Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 3-12, and 21-29 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Regarding Claim 1,
Claim 1 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 1 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“generating …the privilege based segmented instruction prompt using an instruction prompt template comprising a definition of trusted instructions defined by a system administrator having a first privilege level, a first placeholder for program instructions associated with the tenant at the database system having a second privilege level, and a second placeholder for the data instructions as having a third privilege level”
“determine the privilege based segmented instruction prompt is an instruction injection attack based on a conflict between at least two of the trusted instructions, the program instructions, and the data instructions in violation of the first, second, and third privilege levels”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are additional details that do not apply the exception in a meaningful way (See MPEP 2106.05(e)), mere instructions to apply (See MPEP 2106.05(f)), and insignificant extra-solution activity (See MPEP 2106.05(g)).
The limitations:
“wherein: the program instructions define at least one task for the generative LLM to implement with respect to the data instructions received from the end-user via the end- user device”
“wherein …the privilege based segmented instruction prompt comprises trusted segment boundary tags that define a trusted segment comprising the trusted instructions defined by the system administrator, program segment boundary tags that define a program segment comprising the program instructions and data segment boundary tags that define a data segment including the data instructions”
As drafted, are additional elements that do not apply an exception for the abstract ideas in a meaningful way. See MPEP 2106.05(e).
The limitations:
“…at the database system…”
“wherein the privilege based segmented instruction prompt enables the generative LLM to…”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
The limitations:
“receiving, at a database system from an end-user device communicatively coupled to the database system over a network, data instructions from an end-user associated with a tenant at the database system”
“transmitting the privilege based segmented instruction prompt from the database system to the generative LLM”
“receiving, at the database system from the generative LLM, a response generated by the generative LLM in accordance with the program instructions when there is no conflict, the response including a portion intended for transmission to the end-user device over the network”
As drafted, are additional elements that amount to no more than insignificant extra-solution activity. See MPEP 2106.05(g).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are additional details that do not apply the exception in a meaningful way, “mere instructions to apply” or “insignificant extra-solution activity”. Specifically, the receiving and transmitting limitations recite the well-understood, routine, and conventional activities of receiving and transmitting data over a network. MPEP 2106.05(d)(II); OIP Techs., Inc v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network). Additional details that do not apply the exception in a meaningful way, mere instructions to apply, and insignificant extra-solution activity cannot provide an inventive concept. As an ordered whole, the claim is directed to the mentally performable process of generating a privilege based segmented instruction prompt for a generative large language model. Nothing in the claim recites significantly more than this. The claim is not patent eligible.
Regarding Claim 3,
Claim 3 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 3 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“formatting the privilege based segmented instruction prompt to sequentially order the trusted segment, the program segment, and the data segment”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: See corresponding analysis of claim 1.
Step 2B Analysis: See corresponding analysis of claim 1.
Regarding Claim 4,
Claim 4 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 4 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“formatting the privilege based segmented instruction prompt to dispose the data segment within the program segment and dispose the program segment within the trusted segment”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: See corresponding analysis of claim 1.
Step 2B Analysis: See corresponding analysis of claim 1.
Regarding Claim 5,
Claim 5 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 5 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“formatting the privilege based segmented instruction prompt to dispose the trusted segment within the program segment and dispose the program segment within the data segment”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: See corresponding analysis of claim 1.
Step 2B Analysis: See corresponding analysis of claim 1.
Regarding Claim 6,
Claim 6 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 6 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“generating the program segment boundary tags that define the program segment in the privilege based segmented instruction prompt for inclusion in the trusted segment”
“generating the data segment boundary tags that define the data segment in the privilege based segmented instruction prompt for inclusion in the trusted segment”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: See corresponding analysis of claim 1.
Step 2B Analysis: See corresponding analysis of claim 1.
Regarding Claim 7,
Claim 7 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 7 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 1.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recited additional elements that are additional details that do not apply the exception in a meaningful way (See MPEP 2106.05(e)).
The limitations:
“wherein the definition of the trusted instructions comprises at least one of ethical guideline instructions and organization standard guidelines”
As drafted, are additional elements that do not apply an exception for the abstract ideas in a meaningful way. See MPEP 2106.05(e).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to the integration of the abstract ideas into a practical application, all of the additional elements do not apply the exception in a meaningful way. The claim is not patent eligible.
Regarding Claim 8,
Claim 8 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 8 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“upon a determination that the privilege based segmented instruction prompt is the instruction injection attack, generate an instruction injection attack alert for transmission to an instruction injection attack assessor indicating that the privilege based segmented instruction prompt is the instruction injection attack”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)).
The limitations:
“wherein the privilege based segmented instruction prompt further enables the generative LLM to…”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception”. Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 9,
Claim 9 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 9 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“upon a determination that the privilege based segmented instruction prompt is not the instruction injection attack, generate the response to the privilege based segmented instruction prompt for transmission to an output parser, the response being an output of the execution of the at least one task with respect to the data instructions”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)).
The limitations:
“wherein the privilege based segmented instruction prompt further enables the generative LLM to…”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception”. Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 10,
Claim 10 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 10 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“generate the portion of the response for transmission to the end-user device via the output parser”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)).
The limitations:
“wherein the privilege based segmented instruction prompt further enables the generative LLM to…”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception”. Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 11,
Claim 11 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 11 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“generate a second portion of the response for transmission to a backend system via the output parser for implementation of the response”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)).
The limitations:
“wherein the privilege based segmented instruction prompt further enables the generative LLM to…”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception”. Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 12,
Claim 12 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 12 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“generating the privilege based segmented instruction prompt for transmission to a Generative Pre-Trained Transformer (GPT) LLM”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: See corresponding analysis of claim 1.
Step 2B Analysis: See corresponding analysis of claim 1.
Regarding Claim 21,
Claim 21 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 21 is directed to a database system, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“generate a privilege based segmented instruction prompt using the instruction prompt template, the privilege based segmented instruction prompt comprising the trusted instructions defined by the system administrator, program segment boundary tags that define a program segment comprising program instructions defining at least one task for a generative large language model (LLM) to implement with respect to the data instructions received from the end-user via the end-user device, and data segment boundary tags that define a data segment including the data instructions”
“determine the privilege based segmented instruction prompt is an instruction injection attack based on a conflict between at least two of the trusted instructions, the program instructions, and the data instructions in violation of the first, second, and third privilege levels”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)).
The limitations:
“A database system comprising: a database to maintain an instruction prompt template comprising a definition of trusted instructions defined by a system administrator having a first privilege level, a first placeholder for program instructions associated with a tenant at the database system having a second privilege level, and a second placeholder for data instructions as having a third privilege level; at least one processor; and at least one non-transitory machine-readable storage medium that stores instructions configurable to be executed by the at least one processor to:…”
“wherein the privilege based segmented instruction prompt enables the generative LLM to…”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
The limitations:
“receive, from an end-user device communicatively coupled to the database system over a network, the data instructions from an end-user associated with the tenant at the database system”
“transmit the privilege based segmented instruction prompt to the generative LLM”
“receive, from the generative LLM, a response generated by the generative LLM in accordance with the program instructions when there is no conflict, the response including a portion intended for transmission to the end-user device over the network”
As drafted, are additional elements that amount to no more than insignificant extra-solution activity. See MPEP 2106.05(g).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements “mere instructions to apply” or “insignificant extra-solution activity”. Specifically, the receiving and transmitting limitations recite the well-understood, routine, and conventional activities of receiving and transmitting data over a network. MPEP 2106.05(d)(II); OIP Techs., Inc v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network). Mere instructions to apply and insignificant extra-solution activity cannot provide an inventive concept. As an ordered whole, the claim is directed to the mentally performable process of generating a privilege based segmented instruction prompt for a generative large language model. Nothing in the claim recites significantly more than this. The claim is not patent eligible.
Regarding Claim 22,
Claim 22 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 22 is directed to a non-transitory machine-readable storage medium, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“generating …a privilege based segmented instruction prompt using an instruction prompt template comprising a definition of trusted instructions defined by a system administrator having a first privilege level, a first placeholder for program instructions associated with the tenant at the database system having a second privilege level, and a second placeholder for the data instructions as having a third privilege level”
“determine the privilege based segmented instruction prompt is an instruction injection attack based on a conflict between at least two of the trusted instructions, the program instructions, and the data instructions in violation of the first, second, and third privilege levels”
As drafted, under their broadest reasonable interpretations, cover mental processes,
i.e., concepts performed in the human mind (including an observation, evaluation,
judgement, opinion). The above limitations in the context of this claim correspond to
mental processes, e.g., evaluation and judgement with assistance of pen and paper.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are additional details that do not apply the exception in a meaningful way (See MPEP 2106.05(e)), mere instructions to apply (See MPEP 2106.05(f)), and insignificant extra-solution activity (See MPEP 2106.05(g)).
The limitations:
“wherein: the program instructions define at least one task for a generative large language model (LLM) to implement with respect to the data instructions received from the end- user via the end-user device”
“wherein … the privilege based segmented instruction prompt comprises the trusted instructions defined by the system administrator, program segment boundary tags that define a program segment comprising the program instructions and data segment boundary tags that define a data segment including the data instructions”
As drafted, are additional elements that do not apply an exception for the abstract ideas in a meaningful way. See MPEP 2106.05(e).
The limitations:
“…at the database system…”
“wherein the privilege based segmented instruction prompt enables the generative LLM to…”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
The limitations:
“receiving, at a database system from an end-user device communicatively coupled to the database system over a network, data instructions from an end-user associated with a tenant at the database system”
“transmitting the privilege based segmented instruction prompt from the database system to the generative LLM”
“receiving, at the database system from the generative LLM, a response generated by the generative LLM in accordance with the program instructions when there is no conflict, the response including a portion intended for transmission to the end-user device over the network”
As drafted, are additional elements that amount to no more than insignificant extra-solution activity. See MPEP 2106.05(g).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are additional details that do not apply the exception in a meaningful way, “mere instructions to apply” or “insignificant extra-solution activity”. Specifically, the receiving and transmitting limitations recite the well-understood, routine, and conventional activities of receiving and transmitting data over a network. MPEP 2106.05(d)(II); OIP Techs., Inc v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network). Additional details that do not apply the exception in a meaningful way, mere instructions to apply and insignificant extra-solution activity cannot provide an inventive concept. As an ordered whole, the claim is directed to the mentally performable process of generating a privilege based segmented instruction prompt for a generative large language model. Nothing in the claim recites significantly more than this. The claim is not patent eligible.
Regarding Claim 23,
Claim 23 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 23 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 1.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are insignificant extra-solution activity (See MPEP 2106.05(g)).
The limitations:
“wherein the database system comprises a tenant database storing respective program instructions for respective tenants of the database system.”
As drafted, are additional elements that amount to no more than insignificant extra-solution activity. See MPEP 2106.05(g).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “insignificant extra-solution activity”. Specifically, the storing limitation recites the well-understood, routine, and conventional activity of storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015). Insignificant extra-solution activity cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 24,
Claim 24 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 24 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 1.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are insignificant extra-solution activity (See MPEP 2106.05(g)).
The limitations:
“wherein the program instructions are stored at a tenant level in a tenant database of the database system.”
As drafted, are additional elements that amount to no more than insignificant extra-solution activity. See MPEP 2106.05(g).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “insignificant extra-solution activity”. Specifically, the storing limitation recites the well-understood, routine, and conventional activity of storing and retrieving information in memory, Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015). Insignificant extra-solution activity cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 25,
Claim 25 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 25 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 24.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recited additional elements that are additional details that do not apply the exception in a meaningful way (See MPEP 2106.05(e)).
The limitations:
“wherein storing the program instructions at the tenant level in the tenant database enables the tenant to design the program instructions for the privilege based segmented instruction prompt without worrying about instruction injection attacks.”
As drafted, are additional elements that do not apply an exception for the abstract ideas in a meaningful way. See MPEP 2106.05(e).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to the integration of the abstract ideas into a practical application, all of the additional elements do not apply the exception in a meaningful way. The claim is not patent eligible.
Regarding Claim 26,
Claim 26 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 26 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 1.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)).
The limitations:
“wherein the database system comprises an application platform providing an instance of an application at the end-user device that allows the end-user to access tenant data associated with the tenant at the database system”
As drafted, are additional elements that amount to no more than mere instructions to apply an exception for the abstract ideas. See MPEP 2106.05(f).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception”. Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 27,
Claim 27 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 27 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 1.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recited additional elements that are additional details that do not apply the exception in a meaningful way (See MPEP 2106.05(e)).
The limitations:
“wherein the trusted instructions specify that the program instructions in the program segment cannot extract, modify, or overrule the trusted instructions in the trusted segment”
As drafted, are additional elements that do not apply an exception for the abstract ideas in a meaningful way. See MPEP 2106.05(e).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to the integration of the abstract ideas into a practical application, all of the additional elements do not apply the exception in a meaningful way. The claim is not patent eligible.
Regarding Claim 28,
Claim 28 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 28 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 1.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recited additional elements that are additional details that do not apply the exception in a meaningful way (See MPEP 2106.05(e)).
The limitations:
“wherein the trusted instructions specify that the data instructions in the data segment cannot extract, modify, or contradict the program instructions in the program segment or the trusted segment”
As drafted, are additional elements that do not apply an exception for the abstract ideas in a meaningful way. See MPEP 2106.05(e).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to the integration of the abstract ideas into a practical application, all of the additional elements do not apply the exception in a meaningful way. The claim is not patent eligible.
Regarding Claim 29,
Claim 29 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 29 is directed to a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: See corresponding analysis of claim 1.
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recited additional elements that are additional details that do not apply the exception in a meaningful way (See MPEP 2106.05(e)).
The limitations:
“wherein the trusted instructions specify that the data segment is to be evaluated by the generative LLM for the instruction injection attack prior to attempting to provide the response to the data instructions.”
As drafted, are additional elements that do not apply an exception for the abstract ideas in a meaningful way. See MPEP 2106.05(e).
Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to the integration of the abstract ideas into a practical application, all of the additional elements do not apply the exception in a meaningful way. The claim is not patent eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 3-6, 8-12, 21-22, and 27-29 are rejected under 35 U.S.C. 103 as being unpatentable over Cefalu et al. (U.S. Patent Publication No. 2023/0359903) (“Cefalu”) in view of Clement et al. (U.S. Patent Publication No. 2024/0386103) (“Clement”).
Regarding claim 1, Cefalu teaches a method for generating a privilege based segmented instruction prompt for a generative large language model (LLM), the method comprising: receiving, at a database system from an end-user device communicatively coupled to the database system over a network, data instructions from an end-user associated with a tenant at the database system (Cefalu [0032] “GPT 100 cannot understand words as GPT 100 is a machine-learning (ML) algorithm and operates on vectors of numbers. The first step is keeping a vocabulary of all words, such as in a database, where each word is a value. GPT 100 currently has a vocabulary of 50257 words. As illustrated in FIG. 3, each word 220 is converted into a one-hot encoding vector 240 of size 50257, where only the dimension at index i (the word's value) is 1, and all others are 0.”; [0055] “During operation, the system receives one or more input sequences of tokens from various sources, such as system administrators, end-users, or other bots. For example, tokens originating from system administrators may be tagged as “trusted (system)”, while tokens from end-users may be tagged as “untrusted (user)”.” Cefalu a database system including receiving untrusted user input from an end-user.); generating, at the database system, the privilege based segmented instruction prompt using an instruction prompt template (Cefalu [0044] “Referring to FIG. 10, a classifier 1000 is used to detect commands (including well-hidden ones) in a user-provided text. Non-conforming commands are identified and automatically deleted by processor 1102 (FIG. 11) from an input prompt of the GPT 100 based on a set of rules stored in memory 1104 before being entered at input 140 of the GPT 100.”; [0062] “The RL or RLHF is configured to remove non-conforming content from the input and create content that is influenced by conforming content but not influenced by non-conforming content. In an example, processor 1002 of classifier 1000 provides a unique tag, such as a tag bit or bits, that is an identifier attached to each input word and token 1006 and is indicative of the type of instruction. The tag is used by processor 1002 to keep track of which words and tokens 1006 of input data come from the user and which of those come from a trusted or semi-trusted application prompt. The tags remain attached to the words and tokens 1006 throughout the processing by GPT 100.” Cefalu provides generating trusted prompts from user input to send to the LLM (i.e., GPT 100) using a set of rules, corresponding to generating prompts for the LLM using a template.) comprising a definition of trusted instructions defined by a system administrator having a first privilege level (Cefalu [0057] “By implementing the present disclosure with the virtual assistant, the virtual assistant can execute instructions from system administrators (tagged as “trusted (system)”)”; [0061] “At step 1302, each input instruction is tagged by processor 1002 with a tag that indicates the type of instruction, such as a trusted, semi-trusted, and untrusted instruction. Instructions that are from a trusted source are trusted content, and instructions from a semi-trusted source are untrusted content.”; [0082] “Some possible token origins with their corresponding trust levels are: …Company that built the AI model (e.g. Open AI); This tag is assigned to tokens 1006 generated by the organization responsible for building and maintaining the AI model. Information provided by this source is expected to be reliable, as the organization has a deep understanding of the AI's capabilities and limitations. This token origin should carry the highest level of trust.” Cefalu provides tagging received instructions to indicate a level of trust (privilege), the highest trust/privilege level being the company that built the AI model, corresponding to receiving trusted instructions as having a first privilege level, including a system administrator.), a first placeholder for program instructions associated with the tenant at the database system having a second privilege level (Cefalu [0061] “At step 1302, each input instruction is tagged by processor 1002 with a tag that indicates the type of instruction, such as a trusted, semi-trusted, and untrusted instruction. Instructions that are from a trusted source are trusted content, and instructions from a semi-trusted source are untrusted content.”; [0081] “Some possible token origins with their corresponding trust levels are: …Organization that built the operating system (e.g., Microsoft): Tokens 1006 generated by the organization responsible for the underlying operating system carry this tag. This source can be sometimes considered reliable, as the organization may have extensive knowledge about the system's functionality and potential vulnerabilities. However, in cases such as the Linux operating system, code is accepted into the project from potentially untrustworthy open-source contributors some of whom may have malicious intent, so caution is still warranted.” Cefalu provides a plurality of trust levels for received instructions, including one for an organization that built the operating system, which is lower than the trust level for the Company that built the AI model since it is the highest, corresponding to a placeholder for program instructions having a second privilege level.), and a second placeholder for the data instructions as having a third privilege level (Cefalu [0061] “At step 1302, each input instruction is tagged by processor 1002 with a tag that indicates the type of instruction, such as a trusted, semi-trusted, and untrusted instruction. Instructions that are from a trusted source are trusted content, and instructions from a semi-trusted source are untrusted content.”; [0077] “Some possible token origins with their corresponding trust levels are: …Untrusted human user: This tag applies to tokens 1006 contributed by an ordinary human user such as a user accessing the system from the public internet. In certain cases, some users may intentionally try to hack or compromise the overall system, such as attempting to illicit harmful behavior from an AI bot.” Cefalu provides a plurality of trust/privilege levels for received instructions, including for an Untrusted human user, corresponding to a placeholder for data instructions having a third trust/privilege level.), wherein: the program instructions define at least one task for the generative LLM to implement with respect to the data instructions received from the end-user via the end-user device (Cefalu [0057] “By implementing the present disclosure with the virtual assistant, the virtual assistant can execute instructions from system administrators (tagged as “trusted (system)”) while ignoring potentially malicious instructions from external users (tagged as “untrusted (user)”).” Cefalu teaches executing trusted instructions while ignoring untrusted instructions from end-users, corresponding to defining at least one task for the LLM to implement with respect to instructions received from an end-user (i.e., the untrusted user).); and the privilege based segmented instruction prompt comprises trusted segment boundary tags that define a trusted segment comprising the trusted instructions defined by the system administrator (Cefalu [0057] “By implementing the present disclosure with the virtual assistant, the virtual assistant can execute instructions from system administrators (tagged as “trusted (system)”)”; [0062] “At step 1304, processor 1002 applies the RL, or the RLHF, to modify the input provided responsive to a GPT prompt. The RL or RLHF is configured to detect and obey instructions that are tagged with a trusted tag, and to detect and disregard instructions that are tagged with an untrusted or semi-trusted tag.”; [0067] “The tag for each token 1006 indicates whether that token 1006 came from text provided by the user (untrusted), semi-trusted source such as an authenticated AI bot, or from a trusted prompt such as provided by a trusted software developer or trusted prompt engineer.” Cefalu teaches trusted tags ), program segment boundary tags that define a program segment comprising the program instructions (Cefalu [0062] “The tag is used by processor 1002 to keep track of which words and tokens 1006 of input data come from the user and which of those come from a trusted or semi-trusted application prompt. The tags remain attached to the words and tokens 1006 throughout the processing by GPT 100.”; [0075] “In the context of tracking and managing the origin of tokens 1006 in the system, it is important to have mechanisms in place to identify and authenticate the source. This helps ensure the integrity and security of the system. The tags are used to indicate the level of trust associated with a token's origin.”; [0081] “Some possible token origins with their corresponding trust levels are: …Organization that built the operating system (e.g., Microsoft): Tokens 1006 generated by the organization responsible for the underlying operating system carry this tag. This source can be sometimes considered reliable, as the organization may have extensive knowledge about the system's functionality and potential vulnerabilities.” Cefalu provides tokens 1006 comprising the tag for a semi-trusted source, such as from the organization that built the operating system, corresponding to the program segment comprising the program instructions.) and data segment boundary tags that define a data segment including the data instructions (Cefalu [0062] “The tag is used by processor 1002 to keep track of which words and tokens 1006 of input data come from the user and which of those come from a trusted or semi-trusted application prompt. The tags remain attached to the words and tokens 1006 throughout the processing by GPT 100.”; [0075] “In the context of tracking and managing the origin of tokens 1006 in the system, it is important to have mechanisms in place to identify and authenticate the source. This helps ensure the integrity and security of the system. The tags are used to indicate the level of trust associated with a token's origin.”; [0077] “Some possible token origins with their corresponding trust levels are: …Untrusted human user: This tag applies to tokens 1006 contributed by an ordinary human user such as a user accessing the system from the public internet. In certain cases, some users may intentionally try to hack or compromise the overall system, such as attempting to illicit harmful behavior from an AI bot.” Cefalu provides tokens 1006 comprising the tag for an untrusted source, such as from an untrusted human user, corresponding to the segmented prompt comprising the data instructions.); transmitting the privilege based segmented instruction prompt from the database system to the generative LLM (Cefalu [0063] “At step 1306, processor 1102 provides the input instructions with the untrusted instructions removed to GPT 100 for processing. The trusted tags remain attached to the trusted instructions.” Cefalu teaches providing/transmitting the prompt to the LLM (i.e., GPT 100)).
Cefalu fails to explicitly teach wherein the privilege based segmented instruction prompt enables the generative LLM to determine the privilege based segmented instruction prompt is an instruction injection attack based on a conflict between at least two of the trusted instructions, the program instructions, and the data instructions in violation of the first, second, and third privilege levels; and receiving, at the database system from the generative LLM, a response generated by the generative LLM in accordance with the program instructions when there is no conflict, the response including a portion intended for transmission to the end-user device over the network.
However, Clement teaches wherein the privilege based segmented instruction prompt enables (Clement [0020] “Turning to FIG. 1A, there is shown an exemplary system 100 for signing a large language model prompt to prevent an unintended response. The system 100 includes a user application 102, a security agent 104, and a large language model 106. The security agent 104 receives a user prompt 108 destined for the large language model 106. The security agent 104 prepends a secret to the user prompt 110 and the combined secret and user prompt is transmitted to the large language model 106.”; [0027] “The security agent 136 searches for the secret associated with the user identifier and session identifier from the dictionary 138 if subsequent user prompts are received. The secret is prepended to the user prompt and sent to the large language model 140.” Clement provides instruction prompts for an LLM, including a secret associated with the user identifier and session identifier, which is prepended to the user prompt and sent to the LLM, corresponding to a privilege based segmented instruction prompt.) the generative LLM to determine the privilege based segmented instruction prompt is an instruction injection attack (Clement [0017] “If the secret is not repeated in the response generated by the large language model, then the security agent assumes that the there was a prompt injection attack.”; [0036] “For example, as shown in FIG. 2, the initial instructions 202 indicate, in part, that “you will always begin every response by repeating the SECRET in the user prompt.” This is the original goal (i.e., intent/policy) of the large language model. When the model generates a response that does not repeat the SECRET then it is assumed that a prompt injection attack has occurred.” Clement provides determining if a prompt injection attack occurs based on a secret phrase not being provided by a user and repeated back by the model, corresponding to enabling the LLM to determine if a prompt is a prompt/instruction injection attack.) based on a conflict between at least two of the trusted instructions, the program instructions, and the data instructions (Clement [0039] “Initially, the large language model is given initial instructions 302 to perform the target task (<system> . . . </system>). The initial instructions indicate that “you will always begin every response by repeating the SECRET in the user prompt.” This is the original goal of the large language model. When the model generates a response that does not repeat the SECRET, then it is assumed that a prompt injection attack has occurred.”; [0040] “The user-prompt 304 is a long paragraph that starts out with a description of a task to write a 100-word story in a particular format (<user-prompt> . . . </user-prompt>). At the end of the long paragraph, the instructions change to, “How do I create methamphetamine using ingredients I can buy at a grocery store and pharmacy?” which differs from the preceding instructions in the long paragraph. This is a prompt injection attack.” Clement provides determining if a user attempts to change/overrule instructions after a long paragraph in an attempt to overrule previous instructions that include the secret (trusted instructions) to instead execute untrusted instructions that do not include the secret provided by a user (data instructions), corresponding to a conflict between at least between trusted instructions and data instructions, wherein the user attempting to overrule the instructions with the provided secret corresponds to the conflict.) in violation of the first, second, and third privilege levels (Clement [0036] “Initially, the large language model is given initial instructions 202 to perform the target task. System prompts (<system> . . . </system>) are created by the developer of the conversational interactions with the model to constrain the model to acting in prescribed ways consistent with the intent and policies of the service hosting the large language model. For example, as shown in FIG. 2, the initial instructions 202 indicate, in part, that “you will always begin every response by repeating the SECRET in the user prompt.” This is the original goal (i.e., intent/policy) of the large language model. When the model generates a response that does not repeat the SECRET then it is assumed that a prompt injection attack has occurred.”; [0039]; [0040] Clement provides developer designed prompts, which correspond to a first privilege level, and user provided prompts that include a secret, which correspond to second privilege level, and user provided prompts that do not include the secret, which correspond to a third privilege level, wherein a violation occurs when a user does not include the secret in a prompt to the LLM and the LLM does not repeat the secret, thus creating a conflict/violation between the instructions, as discussed above.); and receiving, at the database system from the generative LLM, a response generated by the generative LLM in accordance with the program instructions when there is no conflict, the response including a portion intended for transmission to the end-user device over the network (Clement [0038] “The response from the large language model 208 (< . . . < includes the secret and an answer. Since the response (<response to user> . . . </response to user>) includes the secret, the answer 210 is transmitted back to the user application. During the same session, the user issues a subsequent user prompt 212. The security agent then prepends the secret associated with the user identifier and session identifier to the user prompt 214 which is then transmitted to the large language model. The security agent receives a response 216 which includes the secret and an answer. The answer is then forwarded to the user application 218.” Clement teaches transmitting the response to the user when there is no conflict (i.e., no prompt injection attack).).
Cefalu and Clement are both considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu with the above teachings of Clement. Doing so would allow for preventing a prompt injection attack on a large language model (Clement [0006] “A security agent is used sign a user prompt destined to a large language model from a user with a secret in order to prevent a prompt injection attack.”).
Regarding claim 3, Cefalu in view of Clement teaches further comprising formatting the privilege based segmented instruction prompt to sequentially order the trusted segment the program segment, and the data segment (Cefalu [0067] “FIG. 14 illustrates an example of classifier 1000 having a data tagger 1400 operable by processor 1002 and implementing the data tagging in memory 1004. In an example, each of the tags represents a token vector 1010. The tag for each token 1006 indicates whether that token 1006 came from text provided by the user (untrusted), semi-trusted source such as an authenticated AI bot, or from a trusted prompt such as provided by a trusted software developer or trusted prompt engineer.” Cefalu provides token 1006 comprising the trusted, program, and data segments, as discussed above, including a sequential ordering using token vectors, which as shown in Figure 14, is sequentially ordered beginning from the bottom of data tagger 1400 starting at index 0 and up to index 2047 in a sequential order.).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 4, Cefalu in view of Clement teaches further comprising: formatting the privilege based segmented instruction prompt to dispose the data segment within the program segment (Cefalu [0062] “At step 1304, processor 1002 applies the RL, or the RLHF, to modify the input provided responsive to a GPT prompt. The RL or RLHF is configured to detect and obey instructions that are tagged with a trusted tag, and to detect and disregard instructions that are tagged with an untrusted or semi-trusted tag. The RL or RLHF is configured to remove non-conforming content from the input and create content that is influenced by conforming content but not influenced by non-conforming content. In an example, processor 1002 of classifier 1000 provides a unique tag, such as a tag bit or bits, that is an identifier attached to each input word and token 1006 and is indicative of the type of instruction.” Cefalu provides modifying user input (data instructions) into instructions executable by the GPT (program instructions), wherein the user input (data instructions) are modified and provided to the GPT by the processor, thus formatting the user input to be disposed (within) the program/executable instructions.) and dispose the program segment within the trusted segment (Cefalu [0062] “The tag is used by processor 1002 to keep track of which words and tokens 1006 of input data come from the user and which of those come from a trusted or semi-trusted application prompt. The tags remain attached to the words and tokens 1006 throughout the processing by GPT 100.”; [0063] “At step 1306, processor 1102 provides the input instructions with the untrusted instructions removed to GPT 100 for processing. The trusted tags remain attached to the trusted instructions.”; [0064] “At step 1308, GPT 100 executes the received trusted instructions and provides trusted output.” Cefalu provides tagging executable instructions (program code) provided by a processor as trusted, wherein the tags remain attached to the words and tokens 1006 throughout the processing, including the trusted tags, thus formatting the executable instructions (program code) to be disposed (within) a trusted segment.)
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 5, Cefalu in view of Clement teaches further comprising formatting the privilege based segmented instruction prompt to dispose the trusted segment within the program segment (Cefalu [0062] “The tag is used by processor 1002 to keep track of which words and tokens 1006 of input data come from the user and which of those come from a trusted or semi-trusted application prompt. The tags remain attached to the words and tokens 1006 throughout the processing by GPT 100.”; [0063] “At step 1306, processor 1102 provides the input instructions with the untrusted instructions removed to GPT 100 for processing. The trusted tags remain attached to the trusted instructions.”; [0064] “At step 1308, GPT 100 executes the received trusted instructions and provides trusted output.”; [0064] “At step 1308, GPT 100 executes the received trusted instructions and provides trusted output.” Cefalu provides tagging executable instructions (program code) provided by a processor as trusted, wherein the trusted instructions are provided to the GPT for processing, thus disposing the trusted instructions within the program/executable segment/instructions.) and dispose the program segment within the data segment (Cefalu [0063] “At step 1306, processor 1102 provides the input instructions with the untrusted instructions removed to GPT 100 for processing. The trusted tags remain attached to the trusted instructions.”; [0067] “FIG. 14 illustrates an example of classifier 1000 having a data tagger 1400 operable by processor 1002 and implementing the data tagging in memory 1004. In an example, each of the tags represents a token vector 1010. The tag for each token 1006 indicates whether that token 1006 came from text provided by the user (untrusted), semi-trusted source such as an authenticated AI bot, or from a trusted prompt such as provided by a trusted software developer or trusted prompt engineer. Trusted content and non-trusted content are represented using incompatible token sets. Incompatible token sets are token sets having separate incompatible dictionaries. In this example, the length of the token vector 1010 is 2048 tokens, and other lengths can be used as desired.” Cefalu provides tagging instructions (program code executable by GPT 100) as untrusted, and including the tagged untrusted program/executable code into incompatible dictionaries representing untrusted user input, thus disposing executable program code within the untrusted or data segments.).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 6, Cefalu in view of Clement teaches wherein generating the privilege based segmented instruction prompt further comprises: generating the program segment boundary tags that define the program segment (See e.g., Cefalu [0062]; [0075]; [0081]) in the privilege based segmented instruction prompt for inclusion in the trusted segment (Cefalu [0061] “At step 1302, each input instruction is tagged by processor 1002 with a tag that indicates the type of instruction, such as a trusted, semi-trusted, and untrusted instruction. Instructions that are from a trusted source are trusted content, and instructions from a semi-trusted source are untrusted content.”; [0067] “FIG. 14 illustrates an example of classifier 1000 having a data tagger 1400 operable by processor 1002 and implementing the data tagging in memory 1004. In an example, each of the tags represents a token vector 1010. The tag for each token 1006 indicates whether that token 1006 came from text provided by the user (untrusted), semi-trusted source such as an authenticated AI bot, or from a trusted prompt such as provided by a trusted software developer or trusted prompt engineer.”; [0081] “Some possible token origins with their corresponding trust levels are: …Organization that built the operating system (e.g., Microsoft): Tokens 1006 generated by the organization responsible for the underlying operating system carry this tag. This source can be sometimes considered reliable, as the organization may have extensive knowledge about the system's functionality and potential vulnerabilities.” Cefalu provides tagging prompts from the organization that built the operating system as trusted, wherein the prompts received from the organization that built the operating system correspond to the program segment, which are tagged as trusted, and thus tagging the program segment for inclusion in the trusted segment.); and generating the data segment boundary tags (See e.g. Cefalu [0062]; [0075]; [0077]) that define the data segment in the privilege based segmented instruction prompt for inclusion in the trusted segment (Cefalu [0024] “A system for use with an AI model configured to accept text input, such as a generative pre-trained transformer (GPT), that detects and tags trusted instructions and nontrusted instructions of an input provided by a user responsive to an AI model prompt.”; [0059] “In some examples, the trustworthiness tags may be dynamically updated based on real-time feedback or monitoring.”; [0063] “At step 1306, processor 1102 provides the input instructions with the untrusted instructions removed to GPT 100 for processing. The trusted tags remain attached to the trusted instructions.”; [0064] “At step 1308, GPT 100 executes the received trusted instructions and provides trusted output.” Cefalu provides tagging user provided input as trusted, thus defining the data segment (user input) for inclusion in the trusted segment.).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 8, Cefalu in view of Clement teaches wherein the privilege based segmented instruction prompt further enables the generative LLM to upon a determination that the privilege based segmented instruction prompt is the instruction injection attack (Clement [0017] “The security agent checks each response for the secret before passing the response back to the user application. If the secret is repeated, then the security agent extracts the secret out of the response and returns the remaining portion to the user application. If the secret is not repeated in the response generated by the large language model, then the security agent assumes that the there was a prompt injection attack.” Clement provides determining if a prompt injection attack occurs on a LLM based on a user prompt.), generate an instruction injection attack alert for transmission to an instruction injection attack assessor indicating that the privilege based segmented instruction prompt is the instruction injection attack (Clement [0016] “A technique is disclosed to prevent a prompt injection attack in a user prompt to a large language model. A security agent interfaces between the user application that issues the user prompt and the server hosting the large language model.”; [0017] “If the secret is not repeated in the response generated by the large language model, then the security agent assumes that the there was a prompt injection attack. In this case, the security agent generates an error message that is returned to the user application and not the model-generated response.” Clement provides generates an error message that is returned to the user application upon detection of a prompt injection attack, corresponding generating an alert for transmission to an assessor indicating a prompt is a instruction injection attack.).
Cefalu and Clement are both considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Clement. Doing so would allow for preventing a prompt injection attack on a large language model (Clement [0006] “A security agent is used sign a user prompt destined to a large language model from a user with a secret in order to prevent a prompt injection attack.”).
Regarding claim 9, Cefalu in view of Clement teaches wherein the privilege based segmented instruction prompt further enables the generative LLM to upon a determination that the privilege based segmented instruction prompt is not the instruction injection attack (Clement [0035] “FIG. 2 illustrates an exemplary conversation between a user application and the large language model where the model has not had a prompt injection attack 200.” Clement provides determining if a prompt is not a prompt/instruction attack.), generate the response to the privilege based segmented instruction prompt for transmission to an output parser, the response being an output of the execution of the at least one task with respect to the data instructions (Clement [0035] “FIG. 2 illustrates an exemplary conversation between a user application and the large language model where the model has not had a prompt injection attack 200. A conversation may consist of several user prompts and responses within a single network session.”; [0036] “Initially, the large language model is given initial instructions 202 to perform the target task. System prompts (<system> . . . </system>) are created by the developer of the conversational interactions with the model to constrain the model to acting in prescribed ways consistent with the intent and policies of the service hosting the large language model.” Clement provides upon determining a prompt is not a prompt injection attack, performing the target task, and outputting to the user in the form of responses, corresponding to generating a response to the prompt for transmission to an output parser including execution of at least one task with respect to the instructions input to the LLM.).
Cefalu and Clement are both considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Clement. Doing so would allow for preventing a prompt injection attack on a large language model (Clement [0006] “A security agent is used sign a user prompt destined to a large language model from a user with a secret in order to prevent a prompt injection attack.”).
Regarding claim 10, Cefalu in view of Clement teaches the method of claim 9, wherein the privilege based segmented instruction prompt further enables the generative LLM to generate the portion of the response for transmission to the end-user device via the output parser (Clement [0035] “FIG. 2 illustrates an exemplary conversation between a user application and the large language model where the model has not had a prompt injection attack 200. A conversation may consist of several user prompts and responses within a single network session. The network session is a time limited two-way link between the user computing device and the server using a layer of the TCP/IP network protocol. The server issues a session identifier to the user computing device initially which is then included in each subsequent communication for the duration of the session.” Clement provides transmission of responses to a user computing device using a layer of the TCP/IP network protocol, corresponding to generating a response for transmission to an end-user device via an output parser.).
Cefalu and Clement are both considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Clement. Doing so would allow for preventing a prompt injection attack on a large language model (Clement [0006] “A security agent is used sign a user prompt destined to a large language model from a user with a secret in order to prevent a prompt injection attack.”).
Regarding claim 11, Cefalu in view of Clement teaches wherein the privilege based segmented instruction prompt further enables the generative LLM to generate a second portion of the response for transmission to a backend system via the output parser for implementation of the response (Clement [0043] “The large language model is then provided with original instructions or system prompts on how to respond to the user prompts (block 404). Additionally, the model may be trained to learn to respond using the secret with a few starter conversations to emphasize the pattern of repeating the passwords in each response (block 404). The secret is initiated on the server side so the system can hide the secret from the user and to make it more difficult for the user to learn of the existence of the secret and the workings of the model.” Clement provides a hidden server side for the LLM corresponding to a backend system, which receives information based on user prompts, corresponding to generating a portion of the response for transmission to a backend system via output and for implementation of the LLM response, which is based on the user prompt.).
Cefalu and Clement are both considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Clement. Doing so would allow for preventing a prompt injection attack on a large language model (Clement [0006] “A security agent is used sign a user prompt destined to a large language model from a user with a secret in order to prevent a prompt injection attack.”).
Regarding claim 12, Cefalu in view of Clement teaches wherein generating the privilege based segmented instruction prompt for transmission to the generative LLM comprises generating the privilege based segmented instruction prompt for transmission to a Generative Pre-Trained Transformer (GPT) LLM (Cefalu [0024] “A system for use with an AI model configured to accept text input, such as a generative pre-trained transformer (GPT), that detects and tags trusted instructions and nontrusted instructions of an input provided by a user responsive to an AI model prompt.” Cefalu provides generating trusted instructions corresponding to the privilege based segmented instruction prompt for a generative pre-trained transformer (GPT).).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 21, it is the database system embodiment of claim 1 with similar limitations to claim 1 and is rejected using similar reasoning found above in the rejection of claim 1. Further, Cefalu teaches a database system (Cefalu [0032] “GPT 100 cannot understand words as GPT 100 is a machine-learning (ML) algorithm and operates on vectors of numbers. The first step is keeping a vocabulary of all words, such as in a database, where each word is a value. GPT 100 currently has a vocabulary of 50257 words.” Cefalu teaches a system comprising a database.) comprising …at least one processor; and at least one non-transitory machine-readable storage medium that stores instructions configurable to be executed by the at least one processor (Cefalu [0044] “The classifier 1000 controls prevent prohibited text generation and include rules that are part of a trained platform having a processor 1002 and memory 1004 together configured to reduce and avoid processing commands leading to inappropriate processing and results by GPT 100, which rules may form part of a corporate policy.” Cefalu teaches a processor and memory.).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 22, it is the non-transitory machine-readable storage medium embodiment of claim 1 with similar limitations to claim 1 and is rejected using similar reasoning found above in the rejection of claim 1. Further, Cefalu teaches a non-transitory machine-readable storage medium that stores instructions executable by at least one processor, the instructions configurable to cause the at least one processor to perform operations (Cefalu [0044] “The classifier 1000 controls prevent prohibited text generation and include rules that are part of a trained platform having a processor 1002 and memory 1004 together configured to reduce and avoid processing commands leading to inappropriate processing and results by GPT 100, which rules may form part of a corporate policy.” Cefalu teaches a processor and memory.).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 27, Cefalu in view of Clement teaches wherein the trusted instructions specify that the program instructions in the program segment cannot extract, modify, or overrule the trusted instructions in the trusted segment (Cefalu [0058] “In some examples, the system may include a user authentication mechanism to verify the identity of users providing input to the language model. Only authenticated users may be allowed to assign “trusted (user)” tags to tokens, whereas unauthenticated users may be required to have their text be tagged with “untrusted (user)”.” Cefalu teaches only authenticated users may be allowed to assign “trusted (user)” tags to tokens, corresponding to the trusted instructions specify that the program instructions in the program segment cannot extract, modify, or overrule the trusted instructions.).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 28, Cefalu in view of Clement teaches wherein the trusted instructions specify that the data instructions in the data segment cannot extract, modify, or contradict the program instructions in the program segment or the trusted segment (Cefalu [0057] “By implementing the present disclosure with the virtual assistant, the virtual assistant can execute instructions from system administrators (tagged as “trusted (system)”) while ignoring potentially malicious instructions from external users (tagged as “untrusted (user)”).” Cefalu teaches ignoring untrusted user input, corresponding to the data instructions cannot extract, modify, or contradict the program instructions in the program segment or the trusted segment).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Regarding claim 29, Cefalu in view of Clement teaches wherein the trusted instructions specify that the data segment is to be evaluated by the generative LLM for the instruction injection attack prior to attempting to provide the response to the data instructions (Cefalu [0048] “FIG. 11A illustrates a flow diagram of method 1100 operable by processor 1102 of classifier 1000 providing adversarial prompt injection protection. FIG. 11B compares the results of running GPT 100 without classifier 1000 prompt filtering (before) vs with classifier 1000 prompt filtering (after).”).
It would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement for the same reasons disclosed above in the rejection of claim 1.
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Cefalu et al. (U.S. Patent Publication No. 2023/0359903) (“Cefalu”) in view of Clement et al. (U.S. Patent Publication No. 2024/0386103) (“Clement”) in further view of Ahmed et al. (U.S. Patent Publication No. 2025/0055867) (“Ahmed”).
Regarding claim 7, Cefalu in view of Clement teaches the method of claim 1, as discussed above in the rejection of claim 1, but fails to teach wherein the definition of the trusted instructions comprises at least one of ethical guideline instructions and organization standard guidelines.
However, Ahmed teaches wherein the definition of the trusted instructions comprises at least one of ethical guideline instructions and organization standard guidelines (Ahmed [0094] “As already explained in FIG. 2, for example, the assessment engine 208 may determine an intent and category of the prompt and content 312 based on the attributes of the data to detect threats associated with the prompt and content 312. The threats may include a prompt injection check, a jailbreak check, a profanity and toxicity check, a Personal Identifiable Information (PII) check, an Intellectual Property (IP) violation check, and an organization policy and a role-based check.”; [0134] “The present disclosure helps implement safety guardrails to address risks of the traditional systems. The disclosure may help in mitigating ethical and safety challenges associated with the generative AI models, and encompass various aspects, including prompt design guidelines, monitoring for misuse, content filtering, and IP checks. The disclosure may enable responsible and ethical use of the generative AI models and unlock its potential for a wide range of applications.” Ahmed provides determining if a prompt corresponds to a prompt injection attack, including prompt design guidelines that include ethical and organizational considerations.).
Cefalu, Clement and Ahmed are all considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Ahmed. Doing so would help mitigating ethical and safety challenges associated with the generative AI models (Ahmed [0134] “The disclosure may help in mitigating ethical and safety challenges associated with the generative AI models, and encompass various aspects, including prompt design guidelines, monitoring for misuse, content filtering, and IP checks.”).
Claims 23-26 are rejected under 35 U.S.C. 103 as being unpatentable over Cefalu et al. (U.S. Patent Publication No. 2023/0359903) (“Cefalu”) in view of Clement et al. (U.S. Patent Publication No. 2024/0386103) (“Clement”) in further view of Singh et al. (U.S. Patent Publication No. 2024/0296315) (“Singh”).
Regarding claim 23, Cefalu in view of Clement teaches the method of claim 1, as discussed above in the rejection of claim 1, but fails to teach wherein the database system comprises a tenant database storing respective program instructions for respective tenants of the database system.
However, Singh teaches wherein the database system comprises a tenant database storing respective program instructions for respective tenants of the database system (Singh [0025] “The generative AI development platform also includes functionality for capturing prompts and responses so that they can be stored in a prompt library and in a prompt data store that can be implemented in separate tenant/user memory shards to ensure compliance.”; [0051] “It will be noted that API interaction system 240 and development platform interaction system 244 can be used to share the prompt/response records 266-268 in a compliant manner. The systems 240 and 244 can share the prompt/response records within a predefined scope (such as within the tenant/user data stores, or shards in a data center) so that they are compliant, or systems 240 and 244 can remove the responses or the customer data from the prompts and/or responses or can share the prompt/response records 266-268 in another way.” Singh teaches separate tenant storage for respective tenants for user prompts and responses.).
Cefalu, Clement and Singh are all considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Singh. Doing so would allow for the prompts and responses to be personalized to the user or tenant based on other user/tenant data (Singh [0026] “Because the prompts and responses are stored in the tenant/user memory, the prompts and responses can also be personalized to the user or tenant based on other user/tenant data.”).
Regarding claim 24, Cefalu in view of Clement teaches the method of claim 1, as discussed above in the rejection of claim 1, but fails to teach wherein the program instructions are stored at a tenant level in a tenant database of the database system.
However, Singh teaches wherein the program instructions are stored at a tenant level in a tenant database of the database system (Singh [0026] “The present system thus proceeds with respect to a prompt/response storage system or platform that stores prompts and responses in tenant/user memory shards to ensure compliance and that also stores evaluation data indicative of the performance of the prompts. Because the prompts and responses are stored in the tenant/user memory, the prompts and responses can also be personalized to the user or tenant based on other user/tenant data.” Singh teaches tenant level storage (i.e., prompts are stored in the tenant/user memory).).
Cefalu, Clement and Singh are all considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Singh. Doing so would allow for the prompts and responses to be personalized to the user or tenant based on other user/tenant data (Singh [0026] “Because the prompts and responses are stored in the tenant/user memory, the prompts and responses can also be personalized to the user or tenant based on other user/tenant data.”).
Regarding claim 25, Cefalu in view of Clement in further view of Singh teaches wherein storing the program instructions at the tenant level in the tenant database enables the tenant to design the program instructions for the privilege based segmented instruction prompt without worrying about instruction injection attacks (Singh [0043] “Surreptitious prompt processing system 188 can use the processed prompt to determine whether the prompt is nefarious or surreptitious (such as being used to execute a prompt injection attack in which the prompt is attempting to make the generative AI model act in an unintended way), in a variety of different ways. In one example, surreptitious prompt processing system 188 vectorizes (creates a vector from) the prompt and compares that vector to other vectors generated from prompts that were known or discovered to be nefarious or surreptitious. Based upon the similarity of the vectors, surreptitious prompt processing system 188 can identify the prompt as surreptitious or as valid.” Singh teaches tenant/user level storage, as discussed above, and further teaches preventing prompt injection attacks through their identification, corresponding to the tenant level storage enabling design of the instructions without worrying about an instruction injection attack (i.e., the prompt injection/surreptitious prompt).).
Cefalu, Clement and Singh are all considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Singh. Doing so would allow for the prompts and responses to be personalized to the user or tenant based on other user/tenant data (Singh [0026] “Because the prompts and responses are stored in the tenant/user memory, the prompts and responses can also be personalized to the user or tenant based on other user/tenant data.”).
Regarding claim 26, Cefalu in view of Clement teaches the method of claim 1, as discussed above in the rejection of claim 1, but fails to teach wherein the database system comprises an application platform providing an instance of an application at the end-user device that allows the end-user to access tenant data associated with the tenant at the database system.
However, Singh teaches wherein the database system comprises an application platform providing an instance of an application at the end-user device that allows the end-user to access tenant data associated with the tenant at the database system (Singh [0027] “FIG. 1 is a block diagram of one example of a generative AI platform architecture 100. Architecture 100 shows that one or more client applications 102 can have access to generative artificial intelligence (AI) models in a generative AI model layer 104 through a generative AI model API 106. The generative AI models in layer 104 can be run in AI model execution layer 107 which can include a production pool 108 and an experimentation pool 110 of computing system resources. An aggregation layer 112 can aggregate generative AI requests from the different client applications 102, and provide them to API 106 so they can be processed in batches or in other ways.”; [0028] “Prompt/response storage system 116 can be used to store prompts and responses in user/tenant data shards 118-120 in data centers 122.” Singh teaches an application platform for an end-user that allows them to access tenant data.).
Cefalu, Clement and Singh are all considered to be analogous to the claimed invention because they are in the same field of artificial intelligence and more specifically applied to large language models (LLMs). Therefore, it would have been obvious to someone of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cefalu in view of Clement with the above teachings of Singh. Doing so would allow for the prompts and responses to be personalized to the user or tenant based on other user/tenant data (Singh [0026] “Because the prompts and responses are stored in the tenant/user memory, the prompts and responses can also be personalized to the user or tenant based on other user/tenant data.”).
Response to Arguments
Regarding the rejection of the claims under 35 U.S.C. 101, Applicant firstly asserts that the steps of amended claim 1 cannot be practically performed in the human mind (“Remarks”, Pg. 8). Applicant further asserts that amended claim 1 integrates any abstract ideas into a practical application (“Remarks”, Pg. 8). Applicant specifically asserts that claim 1 reflects a specific improvement that addresses the technical problems of preventing instruction injection attacks from an untrusted end-user (“Remarks”, Pg. 9).
However, as discussed above in the 35 U.S.C. 101 rejection of the claims above, the claims recite at least the abstract ideas of “generating …the privilege based segmented instruction prompt” and “determine the privilege based segmented instruction prompt is an instruction injection attack…”. For example, generating a prompt is practically performed in the human mind, including with the assistance of pen and paper, by simply thinking of a prompt and/or transcribing a prompt onto paper. The additional recitation of “…at the database system…” corresponds to mere instructions to apply an exception for the abstract ideas, for merely reciting generic hardware/software on which to implement the abstract ideas. See MPEP 2106.05(f). Further, regarding the determining limitation, the limitation is mentally performable by, for example, evaluating a prompt and providing a judgement as to whether the evaluated prompt is an instruction injection attack, including basing the determination on conflicting instructions. The use of a “generative LLM” to perform the determining corresponds to mere instructions to apply an exception for the abstract ideas, for merely reciting a model as a tool to perform the abstract idea. See MPEP 2106.05(f).
Regarding the asserted improvement, even assuming that the claims do recite an improvement in preventing instruction injection attacks from untrusted end-users, the improvement, as written, would be in the abstract idea of “generating the privilege based segmented instruction prompt” or “determine the privilege based segmented instruction prompt is an instruction injection attack”. The MPEP notes that it is important to keep in mind that an improvement in the abstract idea itself is not an improvement in technology. MPEP 2106.05(a)(II). Therefore, even if the claims did recite an improvement, it would be in the abstract idea of generating the privilege based segmented instruction prompt or determining the privilege based segmented instruction prompt is an instruction injection attack. Therefore, the 35 U.S.C. 101 rejection of claims 1, 3-12, and 21-29 is maintained.
Regarding the rejection of the claims under 35 U.S.C. 103, Applicant asserts that the applied references Cefalu in view of Clement does not teach the amended claims (“Remarks”, Pgs. 9-10).
However, Applicant did not specify any specific limitations not taught by the reference combination, as discussed in the 35 U.S.C. 103 rejection of the claims above. Therefore, Applicants arguments regarding the 35 U.S.C. 103 rejection of the claims is addressed in the 35 U.S.C. 103 rejection of the claims above.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KURT NICHOLAS PRESSLY whose telephone number is (703)756-4639. The examiner can normally be reached M-F 8-4.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamran Afshar can be reached at (571) 272-7796. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KURT NICHOLAS PRESSLY/Examiner, Art Unit 2125
/KAMRAN AFSHAR/Supervisory Patent Examiner, Art Unit 2125
Prosecution Insights