272-3922. The fax phone number for the organization where this application or proceeding is assigned is 571-270-4688.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have any questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/EILEEN M ADAMS/Primary Examiner, Art Unit 2481
Prosecution Insights