DETAILED ACTION
Notice of AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Regarding Chinese Patent App. No. CN202110657041.8 (filed June 11, 2021), receipt is acknowledged of certified copies of papers required by 37 CFR 1.55.
Regarding PCT Application No. PCT/CN2022/094020 (filed May 20, 2022), Applicant’s claim for the benefit of a prior-filed application under 35 U.S.C. 120, 121, 365(c), or 386(c) is acknowledged.
Information Disclosure Statement
The information disclosure statements submitted on 5/16/2024 and 11/12/2025 have been considered.
Claim Objections
Claims 1, 8-10, 17, and 19-20 are objected to because of the following informalities:
Claims 1, 8-10, 17, and 19-20 each recite “performing binary representation.” This limitation is phrased awkwardly, as one would not perform a “binary representation”, but rather, would transform or convert sometime to a binary representation. However, because this phrase is understandable in view of at least paras. 0055-0058, it therefore does not arise to the level of indefiniteness under 35 U.S.C. 112(b). The examiner suggests amending this to recite “performing a binary representation conversion”, or something similar, to make the claim more understandable.
Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1, 8, 10, 17, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over US 20210374605 A1, hereinafter referenced as QIAN, in view of Arachchige, Pathum Chamikara Mahawaga, et al. "Local differential privacy for deep learning." IEEE Internet of Things Journal 7.7 (2019): 5827-5842., hereinafter referenced as ARACHCHIGE.
Regarding Claim 1
QIAN teaches:
A computer-implemented method for updating machine learning models, comprising:
(QIAN, para. 0028: “The solution presented by the embodiments disclosed herein to address this challenge may be using splitting and shuffling model updates since the remote server may be unable to link different gradient/weight values from the same client system after the gradients/weights are split and uploaded anonymously.”;
QIAN, para. 0092: “FIG. 13 illustrates an example computer system 1300 that may be utilized to perform federated learning with local privacy perturbation, in accordance with the presently disclosed embodiments.”)
determining, by a participant of a plurality of participants, a local gradient vector based on a local sample set and current model parameters; (QIAN, para. 0027: “FIG. 2 illustrates an example architecture for federated learning. To train a machine-learning model, a plurality of client systems may each access user data stored on the respective client system. As an example and not by way of limitation, client system 1205 may learn gradients 1245, client system 2215 may learn gradients 2250, client system 3225 may learn gradients 3255, and client system k 235 may learn gradients k 260. The learnt gradients from each client system may be then sent to a remote server 265.”;
QIAN, para. 0035: “In the framework of federated optimization, the remote server 265 may be an aggregator that collects a set of weights of local client-side models from the local side and averages the weights after each communication round.”;
Examiner’s Note: As shown in Fig. 2, each of the client systems generates a gradient (corresponding to recited “local gradient vector”), where such gradient is based on the “user data stored on the respective client system” and local client-side weights (corresponding to recited “local sample set and current model parameters”, respectively)
obtaining, by the participant, a perturbed gradient vector ... based on a differential privacy algorithm; (QIAN, para. 0027: “For an enhanced privacy protection, the embodiments disclosed herein apply local differential privacy (LDP), a strict privacy notion, to federated learning. The embodiments disclosed herein develop new LDP algorithms for adding noise and additional mechanism to achieve a good federated learning performance with a small privacy budget. Particular embodiments may apply LDP either to the gradients or to the raw user data.”;
QIAN, para. 0038: “Accordingly, the client system may use a data perturbator 325 to enforce privacy policies such as LDP to perturb the initial user data 310. The perturbed user data may be further sent to a model trainer 330. The model trainer 330 may perform the duty of federated learning locally, e.g., calculating the loss using user data 310. The output of the model trainer 330 may comprise the gradients 335 associated with the machine-learning model 305. In particular embodiments, the client system may determine, based on one or more privacy policies, that one or more of the plurality of initial gradients 335 should be perturbed. Gradients 335 may be associated with the weights of the machine-learning model. In this case, the client system may first use the model trainer 330 to learn the weights based on the user data 310 and then use a weights perturbator 340 to perturb the gradients 335 associated with the weights. All the client systems may send the gradients 335 to an aggregator 345 to aggregate the gradients 335 from each client system. As a result, the embodiments disclosed herein may have a technical advantage of flexibility in perturbing gradients or user data based on privacy policies.”)
sending, by the participant to a server, the perturbed gradient vector; (QIAN, para. 0027: “The learnt gradients from each client system may be then sent to a remote server 265. The remote server 265 may aggregate the gradients (e.g., by averaging) from those client systems, train the machine-learning model, and then send the trained machine-learning model back to each client system.”
QIAN, para. 0038: “In this case, the client system may first use the model trainer 330 to learn the weights based on the user data 310 and then use a weights perturbator 340 to perturb the gradients 335 associated with the weights. All the client systems may send the gradients 335 to an aggregator 345 to aggregate the gradients 335 from each client system.”)
receiving, by the participant from the server, a target gradient vector determined by ... an aggregation result of aggregating a plurality of perturbed gradient vectors received from the plurality of participants; and (QIAN, para. 0027: “The learnt gradients from each client system may be then sent to a remote server 265. The remote server 265 may aggregate the gradients (e.g., by averaging) from those client systems, train the machine-learning model, and then send the trained machine-learning model back to each client system.”;
QIAN, para. 0052: “In the cloud process, the remote server 265 may average the perturbed gradient information of all client systems using an aggregator model 680. The remote server 265 may further send the aggregated model to each client system for the next updates.”;
QIAN, para. 0059: “The second step may be local update. Each client system may contain its own private dataset. In each communication, the selected local client systems may update their local models by the weights from the remote server 265.”
Examiner’s Note: As shown in Fig. 2, the remote server 265 aggregates the client gradients, and then returns an updated gradient (e.g., updated weights) corresponding to the central model back to each client)
updating, by the participant, the current model parameters based on the target gradient vector. (QIAN, para. 0059: “The second step may be local update. Each client system may contain its own private dataset. In each communication, the selected local client systems may update their local models by the weights from the remote server 265.”)
However, QIAN fails to explicitly teach:
... by performing random binarization processing on the local gradient vector
... performing binary representation
However, in a related field of endeavor (local differential privacy for deep learning), ARACHCHIGE teaches and makes obvious:
obtaining, by the participant, a perturbed gradient vector by performing random binarization processing on the local gradient vector based on a differential privacy algorithm; (ARACHCHIGE, p. 5831, section III.A.1: “LATENT converts the input values to binary values before randomization.”
ARACHCHIGE, p. 5831, section III.A.3: “After determining the length of the components of binary strings of the inputs, the inputs can be mapped as shown in Fig. 4. The figure shows the direct mapping of an integer/float value to its binary representation.”
ARACHCHIGE, p. 5832, section III.A.7: “By further extending this idea, we apply two randomization models over the bits of a binary string to enhance the utility of randomized binary strings. In this way, we try to randomize half of the bits in the bit string differently compared to the other half as defined in Theorem 4.”;
Examiner’s Note: ARACHCHIGE discloses, in the field of local differential privacy for updating neural networks, converting inputs to a binary string and then randomizing said binary string; the QIAN-ARACHCHIGE combination now takes the perturbed gradients of QIAN, and converts such perturbed gradients to a randomized binary string as taught by ARACHCHIGE)
receiving, by the participant from the server, a target gradient vector determined by performing binary representation on an aggregation result of aggregating a plurality of perturbed gradient vectors received from the plurality of participants; and (ARACHCHIGE, p. 5831, section III.A.1: “LATENT converts the input values to binary values before randomization.”
ARACHCHIGE, p. 5831, section III.A.3: “After determining the length of the components of binary strings of the inputs, the inputs can be mapped as shown in Fig. 4. The figure shows the direct mapping of an integer/float value to its binary representation.”
Examiner’s Note: ARACHCHIGE discloses, in the field of local differential privacy for updating neural networks, converting inputs to a binary string; the QIAN-ARACHCHIGE combination now takes the gradients returning from the server to the remote clients of QIAN, and converts such gradients to a binary string as taught by ARACHCHIGE)
Before the effective filing date of the present application, it would have been obvious to one of ordinary skill in the art to combine the teachings of QIAN with ARACHCHIGE as explained above. As disclosed by ARACHCHIGE, one of ordinary skill would have been motivated to do so in order to employ “sufficient privacy-preserving mechanisms to limit privacy leaks of trained DL models.” (p. 5827, section I).
Regarding Claim 8
QIAN and ARACHCHIGE teach the method of claim 1. However, QIAN fails to explicitly teach:
wherein performing binary representation on the aggregation result of aggregating the plurality of perturbed gradient vectors comprises: performing binary representation on elements in the aggregation result based on plus-minus signs of the elements by using a sign function.
However, in a related field of endeavor (local differential privacy for deep learning), ARACHCHIGE teaches and makes obvious:
wherein performing binary representation on the aggregation result of aggregating the plurality of perturbed gradient vectors comprises: performing binary representation on elements in the aggregation result based on plus-minus signs of the elements by using a sign function.
ARACHCHIGE, p. 5831, section III.A.3: “After determining the length of the components of binary strings of the inputs, the inputs can be mapped as shown in Fig. 4. The figure shows the direct mapping of an integer/float value to its binary representation.”
PNG
media_image1.png
162
388
media_image1.png
Greyscale
Examiner’s Note: ARACHCHIGE discloses that converting values to binary string includes a sign bit, meaning that function is required to determine the sign of the value prior to conversion to binary; the QIAN-ARACHCHIGE combination now takes the gradients returning from the server to the remote clients of QIAN, and converts such gradients to a binary string as taught by ARACHCHIGE using at least the sign bit of ARACHCHIGE)
Before the effective filing date of the present application, it would have been obvious to one of ordinary skill in the art to combine the teachings of QIAN with ARACHCHIGE as explained above. As disclosed by ARACHCHIGE, one of ordinary skill would have been motivated to do so in order to employ “sufficient privacy-preserving mechanisms to limit privacy leaks of trained DL models.” (p. 5827, section I).
Regarding Claim 10
QIAN teaches:
A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising: (QIAN, para. 0095: “In particular embodiments, processor 1302 includes hardware for executing instructions, such as those making up a computer program. As an example, and not by way of limitation, to execute instructions, processor 1302 may retrieve (or fetch) the instructions from an internal register, an internal cache, memory 1304, or storage 1306; decode and execute them; and then write one or more results to an internal register, an internal cache, memory 1304, or storage 1306. In particular embodiments, processor 1302 may include one or more internal caches for data, instructions, or addresses”;
QIAN, para. 0111: “Herein, a computer-readable non-transitory storage medium or media may include one or more semiconductor-based or other integrated circuits (ICs) (such, as for example, field-programmable gate arrays (FPGAs) or application-specific ICs (ASICs)), hard disk drives (HDDs), hybrid hard drives (HHDs), optical discs, optical disc drives (ODDs), magneto-optical discs, magneto-optical drives, floppy diskettes, floppy disk drives (FDDs), magnetic tapes, solid-state drives (SSDs), RAM-drives, SECURE DIGITAL cards or drives, any other suitable computer-readable non-transitory storage media, or any suitable combination of two or more of these, where appropriate.”)
The remaining limitations correspond to the method of claim 1 and are therefore rejected for the same reasons explained above with respect to claim 1.
Regarding Claim 17
QIAN teaches:
A computer-implemented system, comprising: one or more computers; and one or more computer memory devices interoperably coupled with the one or more computers and having tangible, non-transitory, machine-readable media storing one or more instructions that, when executed by the one or more computers, perform one or more operations comprising: (QIAN, para. 0095: “In particular embodiments, processor 1302 includes hardware for executing instructions, such as those making up a computer program. As an example, and not by way of limitation, to execute instructions, processor 1302 may retrieve (or fetch) the instructions from an internal register, an internal cache, memory 1304, or storage 1306; decode and execute them; and then write one or more results to an internal register, an internal cache, memory 1304, or storage 1306. In particular embodiments, processor 1302 may include one or more internal caches for data, instructions, or addresses”;
QIAN, para. 0111: “Herein, a computer-readable non-transitory storage medium or media may include one or more semiconductor-based or other integrated circuits (ICs) (such, as for example, field-programmable gate arrays (FPGAs) or application-specific ICs (ASICs)), hard disk drives (HDDs), hybrid hard drives (HHDs), optical discs, optical disc drives (ODDs), magneto-optical discs, magneto-optical drives, floppy diskettes, floppy disk drives (FDDs), magnetic tapes, solid-state drives (SSDs), RAM-drives, SECURE DIGITAL cards or drives, any other suitable computer-readable non-transitory storage media, or any suitable combination of two or more of these, where appropriate.”)
The remaining limitations correspond to the method of claim 1 and are therefore rejected for the same reasons explained above with respect to claim 1.
Claim 19 depends from claim 17 and claims a system that corresponds to the method of claim 8, and is therefore rejected for the same reasons explained above with respect to claims 8 and 17.
Allowable Subject Matter
Claims 2-7, 9, 11-16, 18, and 20 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
The following is a statement of reasons for the indication of allowable subject matter:
Claim 2 would be considered allowable because none of the references of record either alone or in combination fairly disclose or suggest the combination of limitations specified in claim 2, including at least:
wherein ... performing random binarization processing on the local gradient vector comprises:
determining a first probability based on a value of the first element, wherein the first probability is positively correlated with the value of the first element; and
converting the value of the first element to 1 or -1, wherein a probability of converting the value of the first element to 1 is the first probability, and a probability of converting the value of the first element to -1 is a second probability,
wherein a sum of the first probability and the second probability is 1.
The closest prior art of record discloses:
US 20210374605 A1, hereinafter referenced as QIAN, discloses a federated learning system that utilizes gradients determined using local differential privacy (LDP). (para. 0027).
Arachchige, Pathum Chamikara Mahawaga, et al. "Local differential privacy for deep learning." IEEE Internet of Things Journal 7.7 (2019): 5827-5842., hereinafter referenced as ARACHCHIGE, teaches a random binarization process, where the values are first converted to binary and then randomized. (pp. 5831-5832, section III.A.1-7). The examiner notes that claim 2 requires a first probability to be determined before the conversion to binary elements (-1 or 1).
Adams, Samuel, et al. "Privacy-preserving training of tree ensembles over continuous data." arXiv preprint arXiv:2106.02769 (June 5, 2021), hereinafter referenced as ADAMS, discloses random binarizing by choosing a random threshold, and assigning a value of 1 or 0 based on whether the threshold is exceeded or not. (p. 8, section VI).
However, the examiner has found that the distinct feature of the Applicant's claimed invention over the prior art is the explicit claiming of the aforementioned limitations in combination with all the other limitations as specified in claim 2. In particular, one of ordinary skill would not have been motivated to perform the recited “randomized binarization” by first determining a first probability based on a value of the first element of a local gradient vector, and only then doing the conversion to binary (-1,1) based on such first probability, without the hindsight aid of Applicant’s disclosure. Therefore, because the prior art of record does not anticipate nor make obvious the limitations of claim 2 as identified above, claim 2 would be allowed over the prior art if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claims 3-7 depend from claim 2, and would be allowed for the same reasons explained with respect to claim 2 if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim 9 would be considered allowable because none of the references of record either alone or in combination fairly disclose or suggest the combination of limitations specified in claim 9, including at least:
wherein performing binary representation on the aggregation result of aggregating the plurality of perturbed gradient vectors comprises:
superimposing an error compensation vector on the aggregation result to obtain a superimposition result,
wherein the error compensation vector of a current iteration is obtained by superimposing a difference between an aggregation result of a previous iteration and a binary representation result from performing binary representation of the aggregation result in the previous iteration on an error compensation vector of the previous iteration; and
performing binary representation on elements in the superimposition result based on plus-minus signs of the elements by using a sign function.
The closest prior art of record discloses:
US 20210374605 A1, hereinafter referenced as QIAN, discloses a federated learning system that utilizes gradients determined using local differential privacy (LDP). (para. 0027).
Arachchige, Pathum Chamikara Mahawaga, et al. "Local differential privacy for deep learning." IEEE Internet of Things Journal 7.7 (2019): 5827-5842., hereinafter referenced as ARACHCHIGE, teaches a random binarization process, where the values are first converted to binary and then randomized. (pp. 5831-5832, section III.A.1-7). The examiner notes that claim 2 requires a first probability to be determined before the conversion to binary elements (-1 or 1).
However, the examiner has found that the distinct feature of the Applicant's claimed invention over the prior art is the explicit claiming of the aforementioned limitations in combination with all the other limitations as specified in claim 9. In particular, one of ordinary skill would not have been motivated to perform the recited “binary representation” in the particular manner recited in claim 9 without the hindsight aid of Applicant’s disclosure. Therefore, because the prior art of record does not anticipate nor make obvious the limitations of claim 9 as identified above, claim 9 would be allowed over the prior art if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim 11 recites a non-transitory, computer-readable medium that corresponds to the method of claim 2, and would therefore be allowed for the same reasons explained with respect to claim 2 if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claims 12-16 depend from claim 11, and would be allowed for the same reasons explained with respect to claim 11 if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim 18 recites a system that corresponds to the method of claim 2, and would therefore be allowed for the same reasons explained with respect to claim 2 if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim 20 recites a system that corresponds to the method of claim 9, and would therefore be allowed for the same reasons explained with respect to claim 9 if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Kerkouche, Raouf, et al. "Constrained Differentially Private Federated Learning for Low-bandwidth Devices." arXiv preprint arXiv:2103.00342 (Feb. 27, 2021). Discloses an approach of creating binary vectors for federated learning, but criticizes such approach as having lower accuracy. (p. 5, section 3.2.3).
US 20210383280 A1 (Shaloudegi) “elates to methods and apparatuses for training of a machine learning-based model, in particular related to methods and apparatuses for performing federated learning.” (para. 0001).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL C LEE whose telephone number is (571)272-4933. The examiner can normally be reached M-F 12:00 pm - 8:00 pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Omar Fernandez Rivas can be reached at 571-272-2589. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL C. LEE/Examiner, Art Unit 2128
Prosecution Insights