DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This office action is in response to submission of application on 04/08/2024.
Claims 1-14 are presented for examination.
Priority
Applicant’s claim for the benefit of a prior-filed application JP2023-070186 filed on 04/21/2023 is acknowledged and admitted. Receipt is acknowledged of papers submitted under 35 U.S.C. 119(a)-(d), which papers have been placed of record in the file.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 04/08/2024 is/are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Specification
The Specification filed on 04/08/2024 is acceptable for examination purposes.
Drawings
The drawings are objected to as failing to comply with 37 CFR 1.84(p)(5) because they include the following reference character not mentioned in the description: 'S1' (Fig. 8). Corrected drawing sheets in compliance with 37 CFR 1.121(d), or amendment to the specification to add the reference character(s) in the description in compliance with 37 CFR 1.121(b) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-14 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The analysis of the claims will follow the 2019 Revised Patent Subject Matter Eligibility Guidelines (“2019 PEG”).
Step 1: Is the claim directed at one of the four statutory categories?
Claims 1-8 are directed to an information processing apparatus comprising: a memory storing processing instructions; and at least one processor configured to execute the processing instructions, which falls within the statutory category of a machine.
Claims 9-13 are directed to an information processing method, which falls within the statutory category of a process.
Claim 14 is directed to non-transitory computer-readable storage medium, which falls within the statutory category of an article of manufacture.
Therefore, claims 1-14 are directed to one of the four statutory categories of invention, i.e., process, machine, manufacture, or composition of matter. (MPEP § 2106.03)
Independent Claims
Step 2A Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Yes, independent claims 1, 9, & 14 recite an abstract idea in the form of mental processes. A mental process is a process that “can be performed in the human mind, or by a human using a pen and paper” (MPEP § 2106.04(a)(2)(III), ¶1). Examples of mental processes include “observations, evaluations, judgments, and opinions” (MPEP § 2106.04(a)(2)(III), ¶2).
The following limitations of claims 1, 9, & 14 are mental processes:
determining, based on a decision boundary of a machine learning model that relates to a first attribute value and a second attribute value input to the machine learning model and on target data including a pair of a known value of the first attribute value and an unknown candidate value of the second attribute value, whether the target data is valid as training data for the machine learning model; [Determining if target data is valid based the evaluation of known and candidate attribute information in view of the decision boundary is a mental process involving evaluation, judgement, and opinions.]
estimating a value of the second attribute value from the candidate value of the second attribute value included by the target data determined to be valid. [Estimation of a value based on obtained information is a mental process involving evaluations, judgement, and opinions that could be reasonably performed by the human mind with aid of pen and paper.]
Therefore, the independent claims recite a judicial exception
Step 2A Prong Two: Does the claim recite additional elements that integrate the judicial exception into a practical application?
No. The judicial exception recited in the above discussed claims is not integrated into a practical application.
Claim 1 recites An information processing apparatus comprising: a memory storing processing instructions; and at least one processor configured to execute the processing instructions to: [This is mere recitation that a judicial exception is to be performed using generic computer equipment running general class of computer algorithms in their ordinary capacity. (MPEP § 2106.05(f))]
Claim 14 recites A non-transitory computer-readable storage medium storing a program, the program comprising instructions for causing a computer to execute processes: [This is mere recitation that a judicial exception is to be performed using generic computer equipment running general class of computer algorithms in their ordinary capacity. (MPEP § 2106.05(f))]
Therefore, under MPEP § 2106.04(d), the additional elements of the claims do not integrate the judicial exception into a practical application.
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
No. The claims do not recite additional elements that are sufficient for the claims to amount to significantly more than the judicial exception.
Additional elements that are mere instructions to apply an exception do not constitute significantly more than a judicial exception under MPEP § 2106.05(I)(A). Since the additional elements in the independent claims are all mere instructions to apply an exception, they do not constitute significantly more than a judicial exception.
Therefore, the additional elements identified in the Step 2A Prong Two analysis do not constitute significantly more than a judicial exception.
Dependent Claims
The remaining dependent claims being rejected do not recite additional elements, whether considered individually or in combination, that are sufficient to integrate the judicial exception into a practical application or amount to significantly more than the judicial exception.
Claims 2 & 10:
Step 2A, Prong 1:
determining whether the target data is valid based on a boundary value […] and on the known value of the first attribute value. [Determining if target data is valid as claimed is a mental process: observation, evaluation, judgement, something that can be done with the human mind, or with the aid of pen and paper (MPEP 2106.04(a)(2)(III))]
Step 2A, Prong 2 and Step 2B:
corresponding to the first attribute value in the decision boundary based on a content of a conditional branch of a decision tree model serving as the machine learning model [This additional element does no more than generally link the use of a judicial exception to a particular technological environment or field of use (MPEP § 2106.05(h)). This element merely limits the judicial exception to a particular computing environment, namely the field of machine learning and further specifically decision trees, and therefore does not integrate the judicial exception into a practical application or amount to significantly more than the abstract idea itself.]
Claims 3 & 11:
Step 2A, Prong 1:
determine, for each of a plurality of the target data including same known values of the first attribute value and different unknown candidate values of the second attribute value, whether the target data is valid based on comparison between a threshold value of a conditional expression included by the conditional branch and the known value of the first attribute value included by the target data. [Comparing a known value against a threshold to determine target data validity is a mental process: observation, evaluation, judgement, something that can be done with the human mind, or with the aid of pen and paper (MPEP 2106.04(a)(2)(III))]
Step 2A, Prong 2 and Step 2B:
There are no additional elements recited, as such the claim does not provide a practical application and is not considered to be significantly more.
Claim 4:
Step 2A, Prong 1:
determine that the target data is valid in a case where the threshold value of the conditional expression included by the condition branch of the decision tree model on a path through which the target data passes in the conditional branch and the known value of the first attribute value included by the target data are different from each other. [These further limitations merely further define the mental process recited in the parent claim and are therefore considered to be part of the mental process of the parent claim.]
Step 2A, Prong 2 and Step 2B:
There are no additional elements recited, as such the claim does not provide a practical application and is not considered to be significantly more.
Claim 5:
Step 2A, Prong 1:
determine that the target data is valid in a case where the known value of the first attribute value is outside a predetermined range with reference to the threshold value of the conditional expression included by the condition branch of the decision tree model on a path through which the target data passes in the conditional branch. [These further limitations merely further define the mathematical concept recited in the parent claim and are therefore considered to be part of the mathematical concept of the parent claim. This claim does not recite any non-abstract additional elements for the purposes of Step 2A Prong Two and Step 2B analysis]
Step 2A, Prong 2 and Step 2B:
There are no additional elements recited, as such the claim does not provide a practical application and is not considered to be significantly more.
Claims 6 & 12:
Step 2A, Prong 1:
estimate the value of the second attribute value from the candidate value of the second attribute value of the target data determined to be valid, based on the known value of the first attribute value paired with the candidate value of the second attribute value and on the decision
boundary. [These further limitations merely further define the mental process recited in the parent claim and are therefore considered to be part of the mental process of the parent claim.]
Step 2A, Prong 2 and Step 2B:
There are no additional elements recited, as such the claim does not provide a practical application and is not considered to be significantly more.
Claim 7 & 13:
Step 2A, Prong 1:
estimate the value of the second attribute value from the candidate value of the second attribute value of the target data determined to be valid, based on a distance between the known value of the first attribute value paired with the second attribute value and the threshold value of the conditional expression included by the conditional branch. [These further limitations merely further define the mathematical concept recited in the parent claim and are therefore considered to be part of the mathematical concept of the parent claim. This claim does not recite any non-abstract additional elements for the purposes of Step 2A Prong Two and Step 2B analysis]
Step 2A, Prong 2 and Step 2B:
There are no additional elements recited, as such the claim does not provide a practical application and is not considered to be significantly more.
Claim 8:
Step 2A, Prong 1:
estimate, as the value of the second attribute value, the candidate value of the second attribute value paired with the known value of the first attribute value having a largest distance from the threshold value of the conditional expression included by the conditional branch from among the candidate values of the second attribute value of the target data determined to be valid. [These further limitations merely further define the mental process recited in the parent claim and are therefore considered to be part of the mental process of the parent claim.]
Step 2A, Prong 2 and Step 2B:
There are no additional elements recited, as such the claim does not provide a practical application and is not considered to be significantly more.
The following references are relied upon for the art rejection set forth below:
Goldsteen et al. US Pub. No. US 2024/0320541 A1, Sep. 2024, Filed Mar. 2023, hereinafter Goldsteen
Choquette-Choo et al. Label-Only Membership Inference Attacks, Dec 2021, Hereinafter Choquette-Choo
Luo et al. Feature Inference Attack on Model Predictions in Vertical Federated Learning, April 2021, Hereinafter Luo
Yeom et al. Privacy Risk in Machine Learning: Analyzing the Connection to Overfitting, May 2018, Hereinafter Yeom
Chen et al. Robust Decision Trees Against Adversarial Examples, 2019, Hereinafter Chen
Alvarez et al. Ranking Cases with Decision Trees: a Geometric Method that Preserves Intelligibility, 2005, Hereinafter Alvarez
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 9, & 14 are rejected under 35 U.S.C. 103 as being unpatentable over Goldsteen in view of Choquette-Choo.
Regarding Claim 1, Goldsteen discloses An information processing apparatus comprising: a memory storing processing instructions; and at least one processor configured to execute the processing instructions to [Goldsteen: ¶0007] “The illustrative embodiments provide a method, system, and computer program product.” [Goldsteen: ¶0016] “An embodiment includes a computer system. The computer system includes one or more processors, one or more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories.” [Goldsteen: ¶0018] “FIG. 1 depicts an example diagram of a data processing environments” Goldsteen discloses an information (data) processing apparatus including a memory storing processing instructions and at least one processor configured to execute the processing instructions, as claimed.
determine, based on […] and on target data including a pair of a known value of the first attribute value and an unknown candidate value of the second attribute value, whether the target data is valid as training data for the machine learning model; and [Goldsteen: ¶0004] “a membership inference attack, given a trained model and a data sample, one can deduce whether or not that sample was part of the model's training… Given a trained model and knowledge about some of the features of a specific person, it may be possible to deduce the value of additional unknown features” [Goldsteen: ¶0004] “an attribute inference based on membership inference attack finds the target feature value that causes the membership inference attack to classify, with the highest confidence, the sample as a member.” Goldsteen discloses evaluating a sample including known feature information and a target feature value through a membership inference attack to determine whether the sample was part of the model’s training data. Because Goldsteen’s attribute inference-based membership attack evaluates the target feature value that causes the sample to be classified with the highest confidence as a member, the evaluated target feature value corresponds to the claimed candidate value of the unknown second attribute value. As such, Goldsteen discloses determining whether target data including the known feature information and a candidate value of the unknown target feature is valid as training data for the trained machine learning model, as claimed.
estimate a value of the second attribute value from the candidate value of the second attribute value included by the target data determined to be valid. [Goldsteen: ¶0004] “Given a trained model and knowledge about some of the features of a specific person, it may be possible to deduce the value of additional unknown features” Goldsteen discloses identifying, from the evaluated target feature values, the target feature value associated with the sample having the highest confidence of membership in the model’s training data. As such, Goldsteen discloses estimating the unknown target feature value from the candidate value associated with target data determined to be valid as training data, as claimed.
Goldsteen does not expressly disclose that the determination whether the target data is valid as training data is based on a decision boundary of a machine learning model that relates to a first attribute value and a second attribute value input to the machine learning model. However, Choquette-Choo does teach this limitation. [Choquette-Choo: §3.4] “These attacks predict membership using a point’s distance to the model’s decision boundary… we predict
x
a member if
d
i
s
t
h
x
,
y
>
τ
for some threshold
τ
." Choquettte-Choo discloses determining whether an input sample is a member of the model’s training data based on the sample’s distance from the machine learning model’s decision boundary. As such, Choquette-Choo teaches performing the membership determination disclosed by Goldsteen based on the decision boundary of the machine learning model.
Goldsteen and Choquette-Choo are analogous art because they are from the same field of endeavor, specifically membership inference attacks against machine learning models, with Goldsteen teaching membership inference for determining whether a sample was part of a model’s training data and for inferring unknown feature values, and Choquette-Choo teaching membership inference using information associated with a model’s decision boundary.
It would have been obvious to a person having ordinary skill in the art (PHOSITA), before the effective filing date of the claimed invention, to incorporate Choquette-Choo’s decision boundary-based membership inference technique into Goldsteen’s attribute inference-based membership inference attack, in order to provide a finer-grained basis for determining whether a sample was part of the model’s training data.
The suggestion/motivation for doing so would have been provided by Choquette-Choo itself, which teaches that its membership inference (MI) attacks [Choquette-Choo: §3] “improve on existing attacks by (1) combining multiple strategically perturbed samples (queries) as a fine-grained signal of the model’s decision boundary” and further teaches [Choquette-Choo: §1] “how to extract fine-grained MI signal by analyzing a model’s robustness to perturbations of the target data, which reveals signatures of its decision boundary geometry.” A PHOSITA therefore would have been motivated to utilize Choquette-Choo’s decision boundary-based membership inference technique when performing Goldsteen’s membership inference attack, combining prior-art elements according to known methods to obtain the predictable result of a finer-grained membership inference signal for distinguishing training members from non-members. (MPEP § 2143.01(A))
Claim 9 is substantially similar in scope and spirit as claim 1, differing only in reciting An information processing method comprising: the recited operations. Goldsteen expressly discloses a method [Goldsteen: ¶0007] “The illustrative embodiments provide a method, system, and computer program product.” Therefore, the rejection of claim 1 is applied accordingly.
Claim 14 is substantially similar in scope and spirit as claim 1, differing only in reciting A non-transitory computer-readable storage medium storing a program, the program comprising instructions for causing a computer to execute processes to: perform the recited operations – a computer-implemented form, that Goldsteen discloses as implemented in software and executed on processing hardware [Goldsteen: ¶0016] “The computer system includes one or more processors, one or
more computer-readable memories, and one or more computer-readable storage devices, and program instructions stored on at least one of the one or more storage devices for execution by at least one of the one or more processors via at least one of the one or more memories.” Goldsteen further defines [¶0060] “A computer readable storage medium, as that term is used in the present disclosure, is not to be construed as storage in the form of transitory signals per se” corresponding to the non-transitory computer readable medium as claimed. Therefore, the rejection of claim 1 is applied accordingly.
Claims 2 & 10 are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Goldsteen and Choquette-Choo in further view of Luo.
In regards to Claim 2, the combination of Goldsteen and Choquette-Choo disclose the apparatus according to claim 1, wherein the at least one processor is configured to execute the processing instructions to determine whether the target data is valid based on […] and on the known value of the first attribute value [Goldsteen: ¶0004] “a membership inference attack, given a trained model and a data sample, one can deduce whether or not that sample was part of the model's training… Given a trained model and knowledge about some of the features of a specific person, it may be possible to deduce the value of additional unknown features” [Choquette-Choo: §3.4] “These attacks predict membership using a point’s distance to the model’s decision boundary… we predict
x
a member if
d
i
s
t
h
x
,
y
>
τ
for some threshold
τ
." Goldsteen therefore discloses determining whether target data is valid as training data using known feature information, while Choquette-Choo further discloses performing the membership determination based on a point’s distance to the model’s decision boundary.
The combination of Goldsteen and Choquette-Choo does not expressly disclose a boundary value corresponding to the first attribute value in the decision boundary based on a content of a conditional branch of a decision tree model serving as the machine learning model However, Luo does teach this limitation. Luo teaches [Luo: §II.A] “The DT [Decision Tree] model consists of a number of internal nodes and leaf nodes. Each internal node describes a branching threshold w.r.t. a feature, while each leaf node represents a class label. When predicting an input sample, a sequence of branching operations are executed based on comparisons of the sample’s feature values and the thresholds, until a leaf node is reached.” Luo further teaches that, in its path restriction attack, [Luo: §IV.B] “the adversary can restrict the candidate prediction paths to nr paths by comparing his own feature values with the branching thresholds in the tree model.” Luo discloses a decision tree model having conditional branches defined by branching thresholds corresponding to respective features, wherein a sample’s feature value is compared with the corresponding branching threshold to determine the conditional branch traversed by the sample. As such, Luo discloses a branching threshold corresponding to the first attribute value and based on the content of a conditional branch of the decision tree model, as claimed.
Goldsteen, Choquette-Choo, and Luo are analogous art because they are from the same field of endeavor, specifically inference attacks against machine learning models, with Luo teaching feature inference using decision tree models and branching thresholds.
It would have been obvious to a PHOSITA, before the effective filing date of the claimed invention, when performing the Goldsteen and Choquette-Choo inference attack against a decision tree model, to utilize Luo’s decision tree specific path restriction technique to restrict the candidate prediction paths and thereby reduce the set of possible paths considered when inferring the unknown feature value.
The suggestion/motivation for doing so would have been provided by Luo itself, which proposes [Luo: §I] “two specific attacks on the logistic regression (LR) and decision tree (DT) models when the adversary only has an individual prediction output. These attacks are straightforward to initiate and can achieve high accuracy when certain conditions are satisfied.” Luo further teaches that its attack methods [Luo: Abstract] “consider the most stringent setting that the adversary controls only the trained vertical FL model and the model predictions, relying on no background information of the attack target’s data distribution.” A PHOSITA would have been motivated to utilize Luo’s decision tree specific path-restriction technique when performing the Goldsteen and Choquette-Choo inference attack against a decision tree model, combining prior-art elements according to known methods to obtain the predictable benefit of performing feature inference from an individual prediction output while relying on no background information regarding the attack target’s data distribution.
Claim 10 is substantially similar in scope and spirit as claim 2, differing only in reciting An information processing method comprising: the recited operations. Goldsteen expressly discloses a method [Goldsteen: ¶0007] “The illustrative embodiments provide a method, system, and computer program product.” Therefore, the rejection of claim 2 is applied accordingly.
Claims 3, 4, 6, 11, & 12 are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Goldsteen, Choquette-Choo, and Luo in further view of Yeom.
Regarding Claim 3, the combination of Goldsteen, Choquette-Choo, and Luo discloses the information processing apparatus according to Claim 2, wherein the at least one processor is configured to execute the processing instructions to determine, […], whether the target data is valid based on comparison between a threshold value of a conditional expression included by the conditional branch and the known value of the first attribute value included by the target data. [Goldsteen: ¶0004] “an attribute inference based on membership inference attack finds the target feature value that causes the membership inference attack to classify, with the highest confidence, the sample as a member.” [Luo: §IV.B] “the adversary can restrict the candidate prediction paths to nr paths by comparing his own feature values with the branching thresholds in the tree model.” [Luo: Algorithm 1] “adversary’s feature value ≤ threshold value” Goldsteen discloses determining whether target data is valid as training data based on the membership determination, while Luo discloses comparing a known feature value with a branching threshold included in a conditional branch of the decision tree to determine which candidate path remains possible. As such, the combination discloses determining whether the target data is valid based on comparison between a threshold value of a conditional expression included by the conditional branch and the known value of the first attribute value included by the target data.
The combination of Goldsteen, Choquette-Choo and Luo does not expressly disclose, for each of a plurality of the target data including same known values of the first attribute value and different unknown candidate values of the second attribute value, however in Yeom does teach this limitation. [Yeom: §5.2] “Rather than guess the value of t, this adversary tries all values of t in order of their marginal probabilities until the membership adversary says “yes”.” [Yeom: §5.2 Adversary 7] “Suppose that t1, …, tm are the possible values of the sensitive attribute t…
2
.
F
o
r
a
l
l
i
∈
m
,
l
e
t
z
i
'
b
e
z
'
w
i
t
h
t
h
e
v
a
l
u
e
o
f
t
h
e
s
e
n
s
i
t
i
v
e
a
t
t
r
i
b
u
t
e
t
c
h
a
n
g
e
d
t
o
t
i
.
” Yeom discloses generating and evaluating a plurality of target samples
z
i
'
that retain the same remaining known information while including different candidate values
t
i
of the unknown sensitive attribute. As such, Yeom discloses the claimed plurality of target data including the same known first attribute value and different unknown candidate values of the second attribute value.
Goldsteen, Choquette-Choo, Luo, and Yeom are analogous art because they are from the same field of endeavor, specifically inference attacks against machine learning models.
It would have been obvious to a PHOSITA, before the effective filing date of the claimed invention, to utilize Yeom’s multi-query attribute inference technique in the combined Goldsteen, Choquette-Choo, and Luo inference attack by evaluating different possible values of the unknown feature while retaining the known feature information.
The suggestion/motivation for doing so would have been provided by Yeom itself, which explores [Yeom: Abstract] “the connection between membership inference and attribute inference, showing that there are deep connections between the two that lead to effective new attacks.” Yeom further teaches that [Yeom: §1] “Our reductions are not merely of theoretical interest. Rather, they function as practical attacks as well. We implemented a reduction for attribute inference and evaluated it on real data (Section 6.3). Our results show that when generalization error is high, the reduction adversary can outperform an attribute inference attack given in [4] by a significant margin.” A PHOSITA therefore would have been motivated to utilize Yeom’s candidate-value membership inference technique in the combined Goldsteen, Choquette-Choo, and Luo inference attack as a known practical approach for performing attribute inference, combining prior-art according to known methods to obtain the predictable benefit of improved attribute inference performance under the conditions identified by Yeom.
Regarding Claim 4, the combination of Goldsteen, Choquette-Choo, Luo, and Yeom discloses the information processing apparatus according to Claim 3, wherein the at least one processor is configured to execute the processing instructions to determine that the target data is valid in a case where the threshold value of the conditional expression included by the condition branch of the decision tree model on a path through which the target data passes in the conditional branch and the known value of the first attribute value included by the target data are different from each other. [Goldsteen: ¶0004] “a membership inference attack, given a trained model and a data sample, one can deduce whether or not that sample was part of the model's training” [Luo: §II.A] “Each internal node describes a branching threshold w.r.t. a feature, while each leaf node represents a class label. When predicting an input sample, a sequence of branching operations are executed based on comparisons of the sample’s feature values and the thresholds” [Luo: §IV.B] “the adversary can restrict the candidate prediction paths to nr paths by comparing his own feature values with the branching thresholds in the tree model.” Goldsteen discloses determining whether the target data is valid as training data, while Luo discloses determining the path through the decision tree based on comparison of the known feature value with the threshold of the conditional branch. Luo further compares the adversary’s feature value to the threshold value, including [Luo: Algorithm 1] “adversary’s feature value ≤ threshold value”, with the alternative branch being traversed when that condition is not satisfied. Accordingly, for target data traversing the alternative branch, the known feature value is greater than, and therefore different from, the branching threshold. As such, the combination discloses determining that target data is valid in a case where the known first-attribute value and the threshold value on the traversed conditional branch are different from each other.
Regarding Claim 6, the combination of Goldsteen, Choquette-Choo, Luo and Yeom discloses the information processing apparatus according to Claim 3, wherein the at least one processor is configured to execute the processing instructions to estimate the value of the second attribute value from the candidate value of the second attribute value of the target data determined to be valid, based on the known value of the first attribute value paired with the candidate value of the second attribute value and on the decision boundary. [Goldsteen: ¶0004] “Given a trained model and knowledge about some of the features of a specific person, it may be possible to deduce the value of additional unknown features” [Goldsteen: ¶0004] “an attribute inference based on membership inference attack finds the target feature value that causes the membership inference attack to classify, with the highest confidence, the sample as a member.” [Choquette-Choo: §3.4] “These attacks predict membership using a point’s distance to the model’s decision boundary” Goldsteen discloses estimating an unknown target feature value using known feature information and a candidate target feature value associated with a sample determined to be a training member, while Choquette-Choo discloses basing that membership determination on the machine learning model’s decision boundary. As such, the combination discloses the claimed estimation based on the known first-attribute value paired with the candidate second-attribute value and on the decision boundary.
Claims 11 & 12 are substantially similar in scope and spirit as claims 3, & 6, respectively, differing only in reciting An information processing method comprising: the recited operations. Goldsteen expressly discloses a method [Goldsteen: ¶0007] “The illustrative embodiments provide a method, system, and computer program product.” Therefore, the rejections of claims 3 & 6 are applied accordingly.
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over the combination of Goldsteen, Choquette-Choo, Luo, and Yeom in further view of Chen.
Regarding Claim 5 the combination of Goldsteen, Choquette-Choo, Luo, and Yeom discloses the information processing apparatus according to Claim 3, wherein the at least one processor is configured to execute the processing instructions to determine that the target data is valid […] . [Goldsteen: ¶0004] “a membership inference attack, given a trained model and a data sample, one can deduce whether or not that sample was part of the model's training” [Luo: §II.A] “Each internal node describes a branching threshold w.r.t. a feature, while each leaf node represents a class label. When predicting an input sample, a sequence of branching operations are executed based on comparisons of the sample’s feature values and the thresholds” [Luo: §IV.B] “the adversary can restrict the candidate prediction paths to nr paths by comparing his own feature values with the branching thresholds in the tree model.” Goldsteen discloses determining whether target data is valid as training data based on the membership determination, while Luo discloses determining or restricting the path through a decision tree model based on comparison of a known feature value with the branching threshold of the conditional branch.
The combination of Goldsteen, Choquette-Choo, Luo, and Yeom does not expressly disclose, determining that the target data is valid in a case where the known value of the first attribute value is outside a predetermined range with reference to the threshold value of the conditional expression included by the condition branch of the decision tree model on a path through which the target data passes in the conditional branch. However, Chen does teach this limitation. [Chen: §4.2] “We define Δ𝓘 as the ambiguity set, containing examples with feature j inside the [η-є, η+є] region (see Table 1). Only examples in Δ𝓘 may be perturbed from 𝓘L to 𝓘R or from 𝓘R to 𝓘L to reduce the score. Perturbing points in 𝓘\Δ𝓘 will not change the score or the leaves they are assigned to.” Chen discloses a predetermined range [η-є, η+є] defined with reference to a decision tree split threshold η, and distinguishes examples having feature values outside that range. As such, Chen teaches the claimed condition that the known value of the first attribute value is outside a predetermined range with reference to the threshold value of the conditional expression included by the conditional branch.
Goldsteen, Choquette-Choo, Luo, Yeom, and Chen are analogous art. Goldsteen, Choquette-Choo, Luo, and Yeom are from the same field of endeavor, specifically inference attacks against machine learning models. Chen is reasonably pertinent to the particular problem with which the claimed invention is concerned, namely determining information concerning input data based on traversal of a decision tree machine learning model.
It would have been obvious to a PHOSITA, before the effective filing date of the claimed invention, to apply Chen’s threshold-centered ambiguity range to Luo’s comparison of feature values with branching thresholds in a decision tree model, so that feature values whose branch assignment remains stable under bounded perturbation can be distinguished from feature values whose branch assignment may change.
The suggestion/motivation for doing so would have been provided by Luo and Chen themselves. Luo teaches ” [Luo: §IV.B] “the adversary can restrict the candidate prediction paths to nr paths by comparing his own feature values with the branching thresholds in the tree model.” Chen teaches [Chen: §1] “tree-based models are also vulnerable to adversarial examples” and develops a robust decision tree framework directed to [Chen: Abstract] “optimize the performance under the worst-case perturbation of input features”. Chen further teaches that it’s [Chen: Abstract] “proposed algorithms can substantially improve the robustness of tree-based models against adversarial examples.” Because Luo’s path restriction depends on determining a candidate path from feature value and branching threshold comparisons, Chen’s teaching that bounded perturbations can affect the branch or leaf assigned to an input would have provided a reason to improve the robustness of that path determination. A PHOSITA therefore would have been motivated to apply Chen’s threshold-based robustness technique to Luo’s decision tree path restriction, which relies on comparisons between known feature values and branching thresholds, in order to make the resulting path determination less susceptible to changes in the input feature value. Furthermore, this is the application of a known technique, Chen’s threshold centered evaluation of feature values relative to a decision tree branching threshold, to a known method ready for improvement, Luo’s decision tree path restriction based on comparisons between feature values and branching thresholds, to yield the predictable result of identifying feature values having a stable branch assignment under bounded perturbation. (MPEP §2143(D))
Claims 7, 8, & 13 are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Goldsteen, Choquette-Choo, Luo and Yeom, in further view of Alvarez.
Regarding Claim 7, the combination of Goldsteen, Choquette-Choo, Luo, and Yeom discloses the information processing apparatus according to Claim 6, wherein the at least one processor is configured to execute the processing instructions to estimate the value of the second attribute value from the candidate value of the second attribute value of the target data determined to be valid, […] [Goldsteen: ¶0004] “Given a trained model and knowledge about some of the features of a specific person, it may be possible to deduce the value of additional unknown features” [Goldsteen: ¶0004] “an attribute inference based on membership inference attack finds the target feature value that causes the membership inference attack to classify, with the highest confidence, the sample as a member.” Goldsteen discloses estimating an unknown second attribute value from a candidate value associated with target data determined to be a training member. Goldsteen further discloses that the sample includes the known feature information together with the target feature value being evaluated, thereby disclosing the known first attribute value paired with the candidate second attribute value. Luo further teaches [Luo: §II.A] “Each internal node describes a branching threshold w.r.t. a feature… a sequence of branching operations are executed based on comparisons of the sample’s feature values and the thresholds”. Luo therefore discloses a feature specific branching threshold corresponding to a conditional branch of the decision tree model.
The combination of Goldsteen, Choquette-Choo, Luo, and Yeom does not expressly disclose performing the estimation based on a distance between the known value of the first attribute value paired with the second attribute value and the threshold value of the conditional expression included by the conditional branch. However, Alvarez does teach evaluating a case based on its distance from the decision boundary of a decision tree. [Alvarez: §3] “Each test of the tree involves a unique attribute. We note Γ the decision boundary induced by the tree. Γ consists of several pieces of hyperplanes which are normal to the axes.” [Alvarez: §3.1] “Let x be a case, c(x) the class label assigned to x by the tree, d = d(x, Γ) the distance of x from the decision boundary Γ. We use the distance of an example from the decision boundary to define its geometric score.” Alvarez teaches evaluating a case based on its distance from the decision boundary induced by the decision tree. Alvarez further teaches that each tree test involves a unique attribute and that the resulting decision boundary comprises hyperplane portions normal to the respective feature axes. For a feature specific decision boundary, the distance to the boundary is determined along the corresponding feature axis. In the existing combination, Goldsteen supplies the known feature value associated with the candidate value being estimated, while Luo supplies corresponding feature-specific branching threshold of the conditional branch. Applying Alvarez’s distance-based evaluation to that feature specific boundary would provide the distance between the known first attribute value and the corresponding branching threshold. As such, the combination discloses estimating the second attribute value based on the distance as claimed.
Goldsteen, Choquette-Choo, Luo, Yeom, and Alvarez are analogous art. Goldsteen, Choquette-Choo, Luo, and Yeom are from the same field of endeavor as the claimed invention, specifically inference attacks against machine-learning models. Alvarez is also from the same field of endeavor as the claimed invention, specifically analysis of data using decision tree machine learning models.
It would have been obvious to a PHOSITA, before the effective filing date of the claimed invention, to apply Alvarez’s distance-based evaluation of cases relative to a decision tree decision boundary to the candidate values evaluated using the decision tree branching thresholds disclosed by Luo, so that the candidate values can be evaluated according to their distance from the applicable decision tree boundary.
The suggestion/motivation for doing so would have been provided by Alvarez itself, which teaches that [Alvarez: §1] “for some applications knowing the class of each case is not sufficient to make a decision, one needs to compare the cases to one another in order to select the most promising examples.” Alvarez further teaches that [Alvarez: §1] “the objective is to improve the ranking without modifying the tree itself” and that [Alvarez: §1] “it is generally possible to use directly the score induced by the distance to rank and to select the most interesting cases.” Alvarez additionally teaches that [Alvarez: Abstract] “The distance-based score gives good results even with pruned tree, so if the tree is intelligible this property is preserved with an improved ranking ability.” A PHOSITA would have been motivated to utilize Alvarez’s distance-based evaluation when evaluating candidate cases in a decision tree model in order to compare and distinguish the candidates while preserving the decision tree structure and improving the ability to rank the candidates. Furthermore, this is the application of a known technique, Alvarez’s distance-based evaluation of decision-tree cases, to a known method ready for improvement, to yield the predictable result of improved comparison and ranking of candidate cases while preserving the decision tree structure. (MPEP §2143(D))
Regarding Claim 8, the combination of Goldsteen, Choquette-Choo, Luo, Yeom, and Alvarez discloses the information processing apparatus according to Claim 7, wherein the at least one processor is configured to execute the processing instructions to estimate, as the value of the second attribute value, the candidate value of the second attribute value paired with the known value of the first attribute value having a largest distance from the threshold value of the conditional expression included by the conditional branch from among the candidate values of the second attribute value of the target data determined to be valid. [Goldsteen: ¶0004] “Given a trained model and knowledge about some of the features of a specific person, it may be possible to deduce the value of additional unknown features” [Goldsteen: ¶0004] “an attribute inference based on membership inference attack finds the target feature value that causes the membership inference attack to classify, with the highest confidence, the sample as a member.” Goldsteen discloses estimating an unknown second attribute value from a candidate value associated with target data determined to be a training member. [Luo: §II.A] “Each internal node describes a branching threshold w.r.t. a feature… a sequence of branching operations are executed based on comparisons of the sample’s feature values and the thresholds” [Alvarez: §3.1] “Let x be a case, c(x) the class label assigned to x by the tree, d = d(x, Γ) the distance of x from the decision boundary Γ. We use the distance of an example from the decision boundary to define its geometric score.” Luo further teaches the feature specific branching threshold of the applicable conditional branch, while Alvarez teaches evaluation of a case based on its distance from the corresponding decision boundary. [Alvarez: §1] “it is generally possible to use directly the score induced by the distance to rank and to select the most interesting cases.” [Alvarez: §3.1] “Cases are ranked in decreasing order relatively to the geometric score. The most promising cases have the highest geometric score, which means that their predicted class is the positive one and that they are far from the decision boundary.” Alvarez further teaches ranking and selecting candidate cases according to a score induced by their distance from the decision boundary. In the established combination, the candidate second attribute values supplied by Goldsteen and Yeom are evaluated with respect to the feature specific branching threshold supplied by Luo. Applying Alvarez’s distance-based ranking to those candidates provides for selecting the candidate paired with the known first attribute value having the greatest distance from the applicable branching threshold among the relevant candidate cases.
Claim 13 is substantially similar in scope and spirit as claim 7, differing only in reciting An information processing method comprising: the recited operations. Goldsteen expressly discloses a method [Goldsteen: ¶0007] “The illustrative embodiments provide a method, system, and computer program product.” Therefore, the rejection of claim 7 is applied accordingly.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Alvarez et al. “Keep the Decision Tree and Estimate the Class Probabilities Using its Decision Boundary”
Gambs et al. “Reconstruction attack through classifier analysis”
Tramèr et al. “Stealing Machine Learning Models via Prediction APIs”
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GRANT F FITCH whose telephone number is (571)270-0621. The examiner can normally be reached Monday-Thursday 7-3.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Miranda Huang can be reached at (571) 270-7092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/G.F.F./Examiner, Art Unit 2124
/MIRANDA M HUANG/Supervisory Patent Examiner, Art Unit 2124
Prosecution Insights