DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
Claims 1-8 are pending and examined herein.
Claims 1-8 are rejected under 35 U.S.C. 101.
Claims 1-8 are rejected under 35 U.S.C. 103.
Information Disclosure Statement
The listing of references in the specification is not a proper information disclosure statement. 37 CFR 1.98(b) requires a list of all patents, publications, or other information submitted for consideration by the Office, and MPEP § 609.04(a) states, "the list may not be incorporated into the specification but must be submitted in a separate paper." Therefore, unless the references have been cited by the examiner on form PTO-892, they have not been considered.
Priority
Receipt is acknowledged of certified copies of papers required by 37 CFR 1.55.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-8 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
MPEP § 2109(III) sets out steps for evaluating whether a claim is drawn to patent-eligible subject
matter. The analysis of claims 1-8, in accordance with these steps, follows.
Step 1 Analysis:
Step 1 is to determine whether the claim is directed to a statutory category (process, machine,
manufacture, or composition of matter. Claims 1-4 are directed to a process and claims 5-8 are directed to a machine. All claims are directed to statutory categories and analysis proceeds.
Step 2A Prong One, Step 2A Prong Two, and Step 2B Analysis:
Step 2A Prong One asks if the claim recites a judicial exception (abstract idea, law of nature, or natural phenomenon). If the claim recites a judicial exception, analysis proceeds to Step 2A Prong Two, which asks if the claim recites additional elements that integrate the abstract idea into a practical application. If the claim does not integrate the judicial exception, analysis proceeds to Step 2B, which asks if the claim amounts to significantly more than the judicial exception. If the claim does not amount to significantly more than the judicial exception, the claim is not eligible subject matter under 35 U.S.C. 101.
None of the claims represent an improvement to technology.
Regarding claim 1, the following are abstract ideas:
for one of the plurality of layers, encrypting a plaintext input with a first encryption algorithm to generate a ciphertext vector; (Encrypting an input with an algorithm is a mathematical calculation, which is a mathematical concept.)
performing a convolution operation according to the ciphertext vector to generate a result vector; (Performing a convolution operation is performing a mathematical calculation, which is a mathematical concept.)
converting the result vector into a plurality of result ciphertexts adopting a second encryption algorithm; (Converting the result vector into a result ciphertext adopting an algorithm is a mathematical calculation, which is a mathematical concept.)
inputting the plurality of result ciphertexts into an activation function to generate a plurality of encrypted activation values; and (Using the activation function to generate encrypted values is a mathematical calculation, which is a mathematical concept.)
The following claim elements are additional elements which, taken alone or in combination with the other additional elements, do not integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception:
An operating method of a fully homomorphic encrypted neural network model, wherein the fully homomorphic encrypted neural network model includes a plurality of layers, and the method is performed by a processor and comprises: (This recites generic machine learning components (fully homomorphic encrypted neural network model, layers) and a generic computer component and process (using a processor to perform a method). This amounts to mere instructions to apply an exception.)
repacking the plurality of encrypted activation values to generate an output vector adopting the first encryption algorithm. (Repacking values is a generic process in encryption. This amounts to mere instructions to apply an exception.)
Regarding claim 2, the rejection of claim 1 is incorporated herein. The following are abstract ideas:
performing the convolution operation on the plaintext input to generate a plaintext vector; and (Performing a convolution operation is performing a mathematical calculation, which is a mathematical concept.)
inputting the plaintext vector into the activation function to generate one of the plurality of plaintext activation values; (Using the activation function to generate encrypted values is a mathematical calculation, which is a mathematical concept.)
determining a linear mapping range according to a range of the plurality of plaintext activation values; (Determining a linear mapping range according to a range of activation values can be practically performed in the human mind. This is a mental process.)
updating a weight of the convolution operation according to the linear mapping function; and (Using the linear mapping function to update a weight is a mathematical calculation, which is a mathematical concept.)
updating the activation function according to an inverse function of the linear mapping function. (Updating an activation function according to a function is a mathematical calculation, which is a mathematical concept.)
for each of the plurality of layers, determining a linear mapping function according to the range of the plurality of plaintext activation values and the linear mapping range; (Determining a linear mapping function according to a range of activation values and a linear mapping range can be practically performed in the human mind. This is a mental process.)
The following claim elements are additional elements which, taken alone or in combination with the other additional elements, do not integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception:
before performing the convolution operation according to the ciphertext vector to generate the result vector, for each of the plurality of layers, performing a training procedure for a plurality of times to generate a plurality of plaintext activation values, wherein the training procedure comprises: (Performing a training procedure is a generic machine learning process. This amounts to mere instructions to apply an exception.)
Regarding claim 3, the rejection of claim 1 is incorporated herein. The following are abstract ideas:
wherein the first encryption algorithm is Cheon-Kim-Kim-Song (CKKS) algorithm, and the second encryption algorithm is associated with Learn with errors (LWE). (As in the rejection of claim 1, the use of the first and second algorithms are mathematical calculations. This is a continuation of mathematical concepts.)
Regarding claim 4, the rejection of claim 1 is incorporated herein. The following are abstract ideas:
The operating method of the fully homomorphic encrypted neural network model of claim 1, wherein the activation function is Rectified Linear Unit (ReLU). (As in the rejection of claim 1, the use of an activation function is a mathematical calculation. This is a continuation of a mathematical concept.)
Regarding claim 5, the following claim elements are additional elements which, taken alone or in combination with the other additional elements, do not integrate the judicial exception into a practical application nor amount to significantly more than the judicial exception:
An operating system of a fully homomorphic encrypted neural network model comprising: (This recites a generic computer component (operating system) and a generic machine learning component (fully homomorphic encrypted neural network model). This amounts to mere instructions to apply an exception.)
a memory configured to store a plurality of instructions; and (This recites a generic computer component (memory) used in its ordinary capacity (storing data). This amounts to mere instructions to apply an exception.)
a processor electrically connected to the memory to execute the plurality of instructions, wherein the plurality of instructions is configured to perform a plurality of operations on one of a plurality of layers of the fully homomorphic encrypted neural network model, and the plurality of operations comprises: (This recites a generic computer component (processor connected to memory) used in its ordinary capacity (executing instructions). This also merely recites generic machine learning components (layers of the fully homomorphic encrypted neural network model). This amounts to mere instructions to apply an exception.)
The remainder of claim 5 recites substantially similar subject matter to claim 1 and is rejected with the same rationale, mutatis mutandis.
Claims 6-8 recite substantially similar subject matter to claims 2-4 respectively and are rejected with the same rationale, mutatis mutandis.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 1-8 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lee (“Privacy-Preserving Machine Learning with Fully Homomorphic Encryption for Deep Neural Network”, 2021) and Lu (“Pegasus: Bridging Polynomial and Non-polynomial Evaluations in Homomorphic Encryption”, 2021).
Regarding claim 1, Lee teaches
An operating method of a fully homomorphic encrypted neural network model, wherein the fully homomorphic encrypted neural network model includes a plurality of layers, and the method is performed by a processor and comprises: (The abstract states "In this work, we firstly implement the standard ResNet-20 model with the RNS-CKKS [Fully homomorphic encryption] with bootstrapping and verify the implemented model with the CIFAR-10 dataset and the plaintext model parameters." The implementation of the model is interpreted as the operating method. The ResNet-20 model is interpreted as the fully homomorphic neural network model. Table 1 on page 4 states that there are 4 convolutional layers, interpreted as the plurality of layers.)
for one of the plurality of layers, encrypting a plaintext input with a first encryption algorithm to generate a ciphertext vector; (Page 5 states "The message is a 32 x 32 CIFAR-10 image, and one image is processed at a time. We can use 215 message slots in one ciphertext with our parameters, which is the half polynomial degree. Therefore, we employ the sparse packing method [7] to pack a channel of a CIFAR-10 image in one ciphertext using only 210 sparse slots since the bootstrapping of sparsely packed ciphertext takes much less time than that of fully packed ciphertext." Page 3 states "We prepare the pre-trained model parameters by training the original ResNet-20 model with the CIFAR-10 plaintext dataset and perform the privacy-preserving ResNet-20 with these plaintext pre-trained model parameters and encrypted input images." Therefore, the plaintext input images are encrypted into a ciphertext vector. Pages 5-6, Section 3.2 gives details on the encryption algorithm used, which is CKKS-RNS.)
performing a convolution operation according to the ciphertext vector to generate a result vector; (Page 6 states "Most of the operations in the ResNet-20 are convolutions with zero-padded input to maintain their size. We use the packed single input single output (SISO) convolution with stride 1 used in Gazelle [20], which has low complexity for the encrypted data." Page 6, Figure 2(b) shows an example of the convolution, which uses the ciphertext vector and generates a result vector.)
inputting the plurality of result ciphertexts into an activation function to generate a plurality of encrypted activation values; and (Page 5, Fig. 1 shows that the convolutional operations are followed by ReLU, an activation function, meaning that the ciphertexts from the previous step would be input into the activation function and generate encrypted activation values.)
Lee does not appear to explicitly teach
converting the result vector into a plurality of result ciphertexts adopting a second encryption algorithm;
repacking the plurality of encrypted activation values to generate an output vector adopting the first encryption algorithm.
However, Lu—directed to analogous art—teaches
converting the result vector into a plurality of result ciphertexts adopting a second encryption algorithm; (The specification of the current application, [0027] states "The conversion operation mentioned in step S3 applies PEGASUS, which is a framework for converting between CKKS ciphertext and LWE ciphertext without decryption. Please refer to ‘jie Lu, W., Huang, Z., Hong, C., Ma, Y., Qu, H.: PEGASUS: Bridging 5 polynomial and non-polynomial evaluations in homomorphic encryption. In: 2021 IEEE Symposium on Security and Privacy. pp. 1057-1073. IEEE Computer Society Press (May 2021).’" LWS is interpreted as the second encryption algorithm.)
repacking the plurality of encrypted activation values to generate an output vector adopting the first encryption algorithm. (Page 1064 states "Finally, PEGASUS repacks a set of LWE ciphertexts to an RLWE ciphertext by simply using the implementations of the FLT and Fmod (Step 9-10)." The abstract "PEGASUS can efficiently switch back and forth between a packed CKKS ciphertext and FHEW ciphertexts without decryption, allowing us to evaluate arithmetic functions efficiently on the CKKS side, and to evaluate look-up tables on FHEW ciphertexts." As the final step is to repack the values, the repacking results in an output vector adopting the first encryption algorithm, CKKS.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to combine the teachings of Lee with the teachings of Lu because, as Lu states on page 1058, "In this work, we present PEGASUS, a highly optimized framework that supports both SIMD style operations and LUT evaluations on large input domains (i.e., the last row of Table II)." Additionally, the abstract states "PEGASUS can efficiently switch back and forth between a packed CKKS ciphertext and FHEW ciphertexts without decryption, allowing us to evaluate arithmetic functions efficiently on the CKKS side, and to evaluate look-up tables on FHEW ciphertexts"
Regarding claim 2, the rejection of claim 1 is incorporated herein. Lee teaches
before performing the convolution operation according to the ciphertext vector to generate the result vector, for each of the plurality of layers, performing a training procedure for a plurality of times to generate a plurality of plaintext activation values, wherein the training procedure comprises: (Page 3 states "We prepare the pre-trained model parameters by training the original ResNet-20 model with the CIFAR-10 plaintext dataset and perform the privacy-preserving ResNet-20 with these plaintext pre-trained model parameters and encrypted input images." Table 1 on page 4 shows the layers of the trained neural network.)
performing the convolution operation on the plaintext input to generate a plaintext vector; and (Page 5, Fig. 1 shows the trained neural network, which performs convolution on the input, which is plaintext during training.)
inputting the plaintext vector into the activation function to generate one of the plurality of plaintext activation values; (Page 5, Fig. 1 shows that the end of each convolutional block is a ReLU activation function, which would generate plaintext activation values during training.)
updating a weight of the convolution operation according to the linear mapping function; and (Training of a neural network inherently involves updating weights based on each layer of the neural network. Therefore, the weight of the convolution operation depends on each other operation in the neural network, including the activation function. As the linear mapping function updates the activation function, as taught by Lu (see explanation below), the weight of the convolution operation would be updated according to the linear mapping function.)
Lee does not appear to explicitly teach
determining a linear mapping range according to a range of the plurality of plaintext activation values;
for each of the plurality of layers, determining a linear mapping function according to the range of the plurality of plaintext activation values and the linear mapping range;
updating the activation function according to an inverse function of the linear mapping function.
However, Lu—directed to analogous art—teaches
determining a linear mapping range according to a range of the plurality of plaintext activation values; (Page 1061 states "To use a larger ciphertext modulus
q
≫
n
for larger plaintexts, our insight is to use an approximate LWE decryption formula which is computed in modulo
n
. To do so, we first scale down the modulus from
q
to
ϵ
~
n
, i.e.,
b
~
=
ϵ
~
n
q
b
and
a
~
=
ϵ
~
n
q
a
for some even value
ϵ
~
∈
N
such as
ϵ
~
=
2
." Page 1061 further states "We also need to modify the look-up table as
T
(
x
)
=
T
(
q
ϵ
~
n
)
x
to take inputs from the range
x
∈
-
n
/
2
,
n
/
2
By doing so, the origin LUT can be homomorphically evaluated within a subset of the wider range
[
-
q
/
2
ϵ
~
,
q
/
2
ϵ
~
]
." The modulus is interpreted as the range. Therefore, the range of the input values (plurality of plaintext activation values) is
q
and the linear mapping range is
ϵ
~
n
.)
for each of the plurality of layers, determining a linear mapping function according to the range of the plurality of plaintext activation values and the linear mapping range; (Page 1061 states "To use a larger ciphertext modulus
q
≫
n
for larger plaintexts, our insight is to use an approximate LWE decryption formula which is computed in modulo
n
. To do so, we first scale down the modulus from
q
to
ϵ
~
n
, i.e.,
b
~
=
ϵ
~
n
q
b
and
a
~
=
ϵ
~
n
q
a
for some even value
ϵ
~
∈
N
such as
ϵ
~
=
2
." Page 1061 further states "We also need to modify the look-up table as
T
(
x
)
=
T
(
q
ϵ
~
n
)
x
to take inputs from the range
x
∈
-
n
/
2
,
n
/
2
By doing so, the origin LUT can be homomorphically evaluated within a subset of the wider range
[
-
q
/
2
ϵ
~
,
q
/
2
ϵ
~
]
." The mapping function is
x
~
=
ϵ
~
n
q
x
, which involves the range of the plurality of plaintext activation values
q
and the linear mapping range
ϵ
~
n
.)
updating the activation function according to an inverse function of the linear mapping function. ("We also need to modify the look-up table as
T
(
x
)
=
T
(
q
ϵ
~
n
)
x
to take inputs from the range
x
∈
-
n
/
2
,
n
/
2
By doing so, the origin LUT can be homomorphically evaluated within a subset of the wider range
[
-
q
/
2
ϵ
~
,
q
/
2
ϵ
~
]
."
T
(
x
)
=
T
(
q
ϵ
~
n
)
x
is the inverse of
x
~
=
ϵ
~
n
q
x
. Therefore, the LUT is updated by an inverse of the linear mapping function. Page 1065 states "sigmoid/ReLU/sqrt/reciprocal. Many useful functions can be evaluated via one LUT, for instance sigmoid, ReLU, square-root and reciprocal. These functions are commonly used in machine learning algorithms." Therefore, as the activation function (ReLU) is determined by the LUT, updating the LUT is updating the activation function.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to combine the teachings of Lee and Lu for the reasons given above in regards to claim 1.
Regarding claim 3, the rejection of claim 1 is incorporated herein. Lee does not appear to explicitly teach
wherein the first encryption algorithm is Cheon-Kim-Kim-Song (CKKS) algorithm, and the second encryption algorithm is associated with Learn with errors (LWE).
However, Lu—directed to analogous art—teaches
wherein the first encryption algorithm is Cheon-Kim-Kim-Song (CKKS) algorithm, and the second encryption algorithm is associated with Learn with errors (LWE). (The specification of the current application, [0027] states "The conversion operation mentioned in step S3 applies PEGASUS, which is a framework for converting between CKKS ciphertext and LWE ciphertext without decryption. Please refer to ‘jie Lu, W., Huang, Z., Hong, C., Ma, Y., Qu, H.: PEGASUS: Bridging 5 polynomial and non-polynomial evaluations in homomorphic encryption. In: 2021 IEEE Symposium on Security and Privacy. pp. 1057-1073. IEEE Computer Society Press (May 2021).’" CKKS is interpreted as the first encryption algorithm; LWS is interpreted as the second encryption algorithm.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the present application to combine the teachings of Lee and Lu for the reasons given above in regards to claim 1.
Regarding claim 4, the rejection of claim 1 is incorporated herein. Lee teaches
The operating method of the fully homomorphic encrypted neural network model of claim 1, wherein the activation function is Rectified Linear Unit (ReLU). (Page 6 states "The activation function of the ResNet-20 is the ReLU function.")
Regarding claim 5, Lee teaches
An operating system of a fully homomorphic encrypted neural network model comprising: (Page 8 states "We simulate the proposed model by the SEAL library [14] released by Microsoft. Our simulation environment is a dual Intel Xeon Platinum 8280 CPU (112 cores) with 512GB memory." The environment is interpreted as the operating system. The abstract states "In this work, we firstly implement the standard ResNet-20 model with the RNS-CKKS [Fully homomorphic encryption] with bootstrapping and verify the implemented model with the CIFAR-10 dataset and the plaintext model parameters." The implementation of the model is interpreted as the operating method. The ResNet-20 model is interpreted as the fully homomorphic neural network model. Table 1 on page 4 states that there are 4 convolutional layers, interpreted as the plurality of layers.)
a memory configured to store a plurality of instructions; and (Page 8 states "We simulate the proposed model by the SEAL library [14] released by Microsoft. Our simulation environment is a dual Intel Xeon Platinum 8280 CPU (112 cores) with 512GB memory." The memory necessarily stores instructions in order to perform the method.)
a processor electrically connected to the memory to execute the plurality of instructions, wherein the plurality of instructions is configured to perform a plurality of operations on one of a plurality of layers of the fully homomorphic encrypted neural network model, and the plurality of operations comprises: (Page 8 states "We simulate the proposed model by the SEAL library [14] released by Microsoft. Our simulation environment is a dual Intel Xeon Platinum 8280 CPU (112 cores) with 512GB memory." The processor is necessarily connected the memory and executes the instructions in order to perform the method. Fig. 1 shows operations on layers of the neural network.)
The remainder of claim 5 recites substantially similar subject matter to claim 1 and is rejected with the same rationale, mutatis mutandis.
Claims 6-8 recite substantially similar subject matter to claims 2-4 respectively and are rejected with the same rationale, mutatis mutandis.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JESSICA THUY PHAM whose telephone number is (571)272-2605. The examiner can normally be reached Monday - Friday, 9 A.M. - 5:00 P.M..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Li Zhen can be reached at (571) 272-3768. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/J.T.P./Examiner, Art Unit 2121
/Li B. Zhen/Supervisory Patent Examiner, Art Unit 2121
Prosecution Insights