Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The office action is in response to the application filed on April 15, 2024.
Claims 1-20 are pending and have been examined. Claims 1-20 are rejected.
Information Disclosure Statement
Acknowledgment is made of the information disclosure statements filed May 15, 2024, which comply with 37 CFR 1.97. As such, the information disclosure statements have been placed in the application file and the information referred to therein has been considered by the examiner.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter.
According to the USPTO guidelines, a claim is directed to non-statutory subject matter if:
Step 1: The claim does not fall within one of the four statutory categories of invention (process, machine, manufacture, or composition of matter), or,
Step 2: The claim recites a judicial exception, e.g. an abstract idea, without reciting additional elements that amount to significantly more than the judicial exception, as determined using the following analysis:
Step 2A, Prong 1: Does the claim recite an abstract idea, law of nature, or natural phenomenon?
Step 2A, Prong 2: Does the claim recite additional elements that integrate the judicial exception into a practical application?
Step 2B: Does the claim recite additional elements that amount to significantly more than the judicial exception?
MPEP 2106.04(a)(2)(I) states: "The mathematical concepts grouping is defined as
mathematical relationships, mathematical formulas or equations, and mathematical
calculations."
MPEP 2106.04(a)(2)(III) states: "Accordingly, the "mental processes" abstract idea grouping is defined as concepts performed in the human mind, and examples of mental
processes include observations, evaluations, judgements, and opinions.
Further, the MPEP states: "The courts do not distinguish between mental processes that
are performed entirely in the human mind and mental processes that require a human to use a
physical aid (e.g. pen and paper or a slide run) to perform the claim limitation.
Using the two-step inquiry, it is clear that Claims 1-20 are each directed to non-statutory
subject matter as shown below:
Please note the following:
The following groups of claims are expressed in different statutory categories:
Claims 1-10 are directed to a method for providing a federated learning system that monitors network traffic to detect anomalous behavior and calculates a performance score, correlation metric, and client node score to ultimately assist in updating a global machine learning model.
Claims 11-20 are directed to a non-transitory storage medium storing machine-executable instructions which, when executed by a hardware processor of a computing device, cause the processor to carry out a process/operation.
With respect to Claims 1 and 11, which are independent claims with identical claim limitations:
Step 1: Claim 1 is directed to a method, also known as a process, which is one of the four statutory categories of patentable subject matter. Claim 11 is directed to a non-transitory storage medium on which machine-executable instructions are stored, corresponding to an article of manufacture, which is one of the four statutory categories of patentable subject matter.
Step 2A, Prong 1: A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“calculating, using a function, a correlation metric based on a historical consistency of a local ML model that is returned encrypted to the central server from a plurality of client nodes of the federated learning system;”; Calculating a correlation metric based on historical consistency of a local ML model that is returned encrypted using a function is an abstract idea of a mathematical calculation, as directed to “a claim that recites a mathematical calculation, when the claim is given its broadest reasonable interpretation in light of the specification, will be considered as falling within the "mathematical concepts" grouping. A mathematical calculation is a mathematical operation (such as multiplication) or an act of calculating using mathematical methods to determine a variable or number”. See MPEP § 2106.04(a)(2)(I)(C).
“monitoring, using a ML model, network traffic between the central server and the plurality of client nodes to detect anomalous behavior in the network traffic based on historical network traffic behavior between the central server and the plurality of client nodes;” ; Monitoring network traffic between the central server and the plurality of client nodes to detect anomalous behavior is an abstract idea of a mental process that can practically be performed in the human mind, with or without the use of a physical aid such as pen and paper (including an observation, evaluation, judgment, opinion) -See MPEP § 2106.04(a)(2)(III).
“calculating, using another function, performance score based on a historical performance of the local ML model that is returned encrypted to the central server from the plurality of client nodes;” ; Calculating a performance score based on a historical performance of the local ML model that is returned encrypted using another function is an abstract idea of a mathematical calculation, as directed to “a claim that recites a mathematical calculation, when the claim is given its broadest reasonable interpretation in light of the specification, will be considered as falling within the "mathematical concepts" grouping. A mathematical calculation is a mathematical operation (such as multiplication) or an act of calculating using mathematical methods to determine a variable or number”. See MPEP § 2106.04(a)(2)(I)(C).
“calculating a client node score for each of the plurality of client nodes based on the correlation metric, any detected anomalous behavior in the network traffic, and the performance score;”; Calculating a client node score for the client nodes based on a correlation metric, any detected anomalous behavior, and the performance metric is an abstract idea of a mental process that can practically be performed in the human mind, with or without the use of a physical aid such as pen and paper (including an observation, evaluation, judgment, opinion) -See MPEP § 2106.04(a)(2)(III).
“selecting one or more of the plurality of client nodes for inclusion in a federated learning cycle based on the client node score of each of the plurality of client nodes;”; Selecting one or more of the plurality of client nodes for inclusion in a federated learning cycle based on the client node score is an abstract idea of a mental process that can practically be performed in the human mind, with or without the use of a physical aid such as pen and paper (including an observation, evaluation, judgment, opinion) -See MPEP § 2106.04(a)(2)(III).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into a practical application:
“and updating a global ML model by aggregating each local model returned to the central server from the selected one or more client nodes and weighting a contribution of each local model according to the client node score of the client node that returned each local model to the central server.” ; Updating a global ML model by aggregating each local model returned to the central server from the selected one or more client nodes and weighting a contribution of each local model according to the client node score only amounts to "apply it" and the mere instructions to implement an abstract idea on a computer - see MPEP 2106.05(f)(1) in addition to generally links the use of the abstract idea to a particular technological environment or field of use - See MPEP § 2106.05(h).
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception. Updating a global ML model by aggregating each local model returned to the central server from the selected one or more client nodes and weighting a contribution of each local model according to the client node score amounts to "apply it" and mere instructions to implement an abstract idea on a computer. The claim fails to recite details of how a solution or outcome to a problem is accomplished because it is unclear how the "AI system" or "machine learning" is used nor does the specification make it clear how these actions are performed - see MPEP 2106.05(f)(1)). The usage of a global machine learning model is generally linked to a particular technological environment or field of use (AI/ML) - see MPEP 2106.05(h).
Therefore, Claims 1 and 11 are directed to non-statutory subject matter and rejected.
With respect to Claims 2 and 12 which are dependent on Claims 1 and 11 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim. A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“applying the first input weighting parameter to the correlation metric; and applying the second input weighting parameter to the performance score.”; Applying the first input weighting parameter to the correlation metric; and applying the second input weighting parameter to the performance score is an abstract idea of a mathematical calculation, as directed to “a claim that recites a mathematical calculation, when the claim is given its broadest reasonable interpretation in light of the specification, will be considered as falling within the "mathematical concepts" grouping. A mathematical calculation is a mathematical operation (such as multiplication) or an act of calculating using mathematical methods to determine a variable or number”. See MPEP § 2106.04(a)(2)(I)(C).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
“receiving first and second input weighting parameters based on the global ML model;”; Receiving first and second input weighting parameters based on the global ML model is considered insignificant extra-solution activity (mere data gathering) - see MPEP 2106.05(g).
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception. Receiving first and second input weighting parameters based on the global ML model constitutes as receiving or transmitting data over a network, e.g., using the internet to gather data which has been recognized as well‐understood, routine, and conventional when they are claimed in a generic manner." - See MPEP 2106.05(d)(II).
Therefore, Claims 2 and 12 are directed to non-statutory subject matter and rejected.
With respect to Claims 3 and 13 which are dependent on Claims 1 and 11 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim. A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“applying an adaptive threshold to each of the client node scores;”; Applying an adaptive threshold to each of the client node scores is an abstract idea of a mathematical calculation, as directed to “a claim that recites a mathematical calculation, when the claim is given its broadest reasonable interpretation in light of the specification, will be considered as falling within the "mathematical concepts" grouping. A mathematical calculation is a mathematical operation (such as multiplication) or an act of calculating using mathematical methods to determine a variable or number”. See MPEP § 2106.04(a)(2)(I)(C).
“and selecting the one or more of the plurality of client nodes having a client node score that exceeds the adaptive threshold.”; Selecting the one or more of the plurality of client nodes having a client node score that exceeds the adaptive threshold is an abstract idea of a mental process that can practically be performed in the human mind, with or without the use of a physical aid such as pen and paper (including an observation, evaluation, judgment, opinion) -See MPEP § 2106.04(a)(2)(III).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
Therefore, Claims 3 and 13 are directed to non-statutory subject matter and rejected.
With respect to Claims 4 and 14 which are dependent on Claims 3 and 13 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim. A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“applying a threshold weighting parameter to the adaptive threshold to thereby weight up or down the adaptive threshold.”; Applying a threshold weighting parameter to the adaptive threshold to thereby weight up or down the adaptive threshold is an abstract idea of a mathematical calculation, as directed to “a claim that recites a mathematical calculation, when the claim is given its broadest reasonable interpretation in light of the specification, will be considered as falling within the "mathematical concepts" grouping. A mathematical calculation is a mathematical operation (such as multiplication) or an act of calculating using mathematical methods to determine a variable or number”. See MPEP § 2106.04(a)(2)(I)(C).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
Therefore, Claims 4 and 14 are directed to non-statutory subject matter and rejected.
With respect to Claims 5 and 15 which are dependent on Claims 3 and 13 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim. A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“wherein the adaptive threshold is determined based on a mean and standard deviation of a number of client nodes specified by the global ML model as being needed for updating the global model.”; Determining the adaptive threshold based on a mean and standard deviation of a number of client nodes is an abstract idea of a mathematical calculation, as directed to “a claim that recites a mathematical calculation, when the claim is given its broadest reasonable interpretation in light of the specification, will be considered as falling within the "mathematical concepts" grouping. A mathematical calculation is a mathematical operation (such as multiplication) or an act of calculating using mathematical methods to determine a variable or number”. See MPEP § 2106.04(a)(2)(I)(C).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
Therefore, Claims 5 and 15 are directed to non-statutory subject matter and rejected.
With respect to Claims 6 and 16 which are dependent on Claims 3 and 13 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim. A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“wherein when a number of available client nodes is less than a number of client nodes specified by the global ML model as being needed for updating the global ML model, the available client nodes having a client score that exceeds the adaptive threshold are selected.”; Selecting the available client nodes having a client score that exceeds the adaptive threshold based off of when a number of available client nodes is less than a number of client nodes specified by the global ML model as being needed for updating the global ML model is an abstract idea of a mental process that can practically be performed in the human mind, with or without the use of a physical aid such as pen and paper (including an observation, evaluation, judgment, opinion) -See MPEP § 2106.04(a)(2)(III).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
Therefore, Claims 6 and 16 are directed to non-statutory subject matter and rejected.
With respect to Claims 7 and 17 which are dependent on Claims 1 and 11 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim. A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“removing a client node from the one or more selected client nodes when anomalous behavior in the network traffic between the client node and the central server is detected.”; Removing a client node from the one or more selected client nodes when anomalous behavior in the network traffic is detected is an abstract idea of a mental process that can practically be performed in the human mind, with or without the use of a physical aid such as pen and paper (including an observation, evaluation, judgment, opinion) -See MPEP § 2106.04(a)(2)(III).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
Therefore, Claims 7 and 17 are directed to non-statutory subject matter and rejected.
With respect to Claims 8 and 18 which are dependent on Claims 7 and 17 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim.
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
“wherein removing a client node from the one or more selected client nodes comprises setting the client node score to zero.”; Setting the client node score to zero when removing a previously selected client node is considered insignificant extra-solution activity (post-solution activity) - see MPEP 2106.05(g)
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception. Setting the client node score to zero when removing a previously selected client node constitutes as an insignificant extra-solution activity, specifically a post-solution activity. - see MPEP 2106.05(g).
Therefore, Claims 8 and 18 are directed to non-statutory subject matter and rejected.
With respect to Claims 9 and 19 which are dependent on Claims 1 and 11 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim.
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
“wherein the contribution of the local ML model returned by the client node having a highest client node score is given the highest weight.”; Giving the client node that has the highest client node score the highest weight is considered insignificant extra-solution activity (post-solution activity) - see MPEP 2106.05(g).
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception. Giving the client node that has the highest client node score the highest weight constitutes as an insignificant extra-solution activity, specifically a post-solution activity. - see MPEP 2106.05(g).
Therefore, Claims 9 and 19 are directed to non-statutory subject matter and rejected.
With respect to Claims 10 and 20 which are dependent on Claims 1 and 11 respectively:
Step 2A, Prong 1: The claim incorporates the abstract idea of the independent claim. A judicial exception is recited in the claims as they recite mental processes, which are abstract ideas:
“generating a client node score list that lists a client ID for each client node, the client node score of each client node, and an anomaly alert for each client node.”; Generating a client node score list that lists a client ID for each client node, the client node score of each client node, and an anomaly alert for each client node is an abstract idea of a mental process that can practically be performed in the human mind, with or without the use of a physical aid such as pen and paper (including an observation, evaluation, judgment, opinion) -See MPEP § 2106.04(a)(2)(III).
Step 2A, Prong 2: The claims do not recite additional elements that integrate the judicial exception into practical application:
Step 2B: The claims do not recite additional elements that amount to significantly more than the judicial exception.
Therefore, Claims 10 and 20 are directed to non-statutory subject matter and rejected.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
Claims 1, 3, 4, 6, 7, 8, 9, 10, 11, 13, 14, 16, 17, 18, 19, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Kang et. Al, (Reliable Federated Learning for Mobile Networks, published October 14, 2019, hereinafter "Kang"), in view of Nguyen et. Al, (DÏoT: A Federated Self-learning Anomaly Detection System for IoT, published October 31, 2019, hereinafter “Nguyen”), further in view of Cao et. Al (FLTrust: Byzantine-robust Federated Learning via Trust Bootstrapping, published April 12, 2022, hereinafter “Cao”). All disclosure dates are before the effective filing date of the instant application, i.e., April 15, 2024. Therefore, Kang, Nguyen, and Cao constitute prior art under 35 U.S.C. 103.
With respect to Claims 1 and 11:
Kang teaches:
“calculating, using a function, a correlation metric based on a historical consistency of a local ML model that is returned encrypted to the central server from a plurality of client nodes of the federated learning system;” ([Kang sec. IV, pg. 5] defines a computational procedure (subjective logic model function) that takes worker interaction data as input and returns a numeric reputation value as output, “We therefore utilize the subjective logic model to calculate composite reputation values of worker candidates. Subjective logic is widely used to evaluate the trust level between different entities in the networks [1], [7], which is a specific framework of uncertain reasoning that uses a belief metric named “opinion” to represent a subjective beliefs about the world.” [Kang sec. IV, pg. 5] further denotes a reputation value expressing the degree of association between a worker’s positive/negative interaction history and its trustworthiness (Ti correlation metric), “The belief (distrust) degree is expressed by the positive (negative) interaction percentage of all interactions with good communication quality, denoted as bi→j = (1 −ui→j) αj αj+βj and di→j = (1 − ui→j) βj αj+βj . From the local opinion vector, a local reputation value is generated to represent the task publisher’s expected belief that the worker provides high-quality local model updates during the federated learning. The local reputation value is expressed as Ti→j = bi→j + γui→j, where γ is the given constant indicating an effect level of the uncertainty for the reputation.” [Kang pg. 3 & 5] denotes that the correlation metric is based on the historical consistency of the ML model, “The reputation can reflect how well a worker has performed about model training, which can be measured from its training task completion history with the past behaviors of good or unreliable activities [10]…The task publisher records the numbers of positive and negative interaction events of all workers after a learning task, i.e., αj and βj, and generates local reputation opinions for the workers.” [Kang pgs. 2, 6, 5] denote returning the correlation metric (Ti-based reputation value) in an encrypted state from a plurality of client nodes (workers) to the central server (central aggregator/task publisher), “The reputation values of the data owners are securely managed and stored on the consortium blockchain consisting of the edge nodes [2]…The federated learning significantly improves privacy protection of the mobile devices through blocking attack surfaces for direct access to the raw training data[2]…We consider ten workers in this federated learning task including two malicious workers who launch poisoning attacks, four unreliable workers with low-quality data, and four well-behaved workers[6]... After that, all task publishers can obtain the latest reputation opinions for a certain worker candidate from the reputation blockchain. Lastly, with the help of the reputation blockchain, the task publishers are able to select high-reputation workers for federated learning tasks[5].”) Examiner’s Note: Under BRI, utilizing a consortium blockchain allows only authorized edge nodes to participate in the consensus and management of reputation values synonymous to cryptographic keys, further restricting data access only to trusted network entities providing decentralization, transparency, and immutability.
Kang alone does not appear to explicitly disclose:
“monitoring, using a ML model, network traffic between the central server and the plurality of client nodes to detect anomalous behavior in the network traffic based on historical network traffic behavior between the central server and the plurality of client nodes;”
However, Nguyen teaches:
“monitoring, using a ML model, network traffic between the central server and the plurality of client nodes to detect anomalous behavior in the network traffic based on historical network traffic behavior between the central server and the plurality of client nodes;” ([Nguyen pg. 5] teaches utilizing a ML model to monitor network traffic between the central server (IoT security service) and the plurality of client nodes (security gateways) in order to detect anomalous behavior in the network traffic, “The GRU models are learned using traffic collected at several Security Gateways, each monitoring a client IoT network. Each Security Gateway observing a device of a particular type type#k contributes to training its anomaly detection model….In our system, the training data available at each Security Gateway depends on the duration that an IoT device has been in the network and the amount of interaction it has had, which varies largely between clients.” [Nguyen pg. 6] further denotes monitoring communications between client nodes and the central server for anomaly detection purposes, “Each client (Security Gateway) trains its GRU model locally for several epochs before reporting updates to IoT Security Service. This limits the communication overhead by reducing the number of updates to send to the IoT Security Service. To the best of our knowledge, we are the first to employ a federated learning approach for anomaly detection-based intrusion detection.” [Nguyen pg. 8] further discloses that this detection is based on historical network traffic behaviors because the probability estimate is conditioned on a lookback history of preceding traffic symbols, “…we inferred that a lookback history of k = 20 symbols is sufficient to capture most communication interactions with sufficient accuracy.”)
Kang-Nguyen are analogous art and in the same field of invention because both references pertain to distributed network security within modern decentralized ecosystems as well as vulnerability and trust among edge nodes (mobile devices and IoT devices) that are prone to compromise, malicious manipulation, or poor data quality. While Kang teaches effectively securing federated learning by weeding out workers who upload fraudulent, poisoned, or low-quality data, Nguyen teaches securing IoT environments by addressing the failure of existing intrusion detection techniques to spot compromised, malware-infected devices. It would have been obvious to a person having ordinary skill in the art (PHOSITA) before the effective filing date of the claimed invention to implement the base reference of Kang (data integrity and worker trust during decentralized machine learning training) with the teachings of Nguyen (device vulnerability and malware detection) in order to find a way to verify integrity, detect threats, and ensure that only trusted data or devices are allowed to influence the network. One of ordinary skill in the art would be motivated to do so because by integrating Nguyen's framework into the methods of Kang one would be able to note that, "With the help of reputation, each task publisher selects only high-reputation workers to eliminate the impact from unreliable workers, thereby leading to high accuracy of the learning task, {[pg. 1] of Kang}."
The combination of Kang-Nguyen alone does not appear to explicitly disclose:
“calculating, using another function, performance score--------"
However, Cao teaches:
“calculating, using another function, performance score--------” ([Cao pg. 2 & 6] disclose calculating a performance score (trust score), “the server first assigns a trust score (TS) to a local model update, where the trust score is larger if the direction of the local model update is more similar to that of the server model update. Formally, we use the cosine similarity between a local model update and the server model update to measure the similarity of their directions.” using another function (equation 2), “In particular, we use the popular ReLU operation for clipping. Formally, our trust score is defined as follows: TSi=ReLU(ci), (2)”)
Kang-Nguyen-Cao are analogous art and in the same field of invention because all three references pertain to securing federated learning environments against unreliable, anomalous, or malicious data inputs without compromising privacy. While Kang teaches utilizing a Consortium Blockchain to manage a decentralized "reputation metric" for mobile workers in order to prevent the tampering or repudiation of worker history, Nguyen teaches focusing specifically on IoT Security and Intrusion Detection to create autonomous, device-type-specific communication profiles to flag anomalies without human intervention. Similarly, Cao teaches FLTrust, where the central service provider bootstraps trust using a clean "root dataset" and scores client updates based on how closely their mathematical direction matches the server's own clean model. It would have been obvious to a person having ordinary skill in the art (PHOSITA) before the effective filing date of the claimed invention to implement the base reference of Kang (worker selection and preventing intentional/unintentional frauds) with the teachings of Nguyen (95.6% detection rate in 257ms against Mirai malware with zero false alarms) further with the teachings of Cao (Service provider-to-client architectures facing adaptive adversarial attacks) in order to accurately filter out or minimize the impact of bad data/updates to ensure the global model remains highly accurate, reliable, and secure without compromising user privacy. One of ordinary skill in the art would be motivated to do so because by integrating Nguyen's and Cao’s framework into the methods of Kang one would be able to note that a system implementation as such can, "preserve the classification accuracy of the global model in the presence of malicious clients performing strong poisoning attacks, {[pg. 4] of Cao}."
Thus, the combination of Kang-Nguyen-Cao teaches:
“-----------based on a historical performance of the local ML model that is returned encrypted to the central server from the plurality of client nodes;” ([Kang pgs. 2, 6, 5] denote returning the historical-based performance score (trust score from Cao) in an encrypted state from a plurality of client nodes (workers) to the central server (central aggregator/task publisher), “The reputation values of the data owners are securely managed and stored on the consortium blockchain consisting of the edge nodes [2]…The federated learning significantly improves privacy protection of the mobile devices through blocking attack surfaces for direct access to the raw training data[2]…We consider ten workers in this federated learning task including two malicious workers who launch poisoning attacks, four unreliable workers with low-quality data, and four well-behaved workers[6]... After that, all task publishers can obtain the latest reputation opinions for a certain worker candidate from the reputation blockchain. Lastly, with the help of the reputation blockchain, the task publishers are able to select high-reputation workers for federated learning tasks[5].”)
“calculating a client node score for each of the plurality of client nodes based on the correlation metric, any detected anomalous behavior in the network traffic, and the performance score;” ([Kang pg. 6] discloses calculating client node scores for each of the plurality of client nodes (workers) based on the correlation metric (reputation values), “When calculating the composite reputation value of a worker, the task publisher takes not only the overall recommended opinions, but also its own local reputation opinion into consideration to avoid collusion cheating from other task publishers (as shown in 4). The composite reputation of the task publisher to the worker is denoted as a final reputation opinion vector including three elements: the final belief degree, the final distrust degree, and the final uncertainty degree.” [Kang pg. 5] further denotes that the uncertainty term folded into the formula that determines the correlation metric (reputation value) is in itself determined by detecting any anomalous behavior in network traffic by already accepting a transmission/communication-behavior-type input alongside the opinion-history term, “the uncertainty degree is determined by the quality of communication link between the worker j and the task publisher i, i.e., the unsuccessful probability of data packet transmission (e.g., a worker unintentionally ignoring or dropping communication packets).”) Examiner’s Note: Kang's own combining formula already folds in a transmission-behavior-type input alongside its opinion-history term, demonstrating that a person having ordinary skill in the art (PHOSITA) would readily extend the same combining mechanism to merge the three specifically-claimed, reference-distinct inputs (Kang's correlation metric, Nguyen's anomaly-detection output, and Cao's performance score) into one client node score, rather than needing all three inputs to originate from Kang alone.
“selecting one or more of the plurality of client nodes for inclusion in a federated learning cycle based on the client node score of each of the plurality of client nodes;” ([Kang pg. 4 step 2] discloses selecting one or more of the plurality of client nodes, “The task publisher starts to select its workers from the worker candidates according to their reputation values calculated by the subjective logic model in Section IV.” [Kang pg. 4 step 4] further discloses selecting for inclusion in a federated learning cycle, “We can adopt different optimization algorithms to train a federated learning model…This initial SGD model is received by selected workers and the workers collaboratively train the global model by using their own local data.” [Kang pg. 4 step 2] further discloses that this selection is based on a component of the client node score of each client node (worker), “The worker candidates with reputation values above a threshold can be selected as the workers. Here, the task publishers can set different reputation thresholds by themselves according to their own security level requirements.”)
“and updating a global ML model by aggregating each local model returned to the central server from the selected one or more client nodes and weighting a contribution of each local model according to the client node score of the client node that returned each local model to the central server.” ([Cao pg. 3 step 2-3] discloses global model w being updated during each iteration using the computed aggregate g once returned to the server from the selected one or more client nodes, “Then, each client sends its local model update gi = wi − w (i.e., the difference between its local model and the current global model) to the server…Updating the global model via aggregating the local model updates. The server computes a global model update g via aggregating the local model updates according to some aggregation rule. Then, the server updates the global model using the global model update, i.e., w = w + α · g, where α is the global learning rate.” [Cao pg. 6] further reinforces that updating the global ML model relies on weighting a contribution of each local model according to a component of the client node score (performance/trust score) of the client node, “Aggregating the local model updates: We compute the average of the normalized local model updates weighted by their trust scores as the global model update: g= 1 n j=1 TSj n i=1 TSi·¯g”) Examiner’s Note: Cao's weighted average by own score aggregation formula (Eq. 4) — the weighting variable in that formula is a part of the client node score S formed by the (Kang + Cao + Nguyen composite client node score).
Therefore, Claims 1 and 11 are rejected.
With respect to Claims 3 and 13:
The combination of Kang-Nguyen-Cao teaches:
“wherein selecting the one or more of the plurality of client nodes for inclusion in the federated learning cycle comprises: applying an adaptive threshold to each of the client node scores;” ([Kang pg. 4] discloses selecting client nodes (workers) as a result of applying an adaptive threshold to each of the client node scores (reputation value component of client node score), “The worker candidates with reputation values above a threshold can be selected as the workers. Here, the task publishers can set different reputation thresholds by themselves according to their own security level requirements.”) Examiner’s Note: Kang applies a threshold to each candidate's reputation (component of the client node) score, and that threshold is not fixed, it is adaptive, set per-publisher according to application-specific requirements.
“and selecting the one or more of the plurality of client nodes having a client node score that exceeds the adaptive threshold.” ([Kang pg. 7] teaches that if the client node score component (reputation value) does not exceed the adaptive threshold, the client node (worker) is not selected and deemed unreliable, “shows the impact of reputation thresholds of successful detection on the accuracy of a federated learning task (EMD=1.6, attack strength=0.9). If a worker’s calculated reputation is below the given reputation threshold, the worker will be treated as a malicious or unreliable worker.”) Examiner’s Note: Selection is conditioned on each candidate's own score exceeding the threshold, with Fig. 5 empirically confirming the exceeds/below-threshold selection rule in operation.
Therefore, Claims 3 and 13 are rejected.
With respect to Claims 4 and 14:
The combination of Kang-Nguyen-Cao teaches:
“applying a threshold weighting parameter to the adaptive threshold to thereby weight up or down the adaptive threshold.” ([Kang pg. 7] disclosing factoring in threshold weighting to increase and decrease the adaptive threshold, “Figure 5 illustrates that the higher reputation threshold brings a higher federated learning accuracy. Although the accuracy of the MSL scheme is lower than that of the ATV scheme under lower reputation thresholds, the MSL scheme has the same performance as that of the ATV scheme when the reputation is higher than 0.35.”) Examiner’s Note: A publisher with stricter security requirements sets the threshold higher; a more permissive publisher sets it lower i.e., the threshold is weighted up or down according to a configurable parameter.
Therefore, Claims 4 and 14 are rejected.
With respect to Claims 6 and 16:
The combination of Kang-Nguyen-Cao teaches:
“wherein when a number of available client nodes is less than a number of client nodes specified by the global ML model as being needed for updating the global ML model, the available client nodes having a client score that exceeds the adaptive threshold are selected.” ([Cao pg. 3] teaches a scenario where the number of available client nodes becomes less than the number needed by the global ML model to successfully compute an update, “The trim parameter k should be at least the number of malicious clients to make Trim-mean robust. In other words, Trim-mean can tolerate less than 50% of malicious clients.” [Cao pg. 14] further discloses this teaching, “Impact of the number of malicious clients: Figure 6 shows the testing error rates of different FL methods under different attacks and the attack success rates of the Scaling attacks on MNIST-0.5, when the fraction of malicious clients increases from 0 to 95%. Trim-mean cannot be applied when the fraction of malicious clients exceeds 50% because the number of local model updates removed by Trim-mean is twice of the number of malicious clients. Therefore, for Trim-mean, we only show the results when the malicious clients are less than 50%.) Examiner’s Note: The parameter k acts as a dynamic filtering threshold. To maintain robustness, the system evaluates the clients and dynamically adjusts what it filters out. Only clients that survive this filtering process (their score/reliability exceeds the adaptive safety threshold) (i.e., they are categorized within the safe, non-malicious fraction under the 50% limit) are permitted to contribute. The system is explicitly selecting a specific subset of available nodes based on a threshold calculation (
PNG
media_image1.png
1
1
media_image1.png
Greyscale
2𝑘
PNG
media_image1.png
1
1
media_image1.png
Greyscale
< total updates) to ensure the global model has enough clean data to update itself.
Therefore, Claims 6 and 16 are rejected.
With respect to Claims 7 and 17:
The combination of Kang-Nguyen-Cao teaches:
“removing a client node from the one or more selected client nodes…” ([Kang pg. 4] discloses removing the client node (worker) as well as differentiating these underperforming client nodes as separate flagged entities from the plurality of selected client nodes, “With the help of these schemes, the task publisher removes malicious updates from poisoning attacks and unreliable local model updates from the lazy or untrusted workers…During the federated learning process, either the lazy and unreliable workers or the workers with poisoning attackers in each model iteration are recorded as a negative interaction by the task publisher.”) Examiner’s Note: Kang's Step 4 removal of lazy/untrusted workers (§III-B Step 4), applied after the Step 2 selection mapped to claim 1's selecting limitation, where a previously-selected worker is removed from participation.
“…when anomalous behavior in the network traffic between the client node and the central server is detected.” ([Nguyen pg. 5] in combination with Kang discloses tracking anomalous behaviors in the network traffic to determine client node removal procedures, “we trigger an anomaly alarm, if the fraction of anomalous packets in W is larger than an anomaly triggering threshold γ, i.e., if |{si ∈ S|pi < δ}| w >γ.”) Examiner’s Note: Nguyen’s anomaly-alarm-detection condition is the trigger event for removal of the client node (worker).
Therefore, Claims 7 and 17 are rejected.
With respect to Claims 8 and 18:
The combination of Kang-Nguyen-Cao teaches:
“wherein removing a client node from the one or more selected client nodes comprises setting the client node score to zero.” ([Cao pg. 6] presents the equation that contributes to removing the client node, “we exclude such local model updates from the aggregation by clipping the cosine similarity. In particular, we use the popular ReLU operation for clipping…ReLU is defined as follows: ReLU(x) = x if x > 0 and ReLU (x)= 0 otherwise.” [Cao pg. 12, Table IV/VI-B] further indicates the FLTrust-NoReLU row degrades to 0.28 (no attack) and 0.90 (under attack) versus 0.05/0.05 for full FLTrust, showcasing "the necessity of our ReLU operation.") Examiner’s Note: Cao teaches a specific mechanism (ReLU clipping) for driving a client's score to exactly zero upon a disqualifying signal, thereby excluding its contribution from aggregation. Applying that same zeroing technique to the client node score computed in claim 1's upon detection of a network-traffic anomaly (rather than only to Caos's own native TSi) teaches "setting the client node score to zero," consistent with Table IV's ablation confirming the zeroing step is functionally necessary.
Therefore, Claims 8 and 18 are rejected.
With respect to Claims 9 and 19:
The combination of Kang-Nguyen-Cao teaches:
“wherein the contribution of the local ML model returned by the client node having a highest client node score is given the highest weight.” ([Cao pg. 5-6] discloses Eq. (4): g = (1/∑nj=1 TSj) · ∑ni=1 TSi · ḡi — client i's weight in the sum is TSi / ∑j TSj, strictly monotonically increasing in TSi. Fig. 2 (worked example): TS1 = c1 > 0 receives a nonzero weighted contribution; TS2 = ReLU(c2) = 0 receives none.) Examiner’s Note: FLTrust's weighting-term form, score / Σ(scores) (Eq. 4) is strictly increasing in that client's own score and is applied using the client node score from claim 1 as the weighting variable i.e. (the client node having a highest client node score is given the highest weight). FLTrust's aggregation weight for a given client is a strictly increasing function of that same client's own score, regardless of which score is used. Applying that same mathematical form to the client node score computed in claim 1 ( the Kang + Cao + Nguyen composite), rather than Cao's own isolated TSi, necessarily gives the highest-scoring client node the highest weight, a direct mathematical consequence of adopting Cao's weighting form for that composite score.
Therefore, Claims 9 and 19 are rejected.
With respect to Claims 10 and 20:
The combination of Kang-Nguyen-Cao teaches:
“generating a client node score list” ([Kang pg. 5] discloses generating a client node score list, “the task publisher’s interaction histories and local reputation opinions for the workers with digital signatures are recorded as “transactions” and uploaded to the pre-selected miners in the reputation blockchain.” [Kang. Fig. 1] also depicts "Reputation storage" on the blockchain, populated from "Reputation calculation," feeding the "Worker selection" block.) Examiner’s Note: Kang generates and maintains a stored, query-able record of reputation values across the worker population (a client node score list), persisted on the reputation blockchain rather than transiently held.
“that lists a client ID for each client node,” ([Kang pg. 4] discloses client ID determination for each client node being listed, “The task publisher validates the identity and data resource information of the requesters, then the legal requesters can be the worker candidates.”) Examiner’s Note: Each worker candidate is individually identified before entering the reputation/scoring pipeline, and the Step 5 blockchain record is indexed by that identity i.e. supplying the per-client "client ID" field of the recited list.
“the client node score of each client node,” ([Kang pg. 5] discloses the client node score of each client node being listed, “After that, all task publishers can obtain the latest reputation opinions for a certain worker candidate from the reputation blockchain.”) Examiner’s Note: The blockchain record is retrievable per worker candidate by its latest reputation value (an ID-indexed score field).
“and an anomaly alert for each client node.” ([Kang pg. 3] identifies the unsolved problem as the lack of "the synchronous information of malicious and unreliable worker lists." [Kang Fig. 1] discloses "Low reputation worker candidates" shown flagged with a warning indicator at the worker-selection block.) Examiner’s Note: Kang identifies and (via Fig. 1) visually flags low-reputation/malicious candidates alongside its ID-indexed score record anomaly alert).
Therefore, Claims 10 and 20 are rejected.
Claims 2 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Kang, in view of Nguyen, further in view of Cao, further in view of Sanchez et. Al (FederatedTrust: A Solution for Trustworthy Federated Learning, published July 06, 2023, hereinafter “Sanchez”). All disclosure dates are before the effective filing date of the instant application, i.e., April 15, 2024. Therefore, Kang, Nguyen, Cao, and Sanchez constitute prior art under 35 U.S.C. 103.
With respect to Claims 2 and 12:
The combination of Kang-Nguyen-Cao alone does not appear to explicitly disclose:
“receiving first and second input weighting parameters based on the global ML model; applying the first input weighting parameter to the correlation metric; and applying the second input weighting parameter to the performance score.”
However, Sanchez teaches:
“receiving first and second input weighting parameters based on the global ML model;” ([Sanchez pg. 10] teaches independently configurable per-metric weights (§4) one for Client Reputation, one for Performance (first and second input weighting parameters), “It is important to mention that each metric can consider different input sources and can be calculated in a different phase of the FL model creation process…Once the normalized outputs of metrics are calculated, they are weighted and aggregated to compute one score per notion (see Section 3 for more information about notions). Each pillar has one or more notions calculated according to predefined but configurable weights per metric.”) Examiner’s Note: [pg. 16, sec. 6.3] frames weight selection as tunable according to the needs of each scenario i.e., the specific FL deployment, task, and model being trained (based on the global ML model).
“applying the first input weighting parameter to the correlation metric;” ([Sanchez pg. 7] cites, “Client Reputation. In [50], a novel reputation metric was proposed, and a subjective logic model was used to calculate the reputation score for each client interaction. After each training iteration, the server uses a poisoning attack detection scheme and the elapsed time to determine if the local update from the client is reliable.” [Sanchez pg. 10] further teaches applying the first input weighting parameter to the correlation metric, “Once the normalized outputs of metrics are calculated, they are weighted and aggregated to compute one score per notion.”) Examiner’s Note: Sanchez’s Client Reputation metric (§3.2), which incorporates Kang's Ti→j reputation value represents the same component mapped to "correlation metric" in the independent claim 1. [50] is further referencing the Kang reference itself as well.
“and applying the second input weighting parameter to the performance score.” ([Sanchez pg. 6] teaches applying the second input weighting parameter to the performance score/metric, “In FL, there are two approaches to measuring performance. One is reserving a set of test or validation data on the server side to be used for global model evaluation. The other is by evaluating test accuracy at each client’s device and aggregating the test accuracy.” [Sanchez pg. 7] further teaches this notion, “If a round of training at one client improves the performance of the global model, then the data from that client has a high-quality score…Performance Fairness ensures that each client’s reward should be proportional to their data contribution.” [Sanchez pg. 10] discloses the second input weighting parameters and the performance-tracking scores they are applied to, “This input contains information about the client class balance, client test performance loss, client test accuracy, client clever score, coefficient of variation for client feature importance, coefficient of variation for client test accuracy, coefficient of variation for clients participation rate, coefficient of variation for client class imbalance, client average training time, average model size, average upload bytes, and average download bytes.”) Examiner’s Note: Performance metric (§3.2, Table 2) is distinct from, and independently weighted from, Client Reputation.
Kang-Nguyen-Cao-Sanchez are analogous art and in the same field of invention because all four references pertain to establishing/quantifying trust, security, and reliability in decentralized machine learning environments. While Kang teaches establishing a decentralized reputation management system to filter out unreliable or malicious workers amongst distributed edge nodes, Nguyen teaches building autonomous, self-learning anomaly detection profiles specific to device types to identify compromised devices by their network behavior. Similarly, while Cao teaches calculating a trust score by measuring how much a client's update deviates from the server's update isolating malicious or adaptive attacks, Sanchez teaches a six-pillar taxonomy (privacy, robustness, fairness, explainability, accountability, federation) and an algorithm to calculate a single trustworthiness score for FL models. It would have been obvious to a person having ordinary skill in the art (PHOSITA) before the effective filing date of the claimed invention to implement the base reference of Kang (reputation management) with the teachings of Nguyen (IoT intrusion detection) further with the teachings of Cao (service-provider bootstrapped trust) and further with the teachings of Sanchez (holistic trust evaluation) in order to create mechanisms such as reputation metrics, behavioral baselines, trust scores, and comprehensive pillars to ensure the global AI model is not compromised by untrusted or malicious participants. One of ordinary skill in the art would be motivated to do so because by integrating Nguyen's, Cao’s, and Sanchez’s framework into the methods of Kang one would be able to note, " how a real federated application can leverage configuration optimizations during its design in order to increase its trustworthiness without losing notable performance. Note that more changes could be applied according to the metric to optimize, {[pg. 15] of Sanchez}."
Therefore, Claims 2 and 12 are rejected.
Claims 5 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Kang, in view of Nguyen, further in view of Cao, further in view of Ribero et. Al (Communication-Efficient Federated Learning via Optimal Client Sampling, published October 14, 2020, hereinafter “Ribero”). All disclosure dates are before the effective filing date of the instant application, i.e., April 15, 2024. Therefore, Kang, Nguyen, Cao, and Ribero constitute prior art under 35 U.S.C. 103.
With respect to Claims 5 and 15:
The combination of Kang-Nguyen-Cao does not appear to completely disclose:
“wherein the adaptive threshold is determined based on a mean and standard deviation…” ([Kang pg. 4] teaches the threshold being derived from the mean and standard deviation of client scores “The reputation thresholds can also be adjusted by some statistical metrics based on the mean and standard deviation of reputation values of their worker candidates.”)
“…of a number of client nodes specified by the global ML model as being needed for updating the global model.” ([Kang pg. 7] teaches client node (worker) specification directly impacting and influencing the updating capabilities of the global ML model, “efficient schemes for optimizing the number of workers are worth investigation in order to balance the learning performance and resource cost.”)
However, Ribero more explicitly teaches:
“wherein the adaptive threshold is determined based on a mean and standard deviation…” ([Ribero pg. 10] teaches the threshold being derived from the mean and standard deviation of the participating client pool, “The reputation thresholds can also be adjusted by some statistical metrics based on the mean and standard deviation of reputation values of their worker candidates.”)
“…of a number of client nodes specified by the global ML model as being needed for updating the global model.” ([Ribero Table 1] has an N variable that explicitly teaches “number of clients to sample”. [Ribero pg. 2] further discloses an instance of specifying a certain number of client nodes for the purpose of updating the global ML model, “a server distributes an initial model to clients who independently update the model using their local training data. These updates are aggregated by the server which broadcasts a new global model to the clients and selects a subset of them to start a new round of local training; the procedure is repeated until convergence.”)
Kang-Nguyen-Cao-Ribero are analogous art and in the same field of invention because all four references pertain to improving the efficiency, security, and reliability of federated learning systems to make them viable for real-world, large-scale deployments. While Kang teaches heightening trustworthiness by managing reputation scores securely without tampering, Nguyen teaches applying a self-learning intrusion detection system designed to spot compromised IoT devices. Similarly, while Cao teaches neutralizing malicious updates by analyzing their directional deviation and normalizing their magnitude, Ribero teaches a mathematical framework (the Ornstein-Uhlenbeck process) to sample only the clients with the most informative updates while estimating the missing updates from unselected clients. It would have been obvious to a person having ordinary skill in the art (PHOSITA) before the effective filing date of the claimed invention to implement the base reference of Kang (preventing data poisoning) with the teachings of Nguyen (cybersecurity application) further with the teachings of Cao (malicious attack mitigation) and further with the teachings of Ribero (reducing network traffic without relying on data compression) in order to transition FL from a theoretical concept into a robust, scalable system by solving its core vulnerabilities: unreliable/malicious participants and heavy communication overhead. One of ordinary skill in the art would be motivated to do so because by integrating Nguyen's, Cao’s, and Ribero’s framework into the methods of Kang one would be able to note that a system implementation as such, " helps maintain and even improve the accuracy of the baseline scheme, while cutting communication by up to 50%. Experimental results demonstrate efficacy of the proposed methods in various settings. Moreover, our approach can be combined with compression strategies to lower the communication rates even further, {[pg. 17] of Ribero}."
Therefore, Claims 5 and 15 are rejected.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: Shaloudegi et. Al (US20220237508A1: SERVERS, METHODS AND SYSTEMS FOR SECOND ORDER FEDERATED LEARNING, Filed January 28, 2021).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NOOR F CHEEMA whose telephone number is (571)272-9642. The examiner can normally be reached Monday-Friday 7:30am-5:00pm alternative Fridays off.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Mariela Reyes can be reached at (571) 270-1006. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/N.F.C./ Examiner, Art Unit 2142 /Mariela Reyes/Supervisory Patent Examiner, Art Unit 2142
