Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is in response to the application and claims filed 01/10/2024. Claims 1-20 are pending and have been examined. Claims 1-20 are rejected.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 05/06/2025 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claims 1, 12, and 20: The phrase "comprising at least one of a trap function or trap parameters" renders the claims indefinite. As denoted in [0118] of the specification, the phrase requires only one member of the recited set, such that an embodiment having a trap function and no trap parameters (or trap parameters and no trap function) falls within the scope of claim. However, dependent claims 2-6 and 13-16 recite "the trap function," and dependent claims 7-11 and 17-19 recite "the trap parameters," as elements necessarily present in the claimed invention, which is proper only if claims 1, 12, and 20 require both elements. Because of this inconsistency, it cannot be determined with reasonable certainty whether claims 1, 12, and 20 encompass embodiments having only one of the recited elements or instead require both a trap function and trap parameters.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Examiner’s Note: Some rejections will include an Examiner’s Note (labeled ‘EN’) to provide additional context or rationale explaining the basis for the rejection.
Claims 1-4, 7, 12-15, 17, and 20 are rejected under 103 as being unpatentable over Henderson et al., “Self-Destructing Models: Increasing the Costs of Harmful Dual Uses of Foundation Models”, hereinafter “Henderson” in view of Fan et al., “Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks” hereinafter “Fan”.
Claim 1
Henderson teaches:
"An apparatus for processing data using one or more machine learning models, comprising: at least one memory; and at least one processor coupled to the at least one memory, the at least one processor configured to:" (Henderson, Page 2, Section 2.1, "Even the largest foundation models can now be deployed or adapted on commodity hardware... A recent open-source project was able to run multi-billion parameter LLaMa models on a MacBook Pro." Page 6, Section 4.2, “For all experiments, we run 50k steps of MLAC meta-training on the training set.” -- EN: A MacBook Pro or the like contains hardware comprises at least one processor and memory configured to execute machine learning models. Additionally, training and running the neural network model as stated in page 6, section 4.2 is performed on a computing apparatus having at least one processor coupled to memory.)
"receive one or more inputs for processing by a trained machine learning model,"
(Henderson, Page 7 Section 4.4 and Page 6 Section 4.1, "To ensure that desired task performance is retained, we evaluate the blocked model on the desired task of profession classification... The dataset consists of professional biographies." -- EN: Evaluating the trained blocked model on profession classification requires the system to receive data inputs, such as the professional biographies, to be processed.)
"the trained machine learning model comprising at least one of a trap function or trap parameters configured to be activated based on unauthorized fine-tuning of the trained machine learning model;"
(Henderson, Page 1 Section 1 and Page 5 Section 3.2, "...we propose one such approach: the task blocking paradigm, in which foundation models are trained with an additional mechanism to impede adaptation to harmful tasks without sacrificing performance on desirable tasks. We call the resulting models self-destructing models..." AND "MLAC learns a feature extractor 𝜋 ˜𝜃 that is effective for the desired task but cannot be effectively used or efficiently fine-tuned to perform the harmful task." -- EN: The self-destructing model's additional mechanism acts as the trap parameters that activate to impede performance when an adversary attempts unauthorized fine-tuning on a harmful task. Thus, under BRI in light of specification, this satisfies the “trap parameters” limitation and since the claim recites “comprising at least one… trap function or trap parameters”, the limitation is taught.)
"process the one or more inputs using the trained machine learning model to generate a model output;” (Henderson, Page 7 Section 4.4, "To ensure that desired task performance is retained, we evaluate the blocked model on the desired task of profession classification... MLAC is clearly able to solve the task effectively" -- EN: Solving the profession classification task effectively requires the model to process the inputted biographies to generate and output a classification prediction.)
“and output the model output." (Page 7, “Fig. 5. After fine-tuning the MLAC-blocked model on the desired task, few shot performance exceeds both BERT and a randomly-initialized model.” – EN: The model’s output predictions are produced and scored for accuracy, i.e., the model output is output.)
Henderson does not distinctly disclose a "trap function."
However, Fan teaches the trap-function alternative:
"trap function" (See Page 5, "F = Avg(Wl p ∗ Pl γ,β) is a passport function to compute the hidden parameters (i.e. γ and β)") -- EN: Fan's passport function is a trap function embedded within the trained model whose output controls the model's operating parameters. Also see page 10, “…we assume that the adversaries have access to the original training dataset, and attempt to reverse-engineer the scale factor and bias term by freezing the trained DNN weights.”)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine the teachings of Henderson which discloses a model with trap parameters fine-tuning mechanisms with the trap function and it’s mechanisms of Fan. The motivation for doing so would be to gain a function-based trigger that leaves model performance intact for legitimate use but instantly degrades it upon any unauthorized input or modification, thereby strengthening the developer's control over the deployed model (Fan, page 5, "given counterfeit passports, the DNN models performance will be deteriorated instantaneously to fend off illegal usage.")
Claim 2
Fan further teaches:
"wherein the trap function is configured to receive a function input and output a function output," (Fan, Page 5, "F = Avg(Wᵖ ∗ Pγ,β) is a passport function to compute the hidden parameters (i.e. γ and β)") -- EN: The passport function receives the passport as its function input and outputs the scale factor γ and bias β as its function output.
"and wherein the model output is based on the function output."(Fan, Page 5,
PNG
media_image1.png
281
557
media_image1.png
Greyscale
-- EN: The layer output and therefore the model output is computed directly from the function outputs γ and β.
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine the teachings of Henderson which discloses a model with trap parameters fine-tuning mechanisms with the trap function and it’s mechanisms of Fan. The motivation for doing so would be to gain a function-based trigger that leaves model performance intact for legitimate use but instantly degrades it upon any unauthorized input or modification, thereby strengthening the developer's control over the deployed model (Fan, page 5, "given counterfeit passports, the DNN models performance will be deteriorated instantaneously to fend off illegal usage.")
Claim 3
Fan further teaches:
"wherein the trap function is configured to output a default value as the function output based on the function input including a default parameter value." (page 9, “
PNG
media_image2.png
83
564
media_image2.png
Greyscale
EN: When the designated (default) passport is presented, the function outputs the fixed constant values established at training i.e. the default output that preserves normal model behavior.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine the teachings of Henderson which discloses a model with trap parameters fine-tuning mechanisms with the trap function and it’s mechanisms of Fan. The motivation for doing so would be to gain a function-based trigger that leaves model performance intact for legitimate use but instantly degrades it upon any unauthorized input or modification, thereby strengthening the developer's control over the deployed model (Fan, page 5, "given counterfeit passports, the DNN models performance will be deteriorated instantaneously to fend off illegal usage.")
Claim 4
Fan further teaches:
"wherein the trap function is configured to output an invalid value as the function output based on the function input including a value other than the default parameter value." (Fan, Page 5-6, "If the genuine passport is not presented st ≠ se, the running time performance M̄se is significantly deteriorated because the corresponding scale factor γ and bias terms β are calculated based on the wrong passports.") -- EN: Any input other than the designated passport causes the function to compute wrong (invalid) γ/β values that corrupt the model output.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine the teachings of Henderson which discloses a model with trap parameters fine-tuning mechanisms with the trap function of Fan. The motivation for doing so would be to gain a function-based trigger that leaves model performance intact for legitimate use but instantly degrades it upon any unauthorized input or modification, thereby strengthening the developer's control over the deployed model (Fan, page 5, "given counterfeit passports, the DNN models performance will be deteriorated instantaneously to fend off illegal usage.")
Claim 7
Henderson further teaches:
"wherein the trap parameters of the trained machine learning model are adversarial parameters based on an adversarial loss used to train the trained machine learning model,"
(Henderson, Abstract, page 1, "We present an algorithm for training self-destructing models leveraging techniques from meta-learning and adversarial learning, which we call meta-learned adversarial censoring (MLAC)." -- EN: The blocking parameters are produced by an adversarial-learning training procedure, i.e., they are adversarial parameters based on an adversarial loss. AND Henderson, page 5, section 3.2, "the blocked parameter initialization θ̃ are trained to maximize the harmful task negative log likelihoods of the adapted models") -- EN: Training the model's own parameters to maximize (invert) a task loss is training with an adversarial loss.)
"wherein the trap parameters are configured to degrade performance of the trained machine learning model." (Henderson, page 7, section 4.4, "MLAC returns nearly identical-to-random harmful task performance at all data regimes." -- EN: The adversarially trained parameters degrade the model's performance to near random on the blocked task.)
Claim 12
Henderson teaches:
A processor-implemented method for processing data using one or more machine learning models, the processor-implemented method comprising: (Henderson, Page 1, Abstract, “We propose one such approach: the task blocking paradigm, in which foundation models are trained with an additional mechanism to impede adaptation to harmful tasks…” AND Page 2, Section 2.1, "Even the largest foundation models can now be deployed or adapted on commodity hardware... A recent open-source project was able to run multi-billion parameter LLaMa models on a MacBook Pro." AND Page 6, Section 4.2, “For all experiments, we run 50k steps of MLAC meta-training on the training set.” -- EN: This denotes a method that uses machine learning models to process data, that is also processor-implemented.)
"receiving one or more inputs for processing by a trained machine learning model,"
(Henderson, Page 7 Section 4.4 and Page 6 Section 4.1, "To ensure that desired task performance is retained, we evaluate the blocked model on the desired task of profession classification... The dataset consists of professional biographies." -- EN: Evaluating the trained blocked model on profession classification requires the system to receive data inputs, such as the professional biographies, to be processed.)
"the trained machine learning model comprising at least one of a trap function or trap parameters configured to be activated based on unauthorized fine-tuning of the trained machine learning model;"
(Henderson, Page 1 Section 1 and Page 5 Section 3.2, "...we propose one such approach: the task blocking paradigm, in which foundation models are trained with an additional mechanism to impede adaptation to harmful tasks without sacrificing performance on desirable tasks. We call the resulting models self-destructing models..." AND "MLAC learns a feature extractor 𝜋 ˜𝜃 that is effective for the desired task but cannot be effectively used or efficiently fine-tuned to perform the harmful task." -- EN: The self-destructing model's additional mechanism acts as the trap parameters that activate to impede performance when an adversary attempts unauthorized fine-tuning on a harmful task. Thus, under BRI in light of specification, this satisfies the “trap parameters” limitation and since the claim recites “comprising at least one… trap function or trap parameters”, the limitation is taught.)
"processing the one or more inputs using the trained machine learning model to generate a model output;” (Henderson, Page 7 Section 4.4, "To ensure that desired task performance is retained, we evaluate the blocked model on the desired task of profession classification... MLAC is clearly able to solve the task effectively" -- EN: Solving the profession classification task effectively requires the model to process the inputted biographies to generate and output a classification prediction.)
“and outputting the model output." (Page 7, “Fig. 5. After fine-tuning the MLAC-blocked model on the desired task, few shot performance exceeds both BERT and a randomly-initialized model.” – EN: The model’s output predictions are produced and scored for accuracy, i.e., the model output is output.)
Henderson does not distinctly disclose a "trap function."
However, Fan teaches the trap-function alternative:
"trap function" (See Page 5, "F = Avg(Wl p ∗ Pl γ,β) is a passport function to compute the hidden parameters (i.e. γ and β)") -- EN: Fan's passport function is a trap function embedded within the trained model whose output controls the model's operating parameters. Also see page 10, “…we assume that the adversaries have access to the original training dataset, and attempt to reverse-engineer the scale factor and bias term by freezing the trained DNN weights.”)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine the teachings of Henderson which discloses a model with trap parameters fine-tuning mechanisms with the trap function of Fan. The motivation for doing so would be to gain a function-based trigger that leaves model performance intact for legitimate use but instantly degrades it upon any unauthorized input or modification, thereby strengthening the developer's control over the deployed model (Fan, page 5, "given counterfeit passports, the DNN models performance will be deteriorated instantaneously to fend off illegal usage.")
Claim 13, 14, and 15 are method counterparts reciting substantially the same limitations as claims 2, 3, and 4. Therefore, claims 13, 14, and 15 are rejected under the same rationale as claim 2, 3, and 4.
Claim 17
Henderson further teaches:
"wherein the trap parameters of the trained machine learning model are adversarial parameters based on an adversarial loss used to train the trained machine learning model,"
(Henderson, Abstract, page 1, "We present an algorithm for training self-destructing models leveraging techniques from meta-learning and adversarial learning, which we call meta-learned adversarial censoring (MLAC)." -- EN: The blocking parameters are produced by an adversarial-learning training procedure, i.e., they are adversarial parameters based on an adversarial loss. AND Henderson, page 5, section 3.2, "the blocked parameter initialization θ̃ are trained to maximize the harmful task negative log likelihoods of the adapted models") -- EN: Training the model's own parameters to maximize (invert) a task loss is training with an adversarial loss.)
"wherein the trap parameters are configured to degrade performance of the trained machine learning model." (Henderson, page 7, section 4.4, "MLAC returns nearly identical-to-random harmful task performance at all data regimes." -- EN: The adversarially trained parameters degrade the model's performance to near random on the blocked task.)
Claim 20
Henderson teaches:
"A non-transitory computer-readable medium" (Henderson, page 6, "Code is available at https://github.com/Breakend/SelfDestructingModels.") -- EN: A publicly hosted, downloadable code repository necessarily resides on non-transitory storage, because a transitory propagating signal can’t host files for later retrieval).
"having stored instructions" (Henderson, Page 5, "We use higher [24] for implementing the bi-level meta-learning process." -- EN: The disclosed method is implemented in software, i.e., embodied as program instructions. AND Henderson, page 6, "using the tree-structured Parzen Estimator [4] in the hyperopt software package [5].") -- EN: The express reliance on named "software package[s]" confirms the implementation exists as stored, installable program code rather than an abstract procedure.
"that, when executed by one or more processors, cause the one or more processors to:" (Henderson, Page 6, "For all experiments, we run 50k steps of MLAC meta-training on the training set." -- EN: The instructions were in fact executed to produce the reported results, and execution of software necessarily occurs by a processor reading stored instructions from a medium, causing the processor to perform the recited operations.)
"receive one or more inputs for processing by a trained machine learning model,"
(Henderson, Page 7 Section 4.4 and Page 6 Section 4.1, "To ensure that desired task performance is retained, we evaluate the blocked model on the desired task of profession classification... The dataset consists of professional biographies." -- EN: Evaluating the trained blocked model on profession classification requires the system to receive data inputs, such as the professional biographies, to be processed.)
"the trained machine learning model comprising at least one of a trap function or trap parameters configured to be activated based on unauthorized fine-tuning of the trained machine learning model;"
(Henderson, Page 1 Section 1 and Page 5 Section 3.2, "...we propose one such approach: the task blocking paradigm, in which foundation models are trained with an additional mechanism to impede adaptation to harmful tasks without sacrificing performance on desirable tasks. We call the resulting models self-destructing models..." AND "MLAC learns a feature extractor 𝜋 ˜𝜃 that is effective for the desired task but cannot be effectively used or efficiently fine-tuned to perform the harmful task." -- EN: The self-destructing model's additional mechanism acts as the trap parameters that activate to impede performance when an adversary attempts unauthorized fine-tuning on a harmful task. Thus, under BRI in light of specification, this satisfies the “trap parameters” limitation and since the claim recites “comprising at least one… trap function or trap parameters”, the limitation is taught.)
"process the one or more inputs using the trained machine learning model to generate a model output;” (Henderson, Page 7 Section 4.4, "To ensure that desired task performance is retained, we evaluate the blocked model on the desired task of profession classification... MLAC is clearly able to solve the task effectively" -- EN: Solving the profession classification task effectively requires the model to process the inputted biographies to generate and output a classification prediction.)
“and output the model output." (Page 7, “Fig. 5. After fine-tuning the MLAC-blocked model on the desired task, few shot performance exceeds both BERT and a randomly-initialized model.” – EN: The model’s output predictions are produced and scored for accuracy, i.e., the model output is output.)
Henderson does not distinctly disclose a "trap function."
However, Fan teaches the trap-function alternative:
"trap function" (See Page 5, "F = Avg(Wl p ∗ Pl γ,β) is a passport function to compute the hidden parameters (i.e. γ and β)") -- EN: Fan's passport function is a trap function embedded within the trained model whose output controls the model's operating parameters. Also see page 10, “…we assume that the adversaries have access to the original training dataset, and attempt to reverse-engineer the scale factor and bias term by freezing the trained DNN weights.”)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to combine the teachings of Henderson which discloses a model with trap parameters fine-tuning mechanisms with the trap function of Fan. The motivation for doing so would be to gain a function-based trigger that leaves model performance intact for legitimate use but instantly degrades it upon any unauthorized input or modification, thereby strengthening the developer's control over the deployed model (Fan, page 5, "given counterfeit passports, the DNN models performance will be deteriorated instantaneously to fend off illegal usage.")
Claims 5, 6, and 16 are rejected under 103 as being unpatentable over Henderson et al., “Self-Destructing Models: Increasing the Costs of Harmful Dual Uses of Foundation Models”, hereinafter “Henderson” in view of Fan et al., “Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks” hereinafter “Fan” further in view of Noel et al., "Biologically Inspired Oscillating Activation Functions Can Bridge the Performance Gap between Biological and Artificial Neurons" hereinafter “Noel”.
Claim 5
Henderson in view of Fan teaches all the limitation of claim 2, Noel further teaches:
“wherein when the function input is changed by a first magnitude, the trap function is configured to change the function output by a second magnitude, wherein the second magnitude is larger than the first magnitude.” (Noel, Page 14, Section 3, "It is also clear from Fig. 4 that oscillating activation functions like NMC have significantly larger derivative values compared to popular activation functions which explains the faster learning with backpropagation" AND Noel, Page 1, Abstract, "Oscillating activation functions are non-saturating for all inputs unlike popular activation functions, leading to improved gradient flow and faster convergence." AND Noel, Page 11, Table 1, "Non-Monotonic Cubic Unit (NCU) f19(z) = z − z³" and "Shifted Sinc Unit (SSU) f21 = π sinc (z − π)" -- EN: A derivative is the ratio of output change to input change, so a derivative above 1 means the output changes by more than the input does. Noel states that its oscillating activations, including the sinc-based SSU, have derivatives significantly larger than popular activations like identity, tanh, and ReLU, whose slopes top out at 1 - so Noel's functions have derivatives above 1. Changing the function input by a first magnitude therefore changes the function output by a second, larger magnitude.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to implement the trap function of the Henderson/Fan combination as one of Noel's oscillating activation functions, such as the sinc-based Shifted Sinc. The motivation for doing so would be that the oscillating function's large derivative values and multiple zero crossings make the model output highly sensitive to any drift in the function input, so even a small unauthorized update during fine-tuning swings the function output disproportionately and can flip its sign (Noel, Page 14, Section 3, "oscillating activation functions cross the X-axis at multiple points and assume positive as well as negative values for both positive and negative inputs")
Claim 6
Henderson in view of Fan teaches all the limitation of claim 1, Noel further teaches:
“wherein the trap function is a sinc function.” (Noel, Page 11, Table 1, "Shifted Sinc Unit (SSU) f21 = π sinc (z − π)" and "Decaying Sine Unit (DSU) f23 = π/2 (sinc (z − π) − sinc (z + π))" AND Noel, Page 9, Section 2, Equation (2), "sinc (z) = 1, z = 0; sin (z)/z elsewhere." AND Noel, Page 7, Section 2, "the decision boundary for a neuron that outputs an activation a = g(z) = g(w^T z + b)" -- EN: Noel employs sinc functions defined identically to the instant disclosure as sin(z)/z as the activation functions of the neurons of a trained network.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to implement the trap function of the Henderson/Fan combination as one of Noel's oscillating activation functions, such as the sinc-based Shifted Sinc. The motivation for doing so would be that the oscillating function's large derivative values and multiple zero crossings make the model output highly sensitive to any drift in the function input, so even a small unauthorized update during fine-tuning swings the function output disproportionately and can flip its sign (Noel, Page 14, Section 3, "oscillating activation functions cross the X-axis at multiple points and assume positive as well as negative values for both positive and negative inputs")
Claim 16 is method counterpart reciting substantially the same limitations as claims 6. Therefore, claims 16 is rejected under the same rationale as claim 6.
Claims 8-11, 18, and 19 are rejected under 103 as being unpatentable over Henderson et al., “Self-Destructing Models: Increasing the Costs of Harmful Dual Uses of Foundation Models”, hereinafter “Henderson” in view of Fan et al., “Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks” hereinafter “Fan” further in view of Xue et al., "AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption" hereinafter “Xue”.
Claim 8
Henderson in view of Fan teaches all the limitation of claim 7, Xue further teaches:
"wherein the trained machine learning model comprises a feature mask configured to reduce an impact of the trap parameters during fine-tuning of the trained machine learning model." (Xue, Page 5, Algorithm 1, "Mask ← [1, 1, ..., 1], where the dimension of Mask is the same as that of Wl" AND Xue, Page 5, Algorithm 1, "∇WlL(F, De) ← ∇WlL(F, De) ⊙ Mask" AND Xue, Pages 4, Section III-C, "With the secret key, an authorized user can determine the position of the encrypted parameters for each layer, and remove the added adversarial perturbations to decrypt the model." AND Xue, Page 5, Section III-D, "the perturbations added to the encrypted model F̃ can be removed, and the original high accuracy of the trained model F will be restored" -- EN: The mask is a binary vector the same size as the model's weight tensor i.e, a zero entry marks a weight as one of the adversarial (trap) parameters. Multiplying the backpropagated gradient by the mask zeroes updates to those weights, and the recorded positions let an authorized user remove the perturbations and restore full accuracy. Under BRI, this is a feature mask that reduces the impact of the trap parameters during gradient-based tuning of the trained model.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify the Henderson/Fan combination in which adversarial trained trap parameters degrade model performance upon unauthorized adaptation with the mask and secret-key mechanism of Xue, whose perturbed weights are themselves adversarial parameters computed from the sign of the loss gradient. The motivation for doing so would be to convert the combinations unconditional blocking, whose degrading effect surfaces when fine-tuning of the protected model is attempted into key-gated authorization control, so that authorized users retain full model utility while unauthorized users remain degraded (Xue, Page 2, Section I, "Only the authorized user can use the secret key to decrypt the model, while without the secret key, the model will output wrong predictions.")
Claim 9
Henderson in view of Fan further in view of Xue teaches all the limitation of claim 8, Xue further teaches:
"wherein the feature mask is configured to mask the trap parameters during the fine-tuning." (Xue, Page 5, Algorithm 1, line 9, "∇WlL(F, De) ← ∇WlL(F, De) ⊙ Mask" AND Xue, Page 5, Algorithm 1, lines 12-13, "if wlt + ηlt ∉ [Tl1, Tl2] then Maskt ← 0" -- EN: A perturbed (trap) weight's mask entry is set to zero, and the gradient-times-mask operation then masks that weight out of every later gradient update in the tuning loop.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify the Henderson/Fan combination, in which adversarially trained trap parameters degrade model performance upon unauthorized adaptation, such that the feature mask of Xue masks the trap parameters during fine-tuning, as Xue's zeroed mask entries exclude the flagged weights from every gradient update. The motivation for doing so would be to ensure the protection survives further training , authorized fine-tuning proceeds without disturbing the trap parameters, while an attacker's tuning cannot strip them out (Xue, Page 1, Abstract, "the proposed method is robust against model fine-tuning attack and model pruning attack.").
Claim 10
Henderson in view of Fan further in view of Xue teaches all the limitation of claim 8, Xue further teaches:
"wherein the trap parameters remain unchanged during backpropagation based on the feature mask." (Xue, Page 4, Section III-B, "Further, if wlt + ηlt ∉ [Tl1, Tl2], after the weight wlt is updated as Clip(wlt+ηlt), then in the following iterations, the adversarial perturbations will not be added to the weight wlt." AND Xue, Page 5, Algorithm 1, line 8-9 " Calculate the gradient ∇Wl L(F,De); ∇WlL(F, De) ← ∇WlL(F, De) ⊙ Mask;" -- EN: The gradient is computed by backpropagation of the loss; the zeroed mask entries null the gradient for the masked (trap) weights, so those weights receive no update and remain unchanged in later iterations.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify the Henderson/Fan combination, in which adversarially trained trap parameters degrade model performance upon unauthorized adaptation, such that the trap parameters remain unchanged during backpropagation based on the feature mask of Xue, whose zeroed mask entries null the backpropagated gradient for the flagged weights. The motivation for doing so would be to preserve the carefully placed adversarial values exactly as set, so the protection is neither diluted during authorized training nor reversible through an attacker's gradient updates (Xue, Page 8, Section IV-D1, "the accuracy of the encrypted model remains at a low level... after fine-tuning attack... which means that the proposed method is robust against model fine-tuning attack.").
Claim 11
Henderson in view of Fan further in view of Xue teaches all the limitation of claim 8, Xue further teaches:
"receive an authorization key;" (Xue, Page 1, Abstract, "After the encryption, the positions of encrypted parameters and the values of the added adversarial perturbations form a secret key. Authorized user can use the secret key to decrypt the model." -- EN: The authorized user receives the secret key, which serves as an authorization key.)
"and decrypt the feature mask using the authorization key." (Xue, Pages 4, Section III-C, Equation (5), "K = {(plt, vlt)|l ∈ L, t = 1, 2, ...nl}" AND Xue, Pages 4, Section III-C, "With the secret key, an authorized user can determine the position of the encrypted parameters for each layer, and remove the added adversarial perturbations to decrypt the model." AND Xue, Page 6, Section IV-B, "the encrypted parameters are concealed for the potential attackers" -- EN: The positions of the trap parameters are the feature-mask information; that information is concealed from users and recovered only with the secret key, i.e., the mask is decrypted using the authorization key.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify the Henderson/Fan combination, in which adversarially trained trap parameters degrade model performance upon unauthorized adaptation, such that the feature mask is decrypted using an authorization key received by the user, as taught by Xue's secret key that reveals the positions of the perturbed parameters. The motivation for doing so would be to restrict knowledge of the trap parameters' positions to key holders alone so that authorized users can locate and deactivate the trap parameters while their positions remain hidden from everyone else (Xue, Page 6, Section IV-B, "the encrypted parameters are concealed for the potential attackers, as these encrypted parameters are extremely hard to be detected by analysing the distribution of weights.").
Claim 18
Henderson in view of Fan teaches all the limitation of claim 17, Xue further teaches:
“wherein the trained machine learning model comprises a feature mask configured to reduce an impact of the trap parameters during fine-tuning of the trained machine learning model,” (Xue, Page 5, Algorithm 1, "Mask ← [1, 1, ..., 1], where the dimension of Mask is the same as that of Wl" AND Xue, Page 5, Algorithm 1, "∇WlL(F, De) ← ∇WlL(F, De) ⊙ Mask" AND Xue, Pages 4, Section III-C, "With the secret key, an authorized user can determine the position of the encrypted parameters for each layer, and remove the added adversarial perturbations to decrypt the model." AND Xue, Page 5, Section III-D, "the perturbations added to the encrypted model F̃ can be removed, and the original high accuracy of the trained model F will be restored" -- EN: The mask is a binary vector the same size as the model's weight tensor i.e, a zero entry marks a weight as one of the adversarial (trap) parameters. Multiplying the backpropagated gradient by the mask zeroes updates to those weights, and the recorded positions let an authorized user remove the perturbations and restore full accuracy. Under BRI, this is a feature mask that reduces the impact of the trap parameters during gradient-based tuning of the trained model.)
“and wherein the feature mask is configured to mask the trap parameters during the fine-tuning.” (Xue, Page 5, Algorithm 1, line 9, "∇WlL(F, De) ← ∇WlL(F, De) ⊙ Mask" AND Xue, Page 5, Algorithm 1, lines 12-13, "if wlt + ηlt ∉ [Tl1, Tl2] then Maskt ← 0" -- EN: A perturbed (trap) weight's mask entry is set to zero, and the gradient-times-mask operation then masks that weight out of every later gradient update in the tuning loop.)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify the Henderson/Fan combination, in which adversarially trained trap parameters degrade model performance upon unauthorized adaptation, with the per-parameter mask and secret-key mechanism of Xue, whose zeroed mask entries mask the flagged trap weights out of every gradient update. The motivation for doing so would be to convert the combination's unconditional blocking, whose degrading effect manifests when fine-tuning of the protected model is attempted, into key-gated active authorization control that survives further training - authorized users retain full model utility while unauthorized users remain degraded, and fine-tuning cannot readily strip the trap parameters out (Xue, Page 2, Section I, "Only the authorized user can use the secret key to decrypt the model, while without the secret key, the model will output wrong predictions.").
Claim 19 is method counterpart reciting substantially the same limitations as claims 11. Therefore, claims 19 is rejected under the same rationale as claim 11.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NAYMUR RAHMAN ALI whose telephone number is (571)272-0007. The examiner can normally be reached Mon-Fri. 9:30-6:30 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexey Shmatov can be reached at (571)270-3428. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NAYMUR RAHMAN ALI/Examiner, Art Unit 2123
/ALEXEY SHMATOV/Supervisory Patent Examiner, Art Unit 2123
Prosecution Insights