DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Receipt is acknowledged of certified copies of papers required by 37 CFR 1.55.
Claim Objections
Claims 8-14 and 16-20 are objected to because of the following informalities:
In claim 8, line 5, “a DL model” should read “a deep learning (DL) model”
In claim 16, line 1, “The storage medium” should read “The non-transitory computer readable storage medium” in order to properly reference “A non-transitory computer readable storage medium” in line 1 of claim 15
In claim 17, line 1, “The storage medium” should read “The non-transitory computer readable storage medium” in order to properly reference “A non-transitory computer readable storage medium” in line 1 of claim 15
In claim 18, line 1, “The storage medium” should read “The non-transitory computer readable storage medium” in order to properly reference “A non-transitory computer readable storage medium” in line 1 of claim 15
In claim 19, line 1, “The storage medium” should read “The non-transitory computer readable storage medium” in order to properly reference “A non-transitory computer readable storage medium” in line 1 of claim 15
In claim 20, line 1, “The storage medium” should read “The non-transitory computer readable storage medium” in order to properly reference “A non-transitory computer readable storage medium” in line 1 of claim 15
Dependent claims 9-14 are objected based on being directly or indirectly dependent on objected claim 8.
Dependent claim 17 is objected based on being directly or indirectly dependent on objected claim 16.
Dependent claims 19-20 are objected based on being directly or indirectly dependent on objected claim 18.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites the limitation “the DL” in line 4. There is insufficient antecedent basis for this limitation in the claim. For examination purposes, “the DL” has been interpreted as “the DL model” in reference to “a DL model” in line 3.
Claim 8 recites the limitation “the DL” in line 6. There is insufficient antecedent basis for this limitation in the claim. For examination purposes, “the DL” has been interpreted as “the DL model” in reference to “a DL model” in line 5.
Claim 15 recites the limitation “the DL” in line 6. There is insufficient antecedent basis for this limitation in the claim. For examination purposes, “the DL” has been interpreted as “the DL model” in reference to “a DL model” in line 5.
Dependent claim 2-7 is rejected based on being directly or indirectly dependent on rejected claim 1.
Dependent claim 9-14 is rejected based on being directly or indirectly dependent on rejected claim 8.
Dependent claim 16-20 is rejected based on being directly or indirectly dependent on rejected claim 15.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Regarding Claim 1,
Claim 1 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 1 is directed to a method, which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“calculating, based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset, an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified”
“obtaining an ownership verification result of the DL model to be verified by determining an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass can calculate an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the Gaussian mixture distribution, the model chain to be verified and the verification dataset to calculate an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified); and determine an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified to obtain an ownership verification result of the deep learning model to be verified (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the index values of the model chain to be verified to determine an authenticity of the model chain to obtain an ownership verification result of the deep learning model to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“a computer”
“a deep learning (DL) model”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). The limitations:
“obtaining a Gaussian mixture distribution for initialization of a DL model to be verified, a model chain to be verified of the DL to be verified, and a verification dataset, wherein the model chain to be verified is composed of model parameters of the DL model to be verified in each training epoch”
As drafted, are additional elements that correspond to insignificant extra-solution activity. In particular, the additional elements are merely directed towards mere data gathering. See MPEP 2106.05(g). Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computer and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 2,
Claim 2 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 2 is directed to a method, which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“calculating, based on the model chain to be verified and the verification dataset, an accuracy of each model in the model chain to be verified on the verification dataset in sequence”
“calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index”
“calculating a parameter distance between a model in the model chain to be verified and a converged model”
“calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index, wherein the converged model is a final model in the model chain to be verified”
“obtaining the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence”
“obtaining the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution”
“obtaining the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified”
“obtaining the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass calculating an accuracy of each model in the model chain to be verified on the verification dataset in sequence based on the model chain to be verified and the verification dataset (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the model chain to be verified and the verification dataset to calculate an accuracy of each model in the model chain to be verified on the verification dataset in sequence); calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index (corresponds to mathematical calculations); calculating a parameter distance between a model in the model chain to be verified and a converged model (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a parameter distance between a model in the model chain to be verified and a converged model); calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index (corresponds to mathematical calculations); calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence to obtain the parameter distribution continuity index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence); calculate a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution to obtain the initial parameter distribution index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution); calculating a randomness of parameters of the initial model in the model chain to be verified to obtain the initial parameter randomness index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified); and calculating a parameter distance between the initial model and the converged model in the model chain to be verified to obtain the model chain distance index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 1 of a generic computer and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 1 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computer and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 3,
Claim 3 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 3 is directed to a method, which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“wherein the accuracy monotonicity index is calculated as:
PNG
media_image1.png
58
326
media_image1.png
Greyscale
where ρacc represents the accuracy monotonicity index, N represents a total number of training epochs, rank(∙) represents a ranking of an accuracy of an intermediate model in the model chain to be verified, acc(Ci, Dval) represents an accuracy of an i-th intermediate model Ci in the model chain to be verified on the verification dataset, and Dval represents the verification dataset”
“the parameter distance monotonicity index is calculated as:
PNG
media_image2.png
58
306
media_image2.png
Greyscale
where ρdis represents the parameter distance monotonicity index, N represents the total number of training epochs, rank(∙) represents a ranking of an Euclidean distance of parameters between the intermediate model and the converged model in the model chain to be verified, and d(Ci, CN) represents an Euclidean distance of parameters between the i-th intermediate model Ci and the converged model CN in the model chain to be verified”
“the parameter distribution continuity index is calculated as:
PNG
media_image3.png
36
352
media_image3.png
Greyscale
where cweight represents the parameter distribution continuity index, N represents a total number of training epochs, L represents a number of layers of the model,
w
l
i
represents a parameter matrix of an l-th layer of the i-th intermediate model in the model chain to be verified, P(⋅) represents a distribution of parameters, and EMD(⋅,⋅) represents an Earth Mover’s Distance between two distributions”
“the initial parameter distribution index is calculated as follows:
PNG
media_image4.png
46
300
media_image4.png
Greyscale
where dinit represents the initial parameter distribution index, L represents a number of layers of the model, EMD(⋅,⋅) represents an Earth Mover’s Distance between the two distributions, P(⋅) represents a distribution of parameters,
w
l
0
represents a parameter matrix of the l-th layer of the initial model, and PGMM(⋅) represents the Gaussian mixture distribution”
“the initial parameter randomness index is calculated by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified”
“the model chain distance index is calculated as:
dchain=d(C0, CN)
where dchain represents the model chain distance index, and d(C0, CN) represents an Euclidean distance of parameters between the initial model C0 and the converged model CN in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass using the given equation to calculate the accuracy monotonicity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the parameter distance monotonicity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the parameter distribution continuity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the initial parameter distribution index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the initial parameter randomness index by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified to calculate the initial parameter randomness index); and using the given equation to calculate the model chain distance index (corresponds to mathematical formulas or equations and mathematical calculations).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 2 of a generic computer and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 2 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computer and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 4,
Claim 4 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 4 is directed to a method, which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold”
“in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent, determining the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified”
“in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent, determining the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can judge whether the accuracy of each of the index values of the model chain to be verified meets a corresponding threshold to determine the authenticity of the model chain); determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to determining that any of the index values of the model chain to be verified is incoherent, determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified); and determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to determining any of the index values of the model chain to be verified is coherent, determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 1 of a generic computer and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 1 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computer and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 5,
Claim 5 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 5 is directed to a method, which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“in response to the accuracy monotonicity index being less than a first preset threshold, determining that the model chain to be verified is incoherent”
“in response to the parameter distance monotonicity index being less than a second preset threshold, determining that the model chain to be verified is incoherent”
“in response to the parameter distribution continuity index being greater than a third preset threshold, determining that the model chain to be verified is incoherent”
“in response to the initial parameter distribution index being greater than a fourth preset threshold, determining that the model chain to be verified is incoherent”
“calculating a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determining that the model chain to be verified is incoherent”
“calculating a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determining that the model chain to be verified is incoherent”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass determining that the model chain to be verified is incoherent in response to the accuracy monotonicity index being less than a first preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the accuracy monotonicity index being less than a first preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the parameter distance monotonicity index being less than a second preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the parameter distance monotonicity index being less than a second preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the parameter distribution continuity index being greater than a third preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the parameter distribution continuity index being greater than a third preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the initial parameter distribution index being greater than a fourth preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the initial parameter distribution index being greater than a fourth preset threshold, determine that the model chain to be verified is incoherent); calculating a fifth threshold and determining that the model chain to be verified is incoherent in response to the initial parameter randomness index being greater than the fifth threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determine that the model chain to be verified is incoherent); and calculating a sixth threshold and determine that the model chain to be verified is incoherent in response to the model chain distance index being greater than the sixth threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determine that the model chain to be verified is incoherent).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 4 of a generic computer and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 4 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computer and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 6,
Claim 6 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 6 is directed to a method, which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization”
“calculating parameter randomness indexes of the plurality of initial models”
“calculating an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models”
“calculating the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the Gaussian mixture distribution for random initialization to randomly sample initial models); calculating parameter randomness indexes of the plurality of initial models (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate parameter randomness indexes of the initial models); calculating an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models (corresponds to mathematical calculations); and calculating the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the average value and the standard deviation of the parameter randomness indexes to calculate the fifth threshold).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 5 of a generic computer and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 5 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computer and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 7,
Claim 7 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 7 is directed to a method, which is directed to a process, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization”
“calculating an average and a standard deviation of parameter distances between the plurality of initial models and a converged model in the model chain to be verified”
“obtaining the sixth threshold by calculation based on an average value and the standard deviation of the parameter distances between the plurality of initial models and the converged model in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the Gaussian mixture distribution for random initialization to randomly sample initial models); calculating an average and a standard deviation of parameter distances between the initial models and a converged model in the model chain to be verified (corresponds to mathematical calculations); and determining the sixth threshold by calculation based on an average value and the standard deviation of the parameter distances between the plurality of initial models and the converged model in the model chain to be verified (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can perform a calculation based on an average value and the standard deviation of the parameter distances between the plurality of initial models and the converged model in the model chain to be verified to obtain the sixth threshold).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 5 of a generic computer and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 5 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computer and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 8,
Claim 8 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 8 is directed to a computer device, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“calculate, based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset, an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified”
“obtain an ownership verification result of the DL model to be verified by determining an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass can calculate an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the Gaussian mixture distribution, the model chain to be verified and the verification dataset to calculate an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified); and determine an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified to obtain an ownership verification result of the deep learning model to be verified (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the index values of the model chain to be verified to determine an authenticity of the model chain to obtain an ownership verification result of the deep learning model to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“a processor”
“a memory stored with instructions executable by the processor”
“the processor”
“a DL model”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). The limitations:
“obtain a Gaussian mixture distribution for initialization of a DL model to be verified, a model chain to be verified of the DL to be verified, and a corresponding verification dataset, wherein the model chain to be verified is composed of model parameters of the DL model to be verified in each training epoch”
As drafted, are additional elements that correspond to insignificant extra-solution activity. In particular, the additional elements are merely directed towards mere data gathering. See MPEP 2106.05(g). Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic processor, memory, and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtain …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 9,
Claim 9 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 9 is directed to a computer device, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“calculate, based on the model chain to be verified and the verification dataset, an accuracy of each model in the model chain to be verified on the verification dataset in sequence”
“calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index”
“calculate a parameter distance between a model in the model chain to be verified and a converged model”
“calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index, wherein the converged model is a final model in the model chain to be verified”
“obtain the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence”
“obtain the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution”
“obtain the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified”
“obtain the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass calculating an accuracy of each model in the model chain to be verified on the verification dataset in sequence based on the model chain to be verified and the verification dataset (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the model chain to be verified and the verification dataset to calculate an accuracy of each model in the model chain to be verified on the verification dataset in sequence); calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index (corresponds to mathematical calculations); calculating a parameter distance between a model in the model chain to be verified and a converged model (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a parameter distance between a model in the model chain to be verified and a converged model); calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index (corresponds to mathematical calculations); calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence to obtain the parameter distribution continuity index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence); calculate a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution to obtain the initial parameter distribution index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution); calculating a randomness of parameters of the initial model in the model chain to be verified to obtain the initial parameter randomness index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified); and calculating a parameter distance between the initial model and the converged model in the model chain to be verified to obtain the model chain distance index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“the processor”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). In addition, the recitation of additional elements in claim 8 of a generic processor, memory, and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 8 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic processor, memory, and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtain …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 10,
Claim 10 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 10 is directed to a computer device, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“wherein the accuracy monotonicity index is calculated as:
PNG
media_image5.png
54
330
media_image5.png
Greyscale
where ρacc represents the accuracy monotonicity index, N represents a total number of training epochs, rank(∙) represents a ranking of an accuracy of an intermediate model in the model chain to be verified, acc(Ci, Dval) represents an accuracy of an i-th intermediate model Ci in the model chain to be verified on the verification dataset, and Dval represents the verification dataset”
“the parameter distance monotonicity index is calculated as:
PNG
media_image6.png
54
308
media_image6.png
Greyscale
where ρdis represents the parameter distance monotonicity index, N represents the total number of training epochs, rank(∙) represents a ranking of an Euclidean distance of parameters between the intermediate model and the converged model in the model chain to be verified, and d(Ci, CN) represents an Euclidean distance of parameters between the i-th intermediate model Ci and the converged model CN in the model chain to be verified”
“the parameter distribution continuity index is calculated as:
PNG
media_image7.png
38
354
media_image7.png
Greyscale
where cweight represents the parameter distribution continuity index, N represents a total number of training epochs, L represents a number of layers of the model,
w
l
i
represents a parameter matrix of an l-th layer of the i-th intermediate model in the model chain to be verified, P(⋅) represents a distribution of parameters, and EMD(⋅,⋅) represents an Earth Mover’s Distance between two distributions”
“the initial parameter distribution index is calculated as follows:
PNG
media_image8.png
44
294
media_image8.png
Greyscale
where dinit represents the initial parameter distribution index, L represents a number of layers of the model, EMD(⋅,⋅) represents an Earth Mover’s Distance between the two distributions, P(⋅) represents a distribution of parameters,
w
l
0
represents a parameter matrix of the l-th layer of the initial model, and PGMM(⋅) represents the Gaussian mixture distribution”
“the initial parameter randomness index is calculated by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified”
“the model chain distance index is calculated as:
dchain=d(C0, CN)
where dchain represents the model chain distance index, and d(C0,CN) represents an Euclidean distance of parameters between the initial model C0 and the converged model CN in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass using the given equation to calculate the accuracy monotonicity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the parameter distance monotonicity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the parameter distribution continuity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the initial parameter distribution index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the initial parameter randomness index by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified to calculate the initial parameter randomness index); and using the given equation to calculate the model chain distance index (corresponds to mathematical formulas or equations and mathematical calculations).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 9 of a generic processor, memory, and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 9 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic processor, memory, and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtain …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 11,
Claim 11 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 11 is directed to a computer device, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“determine the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold”
“in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent, determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified”
“in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent, determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can judge whether the accuracy of each of the index values of the model chain to be verified meets a corresponding threshold to determine the authenticity of the model chain); determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to determining that any of the index values of the model chain to be verified is incoherent, determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified); and determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to determining any of the index values of the model chain to be verified is coherent, determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“the processor”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). In addition, the recitation of additional elements in claim 8 of a generic processor, memory, and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 8 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic processor, memory, and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtain …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 12,
Claim 12 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 12 is directed to a computer device, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“in response to the accuracy monotonicity index being less than a first preset threshold, determine that the model chain to be verified is incoherent”
“in response to the parameter distance monotonicity index being less than a second preset threshold, determine that the model chain to be verified is incoherent”
“in response to the parameter distribution continuity index being greater than a third preset threshold, determine that the model chain to be verified is incoherent”
“in response to the initial parameter distribution index being greater than a fourth preset threshold, determine that the model chain to be verified is incoherent”
“calculate a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determine that the model chain to be verified is incoherent”
“calculate a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determine that the model chain to be verified is incoherent”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass determining that the model chain to be verified is incoherent in response to the accuracy monotonicity index being less than a first preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the accuracy monotonicity index being less than a first preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the parameter distance monotonicity index being less than a second preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the parameter distance monotonicity index being less than a second preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the parameter distribution continuity index being greater than a third preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the parameter distribution continuity index being greater than a third preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the initial parameter distribution index being greater than a fourth preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the initial parameter distribution index being greater than a fourth preset threshold, determine that the model chain to be verified is incoherent); calculating a fifth threshold and determining that the model chain to be verified is incoherent in response to the initial parameter randomness index being greater than the fifth threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determine that the model chain to be verified is incoherent); and calculating a sixth threshold and determine that the model chain to be verified is incoherent in response to the model chain distance index being greater than the sixth threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determine that the model chain to be verified is incoherent).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“the processor”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). In addition, the recitation of additional elements in claim 11 of a generic processor, memory, and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 11 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic processor, memory, and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtain …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 13,
Claim 13 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 13 is directed to a computer device, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“randomly sample a plurality of initial models by using the Gaussian mixture distribution for random initialization”
“calculate parameter randomness indexes of the plurality of initial models”
“calculate an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models”
“calculate the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the Gaussian mixture distribution for random initialization to randomly sample initial models); calculating parameter randomness indexes of the plurality of initial models (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate parameter randomness indexes of the initial models); calculating an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models (corresponds to mathematical calculations); and calculating the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the average value and the standard deviation of the parameter randomness indexes to calculate the fifth threshold).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“the processor”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). In addition, the recitation of additional elements in claim 12 of a generic processor, memory, and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 12 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic processor, memory, and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtain …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 14,
Claim 14 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 14 is directed to a computer device, which is directed to a machine, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“randomly sample a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculate an average and a standard deviation of parameter distances between the plurality of initial models and a converged model in the model chain to be verified”
“obtain the sixth threshold by calculation based on an average value and the standard deviation of the parameter distances between the plurality of initial models and the converged model in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“the processor”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). In addition, the recitation of additional elements in claim 12 of a generic processor, memory, and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 12 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic processor, memory, and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtain …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 15,
Claim 15 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 15 is directed to a non-transitory computer readable storage medium, which is directed to an article of manufacture, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“calculating, based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset, an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified”
“obtaining an ownership verification result of the DL model to be verified by determining an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass can calculate an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the Gaussian mixture distribution, the model chain to be verified and the verification dataset to calculate an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified); and determine an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified to obtain an ownership verification result of the deep learning model to be verified (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the index values of the model chain to be verified to determine an authenticity of the model chain to obtain an ownership verification result of the deep learning model to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The limitations:
“a computing device”
“a deep learning (DL) model”
As drafted, are additional elements that amount to no more than mere instructions to apply the exception for the abstract ideas. See MPEP 2106.05(f). The limitations:
“obtaining a Gaussian mixture distribution for initialization of a DL model to be verified, a model chain to be verified of the DL to be verified, and a corresponding verification dataset, wherein the model chain to be verified is composed of model parameters of the DL model to be verified in each training epoch”
As drafted, are additional elements that correspond to insignificant extra-solution activity. In particular, the additional elements are merely directed towards mere data gathering. See MPEP 2106.05(g). Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computing device and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 16,
Claim 16 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 16 is directed to a non-transitory computer readable storage medium, which is directed to an article of manufacture, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“calculating, based on the model chain to be verified and the verification dataset, an accuracy of each model in the model chain to be verified on the verification dataset in sequence”
“calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index”
“calculating a parameter distance between a model in the model chain to be verified and a converged model”
“calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index, wherein the converged model is a final model in the model chain to be verified”
“obtaining the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence”
“obtaining the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution”
“obtaining the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified”
“obtaining the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass calculating an accuracy of each model in the model chain to be verified on the verification dataset in sequence based on the model chain to be verified and the verification dataset (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the model chain to be verified and the verification dataset to calculate an accuracy of each model in the model chain to be verified on the verification dataset in sequence); calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index (corresponds to mathematical calculations); calculating a parameter distance between a model in the model chain to be verified and a converged model (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a parameter distance between a model in the model chain to be verified and a converged model); calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index (corresponds to mathematical calculations); calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence to obtain the parameter distribution continuity index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence); calculate a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution to obtain the initial parameter distribution index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution); calculating a randomness of parameters of the initial model in the model chain to be verified to obtain the initial parameter randomness index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified); and calculating a parameter distance between the initial model and the converged model in the model chain to be verified to obtain the model chain distance index (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can obtain the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 15 of a generic computing device and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 15 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computing device and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 17,
Claim 17 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 17 is directed to a non-transitory computer readable storage medium, which is directed to an article of manufacture, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“wherein the accuracy monotonicity index is calculated as:
PNG
media_image9.png
50
322
media_image9.png
Greyscale
where ρacc represents the accuracy monotonicity index, N represents a total number of training epochs, rank(∙) represents a ranking of an accuracy of an intermediate model in the model chain to be verified, acc(Ci, Dval) represents an accuracy of an i-th intermediate model Ci in the model chain to be verified on the verification dataset, and Dval represents the verification dataset”
“the parameter distance monotonicity index is calculated as:
PNG
media_image10.png
56
308
media_image10.png
Greyscale
where ρdis represents the parameter distance monotonicity index, N represents the total number of training epochs, rank(∙) represents a ranking of an Euclidean distance of parameters between the intermediate model and the converged model in the model chain to be verified, and d(Ci, CN) represents an Euclidean distance of parameters between the i-th intermediate model Ci and the converged model CN in the model chain to be verified”
“the parameter distribution continuity index is calculated as:
PNG
media_image11.png
36
356
media_image11.png
Greyscale
where cweight represents the parameter distribution continuity index, N represents a total number of training epochs, L represents a number of layers of the model,
w
l
i
represents a parameter matrix of an l-th layer of the i-th intermediate model in the model chain to be verified, P(⋅) represents a distribution of parameters, and EMD(⋅,⋅) represents an Earth Mover’s Distance between two distributions”
“the initial parameter distribution index is calculated as follows:
PNG
media_image12.png
42
296
media_image12.png
Greyscale
where dinit represents the initial parameter distribution index, L represents a number of layers of the model, EMD(⋅,⋅) represents an Earth Mover’s Distance between the two distributions, P(⋅) represents a distribution of parameters,
w
l
0
represents a parameter matrix of the l-th layer of the initial model, and PGMM(⋅) represents the Gaussian mixture distribution”
“the initial parameter randomness index is calculated by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified”
“the model chain distance index is calculated as:
dchain=d(C0, CN)
where dchain represents the model chain distance index, and d(C0, CN) represents an Euclidean distance of parameters between the initial model C0 and the converged model CN in the model chain to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass using the given equation to calculate the accuracy monotonicity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the parameter distance monotonicity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the parameter distribution continuity index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the initial parameter distribution index (corresponds to mathematical formulas or equations and mathematical calculations); using the given equation to calculate the initial parameter randomness index by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified to calculate the initial parameter randomness index); and using the given equation to calculate the model chain distance index (corresponds to mathematical formulas or equations and mathematical calculations).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 16 of a generic computing device and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 16 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computing device and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 18,
Claim 18 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 18 is directed to a non-transitory computer readable storage medium, which is directed to an article of manufacture, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold”
“in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent, determining the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified”
“in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent, determining the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can judge whether the accuracy of each of the index values of the model chain to be verified meets a corresponding threshold to determine the authenticity of the model chain); determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to determining that any of the index values of the model chain to be verified is incoherent, determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified); and determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to determining any of the index values of the model chain to be verified is coherent, determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 15 of a generic computing device and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 15 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computing device and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 19,
Claim 19 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 19 is directed to a non-transitory computer readable storage medium, which is directed to an article of manufacture, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“in response to the accuracy monotonicity index being less than a first preset threshold, determining that the model chain to be verified is incoherent”
“in response to the parameter distance monotonicity index being less than a second preset threshold, determining that the model chain to be verified is incoherent”
“in response to the parameter distribution continuity index being greater than a third preset threshold, determining that the model chain to be verified is incoherent”
“in response to the initial parameter distribution index being greater than a fourth preset threshold, determining that the model chain to be verified is incoherent”
“calculating a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determining that the model chain to be verified is incoherent”
“calculating a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determining that the model chain to be verified is incoherent”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass determining that the model chain to be verified is incoherent in response to the accuracy monotonicity index being less than a first preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the accuracy monotonicity index being less than a first preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the parameter distance monotonicity index being less than a second preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the parameter distance monotonicity index being less than a second preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the parameter distribution continuity index being greater than a third preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the parameter distribution continuity index being greater than a third preset threshold, determine that the model chain to be verified is incoherent); determining that the model chain to be verified is incoherent in response to the initial parameter distribution index being greater than a fourth preset threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can, in response to the initial parameter distribution index being greater than a fourth preset threshold, determine that the model chain to be verified is incoherent); calculating a fifth threshold and determining that the model chain to be verified is incoherent in response to the initial parameter randomness index being greater than the fifth threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determine that the model chain to be verified is incoherent); and calculating a sixth threshold and determine that the model chain to be verified is incoherent in response to the model chain distance index being greater than the sixth threshold (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determine that the model chain to be verified is incoherent).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 18 of a generic computing device and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 18 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computing device and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Regarding Claim 20,
Claim 20 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1 Analysis: Claim 20 is directed to a non-transitory computer readable storage medium, which is directed to an article of manufacture, one of the statutory categories.
Step 2A Prong One Analysis: The limitations:
“randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization”
“calculating parameter randomness indexes of the plurality of initial models”
“calculating an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models”
“calculating the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes”
As drafted, under their broadest reasonable interpretations, cover mental processes (concepts performed in the human mind (including an observation, evaluation, judgement, opinion)) and mathematical concepts (mathematical relationships, mathematical formulas or equations, mathematical calculations) but for the recitation of mere instructions to apply language (See MPEP 2106.05(f)) and insignificant extra-solution activity (See MPEP 2106.05(g)). The above limitations in the context of this claim encompass randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the Gaussian mixture distribution for random initialization to randomly sample initial models); calculating parameter randomness indexes of the plurality of initial models (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can calculate parameter randomness indexes of the initial models); calculating an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models (corresponds to mathematical calculations); and calculating the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes (corresponds to evaluation and judgement; in particular, a human, with the assistance of pen and paper, can use the average value and the standard deviation of the parameter randomness indexes to calculate the fifth threshold).
Step 2A Prong Two Analysis: The judicial exceptions are not integrated into a practical application. In particular, the claim recites additional elements that are mere instructions to apply (See MPEP 2106.05(f)) or insignificant extra-solution activity (See MPEP 2106.05(g)). The recitation of additional elements in claim 19 of a generic computing device and deep learning model, as drafted, are reciting mere instructions to apply language such that it amounts to no more than mere instructions to apply the exceptions. Furthermore, the “obtaining …” limitations of claim 19 are additional elements that correspond to insignificant extra-solution activity as mere data gathering. Therefore, the additional elements do not integrate the abstract ideas into a practical application.
Step 2B Analysis: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, all of the additional elements are “mere instructions to apply an exception” (I.e. the additional elements describe a generic computing device and deep learning model for applying the abstract ideas) or insignificant extra-solution activity (i.e. obtaining/receiving data). Furthermore, the “obtaining …” limitations are insignificant extra-solution activity that is well-understood, routine, and conventional according to MPEP 2106.05(d) (“The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity… i. Receiving or transmitting data over a network). Mere instructions to apply an exception cannot provide an inventive concept. The claim is not patent eligible.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Liu et al. ("Provenance of Training without Training Data: Towards Privacy-Preserving DNN Model Ownership Verification").
Regarding Claim 1,
Liu et al. teaches a computer-implemented method for verifying an ownership of a deep learning (DL) model based on a training process proof (Section 1, third paragraph: "we propose PoT (Provenance of Training), a model ownership verification mechanism that simultaneously achieves robustness, exclusiveness, and training data privacy protection ... PoT leverages entire provenance of the model training process, which is naturally bound to the specific model. The core is building a coherent model chain from the intermediate model checkpoints saved during model training from scratch, such that the model owner can easily verify the model chain coherence without exposing any training data" teaches a method for verifying ownership of a model based on a training process proof), comprising:
obtaining a Gaussian mixture distribution for initialization of a DL model to be verified, a model chain to be verified of the DL to be verified, and a verification dataset, wherein the model chain to be verified is composed of model parameters of the DL model to be verified in each training epoch (Section 3.2, second paragraph: "We initialize the model parameters with a special Gaussian Mixture Model (GMM) distribution to make the distribution change obviously" teaches obtaining a Gaussian mixture distribution for initialization of the model to be verified. Section 4, second-third paragraphs: "We call the checkpoint sequence generated during model training a model chain. In the following sections, we use M to denote the model protected by PoT, Ci to denote the checkpoint, and C = {C0, C1, ..., CN−1, CN} to denote the model chain. Note that the last checkpoint CN is exactly the protected model M ... The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously" teaches obtaining Gaussian Mixture Model (GMM) distribution and a model chain to be verified of the model to be verified. Section 2.2, first paragraph: "we assume that the verifier possesses a validation dataset Dval with similar distribution to that of the original owner" teaches obtaining a validation dataset (verification dataset));
calculating, based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset, an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified); and
obtaining an ownership verification result of the DL model to be verified by determining an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Section 4.3, first paragraph: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully" teaches obtaining an ownership verification result by determining an authenticity of the model chain based on the aforementioned properties (the indexes) of the model chain to be verified being satisfied).
Regarding Claim 2,
Liu et al. teaches the method of claim 1.
Liu et al. further teaches wherein calculating the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified, comprises: calculating, based on the model chain to be verified and the verification dataset, an accuracy of each model in the model chain to be verified on the verification dataset in sequence, and calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index (Section 4.1, paragraphs relating to property 1: "(1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy). Given a validation dataset Dval with a data distribution similar to Dtrain, the validation accuracies of the checkpoints {C0,C1, · · · ,CN} over Dval are likely to be monotonically nondecreasing. Formally, for most of the timestamp i, acc(Ci, Dval) ≥ acc(Cj, Dval) ∀j ≤ i. We define a metric to quantitatively measure this property by calculating the Spearman’s rank correlation coefficient [10] between the accuracy and the number of training epochs:
PNG
media_image13.png
50
286
media_image13.png
Greyscale
where rank acc(Ci, Dval) denotes the ranking index of the accuracy of Ci in the model chain. A model chain with higher ρacc indicates a higher confidence in its authenticity. Note that there are corner cases where the validation accuracy is not sufficiently monotonic, e.g., the model overfits to the dataset or the task is overly hard. We use early stop during verification to alleviate the overfitting issue and constrain the metric to deal with the non-monotonicity" teaches calculating, based on the model chain and validation dataset Dval (verification dataset), an accuracy (acc(Ci, Dval)) of each model in the model chain based on the verification dataset in sequence and calculating ρacc (Pearson correlation coefficient) between the accuracy (acc(Ci, Dval)) and the training epoch as the monotonicity of validation accuracy property (accuracy monotonicity index));
calculating a parameter distance between a model in the model chain to be verified and a converged model, and calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index, wherein the converged model is a final model in the model chain to be verified (Section 3.4, second paragraph: "In model training, the model parameters will eventually converge to a local optimum from the initial position, and the distance between the intermediate model and converged model will gradually change. Given the gradient descent algorithm’s nature of convergence, the parameters of the model under training shall gradually approach to an optimum that is close to the initial model. Thus the weight distance between the intermediate model and converged model is monotonically non-increasing. We illustrate this observation in Figure 3 where we plot, for multiple model training processes, the parameter distances between the intermediate checkpoints and the final converged models over the epochs" teaches calculating a weight distance (parameter distance) between an intermediate model (model in the model chain to be verified) and a converged model. Section 4.1, paragraphs relating to property 5: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance). Given that the training of the model converges normally, the distance between the intermediate checkpoint and the converged model decreases monotonically to zero, i.e., the following in equality on the model distance is expected to hold: d(C1, CN) ≥ d(C2, CN) ≥ … ≥ d(CN-1, CN) ≳ 0. Property 5 can also be measured using the Spearman’s rank correlation coefficient of the distance sequence:
PNG
media_image14.png
56
316
media_image14.png
Greyscale
" teaches calculating ρdis (Pearson correlation coefficient) between the weight distance (parameter distance) and the training epoch as the monotonicity of weight distance property (parameter distance monotonicity index));
obtaining the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence (Section 4.1, paragraphs relating to property 2: "(2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·,·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity). Given that the model is trained with a sufficiently small learning rate, for any two consecutive checkpoints Ci and Ci+1 and a small threshold δ, the weights in all the L layers should satisfy: ∀l ∈ [1, L], EMD(P(
w
l
i
), P(
w
l
i
+
1
)) < δ. We quantify the property as follows:
PNG
media_image15.png
40
344
media_image15.png
Greyscale
cweight calculates the maximum of layer-wise parameter distribution distances between consecutive checkpoints. This property also prevents the adversary from directly concatenating model chains" teaches calculating a parameter distribution distance between consecutive models in the model chain to be verified in sequence in order to obtain the parameter distribution continuity property (parameter distribution continuity index));
obtaining the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution (Section 4.1, paragraphs relating to property 3: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters). The parameters of the initial model should conform to the required GMM distribution. Given an initial model C0, its weights in all layers should satisfy: ∀l ∈[1, L], EMD (P(
w
l
0
), PGMM(
w
l
0
)) ≈ 0. Property 3 can be quantified by calculating the distance between the distribution of initial parameters and the required GMM distribution. The property is quantified as:
PNG
media_image16.png
36
320
media_image16.png
Greyscale
In a nutshell, Eq. (4) calculates the maximum distance between the required distribution and the actual distribution across all layers" teaches calculating a parameter distribution distance between an initial model of the model chain to be verified and the GMM distribution (Gaussian mixture distribution) to obtain the distribution of the initial parameters property (initial parameter distribution index));
obtaining the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified (Section 4.1, paragraphs relating to property 4: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. … Property 4 (Independence among Initialized Parameters). The parameters of the initial model should be independent. Given the weight w in an initialized layer, any two different parameters w[i] and w[j] in w should satisfy the following equation if we view them as random variables: cov(w[i],w[j]) = 0, where cov(·,·) is the covariance of two random variables. To verify Property 4,we need to evaluate whether the parameters of the initial model are independently and randomly initialized. In §3.3, we show that the verification of parameter independence can be achieved with the PCA algorithm. Here we further elaborate the detailed procedures. First, group the parameters in the same layer according to their relationship (e.g., the parameters belonging to the same neuron in a linear layer or belonging to the same channel in a kernel filter of a convolutional layer are viewed as a group). Second, run the PCA algorithm on the grouped parameters, and get the explained variance ratio of the first principle components:
PNG
media_image17.png
40
338
media_image17.png
Greyscale
where MaxExplainedRatio(·) returns the largest explained variance ratio in the PCA result, and Group(·) is the parameter grouping function. In verification, a large ppca suggests that the initial model of the model chain is not likely to be randomly initialized" teaches calculating a randomness of parameters of the initial model in the model chain to be verified to obtain the independence among initialized parameters property (initial parameter randomness index)); and
obtaining the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified (Section 4.1, paragraphs relating to property 6: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. … Property 6 (Small Distance between the Initial Model and Converged Model). Given that the DNN model is sufficiently complex, it is highly possible that the distance of the converged model to the initial model in the same model chain is much smaller than that to other randomly initialized models. Formally, given the initial model C0 and converged model CN in a model chain C and any other random model Mrand initialized with the same method as C0, the following inequality holds with a high probability: d(C0, CN)≪ d(Mrand, CN). Property 6 can be quantified as follows:
PNG
media_image18.png
28
246
media_image18.png
Greyscale
This property prevents the adversary from constructing a fake model chain by concatenating several short model chains, because the distance pattern is discontinuous and non-monotonic" teaches calculating a parameter distance between the initial model and the converged model in the model chain to be verified to obtain the small distance between the initial model and converged model property (model chain distance index)).
Regarding Claim 3,
Liu et al. teaches the method of claim 2.
Liu et al. further teaches wherein the accuracy monotonicity index is calculated as:
PNG
media_image19.png
58
322
media_image19.png
Greyscale
where ρacc represents the accuracy monotonicity index, N represents a total number of training epochs, rank(∙) represents a ranking of an accuracy of an intermediate model in the model chain to be verified, acc(Ci, Dval) represents an accuracy of an i-th intermediate model Ci in the model chain to be verified on the verification dataset, and Dval represents the verification dataset (Equation (2); Section 4.1, paragraphs relating to property 1: "(1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy). Given a validation dataset Dval with a data distribution similar to Dtrain, the validation accuracies of the checkpoints {C0,C1, · · · ,CN} over Dval are likely to be monotonically nondecreasing. Formally, for most of the timestamp i, acc(Ci, Dval) ≥ acc(Cj, Dval) ∀j ≤ i. We define a metric to quantitatively measure this property by calculating the Spearman’s rank correlation coefficient [10] between the accuracy and the number of training epochs:
PNG
media_image13.png
50
286
media_image13.png
Greyscale
where rank acc(Ci, Dval) denotes the ranking index of the accuracy of Ci in the model chain. A model chain with higher ρacc indicates a higher confidence in its authenticity. Note that there are corner cases where the validation accuracy is not sufficiently monotonic, e.g., the model overfits to the dataset or the task is overly hard. We use early stop during verification to alleviate the overfitting issue and constrain the metric to deal with the non-monotonicity" teaches calculating the monotonicity of validation accuracy property (accuracy monotonicity index) using equation (2) (the given equation));
the parameter distance monotonicity index is calculated as:
PNG
media_image20.png
62
304
media_image20.png
Greyscale
where ρdis represents the parameter distance monotonicity index, N represents the total number of training epochs, rank(∙) represents a ranking of an Euclidean distance of parameters between the intermediate model and the converged model in the model chain to be verified, and d(Ci, CN) represents an Euclidean distance of parameters between the i-th intermediate model Ci and the converged model CN in the model chain to be verified (Equation (6); Section 4.1, paragraphs relating to property 5: "Section 3.4, second paragraph: "In model training, the model parameters will eventually converge to a local optimum from the initial position, and the distance between the intermediate model and converged model will gradually change. Given the gradient descent algorithm’s nature of convergence, the parameters of the model under training shall gradually approach to an optimum that is close to the initial model. Thus the weight distance between the intermediate model and converged model is monotonically non-increasing. We illustrate this observation in Figure 3 where we plot, for multiple model training processes, the parameter distances between the intermediate checkpoints and the final converged models over the epochs" teaches calculating a weight distance (parameter distance) between an intermediate model (model in the model chain to be verified) and a converged model. Section 4.1, paragraphs relating to property 5: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance). Given that the training of the model converges normally, the distance between the intermediate checkpoint and the converged model decreases monotonically to zero, i.e., the following in equality on the model distance is expected to hold: d(C1, CN) ≥ d(C2, CN) ≥ … ≥ d(CN-1, CN) ≳ 0. Property 5 can also be measured using the Spearman’s rank correlation coefficient of the distance sequence:
PNG
media_image14.png
56
316
media_image14.png
Greyscale
" teaches calculating ρdis (Pearson correlation coefficient) between the weight distance (parameter distance) and the training epoch as the monotonicity of weight distance property (parameter distance monotonicity index)" teaches calculating the monotonicity of weight distance property (parameter distance monotonicity index) using equation (6) (the given equation));
the parameter distribution continuity index is calculated as:
PNG
media_image21.png
38
358
media_image21.png
Greyscale
where cweight represents the parameter distribution continuity index, N represents a total number of training epochs, L represents a number of layers of the model,
w
l
i
represents a parameter matrix of an l-th layer of the i-th intermediate model in the model chain to be verified, P(⋅) represents a distribution of parameters, and EMD(⋅,⋅) represents an Earth Mover’s Distance between two distributions (Equation (3); Section 4.1, paragraphs relating to property 2: "(2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·,·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity). Given that the model is trained with a sufficiently small learning rate, for any two consecutive checkpoints Ci and Ci+1 and a small threshold δ, the weights in all the L layers should satisfy: ∀l ∈ [1, L], EMD(P(
w
l
i
), P(
w
l
i
+
1
)) < δ. We quantify the property as follows:
PNG
media_image15.png
40
344
media_image15.png
Greyscale
cweight calculates the maximum of layer-wise parameter distribution distances between consecutive checkpoints. This property also prevents the adversary from directly concatenating model chains" teaches calculating the parameter distribution continuity property (parameter distribution continuity index) using equation (3) (the given equation));
the initial parameter distribution index is calculated as follows:
PNG
media_image22.png
42
294
media_image22.png
Greyscale
where dinit represents the initial parameter distribution index, L represents a number of layers of the model, EMD(⋅,⋅) represents an Earth Mover’s Distance between the two distributions, P(⋅) represents a distribution of parameters,
w
l
0
represents a parameter matrix of the l-th layer of the initial model, and PGMM(⋅) represents the Gaussian mixture distribution (Equation (4); Section 4.1, paragraphs relating to property 3: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters). The parameters of the initial model should conform to the required GMM distribution. Given an initial model C0, its weights in all layers should satisfy: ∀l ∈[1, L], EMD (P(
w
l
0
), PGMM(
w
l
0
)) ≈ 0. Property 3 can be quantified by calculating the distance between the distribution of initial parameters and the required GMM distribution. The property is quantified as:
PNG
media_image16.png
36
320
media_image16.png
Greyscale
In a nutshell, Eq. (4) calculates the maximum distance between the required distribution and the actual distribution across all layers" teaches calculating the distribution of the initial parameters property (initial parameter distribution index) using equation (4) (the given equation));
the initial parameter randomness index is calculated by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified (Equation (5); Section 4.1, paragraphs relating to property 4: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. … Property 4 (Independence among Initialized Parameters). The parameters of the initial model should be independent. Given the weight w in an initialized layer, any two different parameters w[i] and w[j] in w should satisfy the following equation if we view them as random variables: cov(w[i],w[j]) = 0, where cov(·,·) is the covariance of two random variables. To verify Property 4,we need to evaluate whether the parameters of the initial model are independently and randomly initialized. In §3.3, we show that the verification of parameter independence can be achieved with the PCA algorithm. Here we further elaborate the detailed procedures. First, group the parameters in the same layer according to their relationship (e.g., the parameters belonging to the same neuron in a linear layer or belonging to the same channel in a kernel filter of a convolutional layer are viewed as a group). Second, run the PCA algorithm on the grouped parameters, and get the explained variance ratio of the first principle components:
PNG
media_image17.png
40
338
media_image17.png
Greyscale
where MaxExplainedRatio(·) returns the largest explained variance ratio in the PCA result, and Group(·) is the parameter grouping function. In verification, a large ppca suggests that the initial model of the model chain is not likely to be randomly initialized" teaches calculating the independence among initialized parameters property (initial parameter randomness index) by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified using equation (5)); and
the model chain distance index is calculated as:
PNG
media_image23.png
24
138
media_image23.png
Greyscale
where dchain represents the model chain distance index, and d(C0, CN) represents an Euclidean distance of parameters between the initial model C0 and the converged model CN in the model chain to be verified (Equation (7); Section 4.1, paragraphs relating to property 6: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. … Property 6 (Small Distance between the Initial Model and Converged Model). Given that the DNN model is sufficiently complex, it is highly possible that the distance of the converged model to the initial model in the same model chain is much smaller than that to other randomly initialized models. Formally, given the initial model C0 and converged model CN in a model chain C and any other random model Mrand initialized with the same method as C0, the following inequality holds with a high probability: d(C0, CN)≪ d(Mrand, CN). Property 6 can be quantified as follows:
PNG
media_image18.png
28
246
media_image18.png
Greyscale
This property prevents the adversary from constructing a fake model chain by concatenating several short model chains, because the distance pattern is discontinuous and non-monotonic" teaches calculating the small distance between the initial model and converged model property (model chain distance index) using equation (7) (the given equation)).
Regarding Claim 4,
Liu et al. teaches the method of claim 1.
Liu et al. further teaches wherein obtaining the ownership verification result of the DL model to be verified by determining the authenticity of the model chain to be verified comprises: determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold to determine the authenticity of the model chain to obtain the ownership verification result of the DL model);
in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent, determining the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified (Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold and that when an index does not meet a threshold, then the model chain to be verified is incoherent and ownership of the model to be verified is not verified (i.e. the trainer does not have ownership of the model)); and
in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent, determining the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified (Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold and that when all indexes meet a threshold, then the model chain to be verified is coherent and ownership of the model to be verified is verified (i.e. the trainer does have ownership of the model)).
Regarding Claim 5,
Liu et al. teaches the method of claim 4.
Liu et al. further teaches wherein determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets the corresponding threshold, comprises: in response to the accuracy monotonicity index being less than a first preset threshold, determining that the model chain to be verified is incoherent (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Algorithm 1; lines 2-3: "2 if C→ ρacc < δ1 then 3 return False; // Report C to be incoherent" teaches that when the monotonicity of validation accuracy property ρacc (accuracy monotonicity index) is less than a first preset threshold δ1, the model chain to be verified is determined to be incoherent);
in response to the parameter distance monotonicity index being less than a second preset threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 4-5: "4 else if C→ ρdis < δ2 then 5 return False" teaches that when the monotonicity of weight distance property ρdis (parameter distance monotonicity index) is less than a second preset threshold δ2, the model chain to be verified is determined to be incoherent);
in response to the parameter distribution continuity index being greater than a third preset threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 6-7: "6 else if C→ cweight > δ3 then 7 return False" teaches that when the parameter distribution continuity property cweight (parameter distribution continuity index) is greater than a third preset threshold δ3, the model chain to be verified is determined to be incoherent);
in response to the initial parameter distribution index being greater than a fourth preset threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 8-9: "8 else if C→ dinit > δ4 then 9 return False" teaches that when the distribution of the initial parameters property dinit (initial parameter distribution index) is greater than a fourth preset threshold δ4, the model chain to be verified is determined to be incoherent);
calculating a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd (fifth threshold), and that when the independence among initialized parameters property ppca (initial parameter randomness index) is greater than the fifth threshold, the model chain to be verified is determined to be incoherent); and
calculating a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 13-17: "13 estDisMean, estDisSTD = estimateChainDistance(C) ; // Estimate the range of dchain of forged model chains based on randomly re-initializing. 14 if dchain < estDisMean − 30 × estDisSTD then 15 return True; 16 else 17 return False" teaches calculating estDisMean − 30 × estDisSTD (sixth threshold), and that when the small distance between the initial model and converged model property dchain (model chain distance index) is greater than the sixth threshold, the model chain to be verified is determined to be incoherent).
Regarding Claim 6,
Liu et al. teaches the method of claim 5.
Liu et al. further teaches wherein calculating the fifth threshold comprises: randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating parameter randomness indexes of the plurality of initial models (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd as a fifth threshold, and that calculating the fifth threshold comprises randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating independence among initialized parameters properties ppca (initial parameter randomness indexes) of the plurality of initial models); and
calculating an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models, and calculating the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd as a fifth threshold, and that calculating the fifth threshold comprises calculating an estPCAmean (average value) and a estPCAstd (standard deviation) of the independence among initialized parameters properties ppca (initial parameter randomness indexes) of the plurality of initial models).
Regarding Claim 7,
Liu et al. teaches the method of claim 5.
Liu et al. further teaches wherein calculating the sixth threshold comprises: randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating an average and a standard deviation of parameter distances between the plurality of initial models and a converged model in the model chain to be verified (Algorithm 1; lines 13-17: "13 estDisMean, estDisSTD = estimateChainDistance(C) ; // Estimate the range of dchain of forged model chains based on randomly re-initializing. 14 if dchain < estDisMean − 30 × estDisSTD then 15 return True; 16 else 17 return False" teaches calculating estDisMean − 30 × estDisSTD (sixth threshold), and that calculating the sixth threshold comprises randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating an estDisMean (average) and a estDisSTD (standard deviation) of parameter distances between the plurality of initial models and a converged model in the model chain to be verified); and
obtaining the sixth threshold by calculation based on an average value and the standard deviation of the parameter distances between the plurality of initial models and the converged model in the model chain to be verified (Algorithm 1; lines 13-17: "13 estDisMean, estDisSTD = estimateChainDistance(C) ; // Estimate the range of dchain of forged model chains based on randomly re-initializing. 14 if dchain < estDisMean − 30 × estDisSTD then 15 return True; 16 else 17 return False" teaches calculating estDisMean − 30 × estDisSTD (sixth threshold), and that calculating the sixth threshold comprises calculating an estDisMean (average) and a estDisSTD (standard deviation) of parameter distances between the plurality of initial models and a converged model in the model chain to be verified).
Regarding Claim 8,
Liu et al. teaches a computer device, comprising: a processor, and a memory stored with instructions executable by the processor; wherein the processor is configured to: obtain a Gaussian mixture distribution for initialization of a DL model to be verified, a model chain to be verified of the DL to be verified, and a corresponding verification dataset, wherein the model chain to be verified is composed of model parameters of the DL model to be verified in each training epoch (Section 1, third paragraph: "we propose PoT (Provenance of Training), a model ownership verification mechanism that simultaneously achieves robustness, exclusiveness, and training data privacy protection ... PoT leverages entire provenance of the model training process, which is naturally bound to the specific model. The core is building a coherent model chain from the intermediate model checkpoints saved during model training from scratch, such that the model owner can easily verify the model chain coherence without exposing any training data" teaches a method (claim 8 is a computer device corresponding to method claim 1) for verifying ownership of a model based on a training process proof. Section 3.2, second paragraph: "We initialize the model parameters with a special Gaussian Mixture Model (GMM) distribution to make the distribution change obviously" teaches obtaining a Gaussian mixture distribution for initialization of the model to be verified. Section 4, second-third paragraphs: "We call the checkpoint sequence generated during model training a model chain. In the following sections, we use M to denote the model protected by PoT, Ci to denote the checkpoint, and C = {C0, C1, ..., CN−1, CN} to denote the model chain. Note that the last checkpoint CN is exactly the protected model M ... The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously" teaches obtaining Gaussian Mixture Model (GMM) distribution and a model chain to be verified of the model to be verified. Section 2.2, first paragraph: "we assume that the verifier possesses a validation dataset Dval with similar distribution to that of the original owner" teaches obtaining a validation dataset (verification dataset));
calculate, based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset, an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified); and
obtain an ownership verification result of the DL model to be verified by determining an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Section 4.3, first paragraph: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully" teaches obtaining an ownership verification result by determining an authenticity of the model chain based on the aforementioned properties (the indexes) of the model chain to be verified being satisfied).
Regarding Claim 9,
Liu et al. teaches the computer device of claim 8.
Liu et al. further teaches wherein the processor is further configured to: calculate, based on the model chain to be verified and the verification dataset, an accuracy of each model in the model chain to be verified on the verification dataset in sequence, and calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index (Section 4.1, paragraphs relating to property 1: "(1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy). Given a validation dataset Dval with a data distribution similar to Dtrain, the validation accuracies of the checkpoints
{C0,C1, · · · ,CN} over Dval are likely to be monotonically nondecreasing. Formally, for most of the timestamp i, acc(Ci, Dval) ≥ acc(Cj, Dval) ∀j ≤ i. We define a metric to quantitatively measure this property by calculating the Spearman’s rank correlation coefficient [10] between the accuracy and the number of training epochs:
PNG
media_image13.png
50
286
media_image13.png
Greyscale
where rank acc(Ci, Dval) denotes the ranking index of the accuracy of Ci in the model chain. A model chain with higher ρacc indicates a higher confidence in its authenticity. Note that there are corner cases where the validation accuracy is not sufficiently monotonic, e.g., the model overfits to the dataset or the task is overly hard. We use early stop during verification to alleviate the overfitting issue and constrain the metric to deal with the non-monotonicity" teaches calculating, based on the model chain and validation dataset Dval (verification dataset), an accuracy (acc(Ci, Dval)) of each model in the model chain based on the verification dataset in sequence and calculating ρacc (Pearson correlation coefficient) between the accuracy (acc(Ci, Dval)) and the training epoch as the monotonicity of validation accuracy property (accuracy monotonicity index));
calculate a parameter distance between a model in the model chain to be verified and a converged model, and calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index, wherein the converged model is a final model in the model chain to be verified (Section 3.4, second paragraph: "In model training, the model parameters will eventually converge to a local optimum from the initial position, and the distance between the intermediate model and converged model will gradually change. Given the gradient descent algorithm’s nature of convergence, the parameters of the model under training shall gradually approach to an optimum that is close to the initial model. Thus the weight distance between the intermediate model and converged model is monotonically non-increasing. We illustrate this observation in Figure 3 where we plot, for multiple model training processes, the parameter distances between the intermediate checkpoints and the final converged models over the epochs" teaches calculating a weight distance (parameter distance) between an intermediate model (model in the model chain to be verified) and a converged model. Section 4.1, paragraphs relating to property 5: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance). Given that the training of the model converges normally, the distance between the intermediate checkpoint and the converged model decreases monotonically to zero, i.e., the following in equality on the model distance is expected to hold: d(C1, CN) ≥ d(C2, CN) ≥ … ≥ d(CN-1, CN) ≳ 0. Property 5 can also be measured using the Spearman’s rank correlation coefficient of the distance sequence:
PNG
media_image14.png
56
316
media_image14.png
Greyscale
" teaches calculating ρdis (Pearson correlation coefficient) between the weight distance (parameter distance) and the training epoch as the monotonicity of weight distance property (parameter distance monotonicity index));
obtain the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence (Section 4.1, paragraphs relating to property 2: "(2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·,·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity). Given that the model is trained with a sufficiently small learning rate, for any two consecutive checkpoints Ci and Ci+1 and a small threshold δ, the weights in all the L layers should satisfy: ∀l ∈ [1, L], EMD(P(
w
l
i
), P(
w
l
i
+
1
)) < δ. We quantify the property as follows:
PNG
media_image15.png
40
344
media_image15.png
Greyscale
cweight calculates the maximum of layer-wise parameter distribution distances between consecutive checkpoints. This property also prevents the adversary from directly concatenating model chains" teaches calculating a parameter distribution distance between consecutive models in the model chain to be verified in sequence in order to obtain the parameter distribution continuity property (parameter distribution continuity index));
obtain the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution (Section 4.1, paragraphs relating to property 3: " (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters). The parameters of the initial model should conform to the required GMM distribution. Given an initial model C0, its weights in all layers should satisfy: ∀l ∈[1, L], EMD (P(
w
l
0
), PGMM(
w
l
0
)) ≈ 0. Property 3 can be quantified by calculating the distance between the distribution of initial parameters and the required GMM distribution. The property is quantified as:
PNG
media_image16.png
36
320
media_image16.png
Greyscale
In a nutshell, Eq. (4) calculates the maximum distance between the required distribution and the actual distribution across all layers" teaches calculating a parameter distribution distance between an initial model of the model chain to be verified and the GMM distribution (Gaussian mixture distribution) to obtain the distribution of the initial parameters property (initial parameter distribution index));
obtain the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified (Section 4.1, paragraphs relating to property 4: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. … Property 4 (Independence among Initialized Parameters). The parameters of the initial model should be independent. Given the weight w in an initialized layer, any two different parameters w[i] and w[j] in w should satisfy the following equation if we view them as random variables: cov(w[i],w[j]) = 0, where cov(·,·) is the covariance of two random variables. To verify Property 4,we need to evaluate whether the parameters of the initial model are independently and randomly initialized. In §3.3, we show that the verification of parameter independence can be achieved with the PCA algorithm. Here we further elaborate the detailed procedures. First, group the parameters in the same layer according to their relationship (e.g., the parameters belonging to the same neuron in a linear layer or belonging to the same channel in a kernel filter of a convolutional layer are viewed as a group). Second, run the PCA algorithm on the grouped parameters, and get the explained variance ratio of the first principle components:
PNG
media_image17.png
40
338
media_image17.png
Greyscale
where MaxExplainedRatio(·) returns the largest explained variance ratio in the PCA result, and Group(·) is the parameter grouping function. In verification, a large ppca suggests that the initial model of the model chain is not likely to be randomly initialized" teaches calculating a randomness of parameters of the initial model in the model chain to be verified to obtain the independence among initialized parameters property (initial parameter randomness index)); and
obtain the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified (Section 4.1, paragraphs relating to property 6: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. … Property 6 (Small Distance between the Initial Model and Converged Model). Given that the DNN model is sufficiently complex, it is highly possible that the distance of the converged model to the initial model in the same model chain is much smaller than that to other randomly initialized models. Formally, given the initial model C0 and converged model CN in a model chain C and any other random model Mrand initialized with the same method as C0, the following inequality holds with a high probability: d(C0, CN)≪ d(Mrand, CN). Property 6 can be quantified as follows:
PNG
media_image18.png
28
246
media_image18.png
Greyscale
This property prevents the adversary from constructing a fake model chain by concatenating several short model chains, because the distance pattern is discontinuous and non-monotonic" teaches calculating a parameter distance between the initial model and the converged model in the model chain to be verified to obtain the small distance between the initial model and converged model property (model chain distance index)).
Regarding Claim 10,
Liu et al. teaches the computer device of claim 9.
Liu et al. further teaches wherein the accuracy monotonicity index is calculated as:
PNG
media_image24.png
58
326
media_image24.png
Greyscale
where ρacc represents the accuracy monotonicity index, N represents a total number of training epochs, rank(∙) represents a ranking of an accuracy of an intermediate model in the model chain to be verified, acc(Ci, Dval) represents an accuracy of an i-th intermediate model Ci in the model chain to be verified on the verification dataset, and Dval represents the verification dataset (Equation (2); Section 4.1, paragraphs relating to property 1: "(1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy). Given a validation dataset Dval with a data distribution similar to Dtrain, the validation accuracies of the checkpoints {C0,C1, · · · ,CN} over Dval are likely to be monotonically nondecreasing. Formally, for most of the timestamp i, acc(Ci, Dval) ≥ acc(Cj, Dval) ∀j ≤ i. We define a metric to quantitatively measure this property by calculating the Spearman’s rank correlation coefficient [10] between the accuracy and the number of training epochs:
PNG
media_image13.png
50
286
media_image13.png
Greyscale
where rank acc(Ci, Dval) denotes the ranking index of the accuracy of Ci in the model chain. A model chain with higher ρacc indicates a higher confidence in its authenticity. Note that there are corner cases where the validation accuracy is not sufficiently monotonic, e.g., the model overfits to the dataset or the task is overly hard. We use early stop during verification to alleviate the overfitting issue and constrain the metric to deal with the non-monotonicity" teaches calculating the monotonicity of validation accuracy property (accuracy monotonicity index) using equation (2) (the given equation));
the parameter distance monotonicity index is calculated as:
PNG
media_image25.png
56
304
media_image25.png
Greyscale
where ρdis represents the parameter distance monotonicity index, N represents the total number of training epochs, rank(∙) represents a ranking of an Euclidean distance of parameters between the intermediate model and the converged model in the model chain to be verified, and d(Ci, CN) represents an Euclidean distance of parameters between the i-th intermediate model Ci and the converged model CN in the model chain to be verified (Equation (6); Section 4.1, paragraphs relating to property 5: "Section 3.4, second paragraph: "In model training, the model parameters will eventually converge to a local optimum from the initial position, and the distance between the intermediate model and converged model will gradually change. Given the gradient descent algorithm’s nature of convergence, the parameters of the model under training shall gradually approach to an optimum that is close to the initial model. Thus the weight distance between the intermediate model and converged model is monotonically non-increasing. We illustrate this observation in Figure 3 where we plot, for multiple model training processes, the parameter distances between the intermediate checkpoints and the final converged models over the epochs" teaches calculating a weight distance (parameter distance) between an intermediate model (model in the model chain to be verified) and a converged model. Section 4.1, paragraphs relating to property 5: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance). Given that the training of the model converges normally, the distance between the intermediate checkpoint and the converged model decreases monotonically to zero, i.e., the following in equality on the model distance is expected to hold: d(C1, CN) ≥ d(C2, CN) ≥ … ≥ d(CN-1, CN) ≳ 0. Property 5 can also be measured using the Spearman’s rank correlation coefficient of the distance sequence:
PNG
media_image14.png
56
316
media_image14.png
Greyscale
" teaches calculating ρdis (Pearson correlation coefficient) between the weight distance (parameter distance) and the training epoch as the monotonicity of weight distance property (parameter distance monotonicity index)" teaches calculating the monotonicity of weight distance property (parameter distance monotonicity index) using equation (6) (the given equation));
the parameter distribution continuity index is calculated as:
PNG
media_image26.png
38
352
media_image26.png
Greyscale
where cweight represents the parameter distribution continuity index, N represents a total number of training epochs, L represents a number of layers of the model,
w
l
i
represents a parameter matrix of an l-th layer of the i-th intermediate model in the model chain to be verified, P(⋅) represents a distribution of parameters, and EMD(⋅,⋅) represents an Earth Mover’s Distance between two distributions (Equation (3); Section 4.1, paragraphs relating to property 2: "(2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·,·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity). Given that the model is trained with a sufficiently small learning rate, for any two consecutive checkpoints Ci and Ci+1 and a small threshold δ, the weights in all the L layers should satisfy: ∀l ∈ [1, L], EMD(P(
w
l
i
), P(
w
l
i
+
1
)) < δ. We quantify the property as follows:
PNG
media_image15.png
40
344
media_image15.png
Greyscale
cweight calculates the maximum of layer-wise parameter distribution distances between consecutive checkpoints. This property also prevents the adversary from directly concatenating model chains" teaches calculating the parameter distribution continuity property (parameter distribution continuity index) using equation (3) (the given equation));
the initial parameter distribution index is calculated as follows:
PNG
media_image27.png
42
288
media_image27.png
Greyscale
where dinit represents the initial parameter distribution index, L represents a number of layers of the model, EMD(⋅,⋅) represents an Earth Mover’s Distance between the two distributions, P(⋅) represents a distribution of parameters,
w
l
0
represents a parameter matrix of the l-th layer of the initial model, and PGMM(⋅) represents the Gaussian mixture distribution (Equation (4); Section 4.1, paragraphs relating to property 3: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters). The parameters of the initial model should conform to the required GMM distribution. Given an initial model C0, its weights in all layers should satisfy: ∀l ∈[1, L], EMD (P(
w
l
0
), PGMM(
w
l
0
)) ≈ 0. Property 3 can be quantified by calculating the distance between the distribution of initial parameters and the required GMM distribution. The property is quantified as:
PNG
media_image16.png
36
320
media_image16.png
Greyscale
In a nutshell, Eq. (4) calculates the maximum distance between the required distribution and the actual distribution across all layers" teaches calculating the distribution of the initial parameters property (initial parameter distribution index) using equation (4) (the given equation));
the initial parameter randomness index is calculated by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified (Equation (5); Section 4.1, paragraphs relating to property 4: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. … Property 4 (Independence among Initialized Parameters). The parameters of the initial model should be independent. Given the weight w in an initialized layer, any two different parameters w[i] and w[j] in w should satisfy the following equation if we view them as random variables: cov(w[i],w[j]) = 0, where cov(·,·) is the covariance of two random variables. To verify Property 4,we need to evaluate whether the parameters of the initial model are independently and randomly initialized. In §3.3, we show that the verification of parameter independence can be achieved with the PCA algorithm. Here we further elaborate the detailed procedures. First, group the parameters in the same layer according to their relationship (e.g., the parameters belonging to the same neuron in a linear layer or belonging to the same channel in a kernel filter of a convolutional layer are viewed as a group). Second, run the PCA algorithm on the grouped parameters, and get the explained variance ratio of the first principle components:
PNG
media_image17.png
40
338
media_image17.png
Greyscale
where MaxExplainedRatio(·) returns the largest explained variance ratio in the PCA result, and Group(·) is the parameter grouping function. In verification, a large ppca suggests that the initial model of the model chain is not likely to be randomly initialized" teaches calculating the independence among initialized parameters property (initial parameter randomness index) by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified using equation (5)); and
the model chain distance index is calculated as:
PNG
media_image28.png
26
136
media_image28.png
Greyscale
where dchain represents the model chain distance index, and d(C0, CN) represents an Euclidean distance of parameters between the initial model C0 and the converged model CN in the model chain to be verified (Equation (7); Section 4.1, paragraphs relating to property 6: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. … Property 6 (Small Distance between the Initial Model and Converged Model). Given that the DNN model is sufficiently complex, it is highly possible that the distance of the converged model to the initial model in the same model chain is much smaller than that to other randomly initialized models. Formally, given the initial model C0 and converged model CN in a model chain C and any other random model Mrand initialized with the same method as C0, the following inequality holds with a high probability: d(C0, CN)≪ d(Mrand, CN). Property 6 can be quantified as follows:
PNG
media_image18.png
28
246
media_image18.png
Greyscale
This property prevents the adversary from constructing a fake model chain by concatenating several short model chains, because the distance pattern is discontinuous and non-monotonic" teaches calculating the small distance between the initial model and converged model property (model chain distance index) using equation (7) (the given equation)).
Regarding Claim 11,
Liu et al. teaches the computer device of claim 8.
Liu et al. further teaches wherein the processor is further configured to: determine the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold to determine the authenticity of the model chain to obtain the ownership verification result of the DL model);
in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent, determine the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified (Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold and that when an index does not meet a threshold, then the model chain to be verified is incoherent and ownership of the model to be verified is not verified (i.e. the trainer does not have ownership of the model)); and
in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent, determine the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified (Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold and that when all indexes meet a threshold, then the model chain to be verified is coherent and ownership of the model to be verified is verified (i.e. the trainer does have ownership of the model)).
Regarding Claim 12,
Liu et al. teaches the computer device of claim 11.
Liu et al. further teaches wherein the processor is further configured to: in response to the accuracy monotonicity index being less than a first preset threshold, determine that the model chain to be verified is incoherent (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Algorithm 1; lines 2-3: "2 if C→ ρacc < δ1 then 3 return False; // Report C to be incoherent" teaches that when the monotonicity of validation accuracy property ρacc (accuracy monotonicity index) is less than a first preset threshold δ1, the model chain to be verified is determined to be incoherent);
in response to the parameter distance monotonicity index being less than a second preset threshold, determine that the model chain to be verified is incoherent (Algorithm 1; lines 4-5: "4 else if C→ ρdis < δ2 then 5 return False" teaches that when the monotonicity of weight distance property ρdis (parameter distance monotonicity index) is less than a second preset threshold δ2, the model chain to be verified is determined to be incoherent);
in response to the parameter distribution continuity index being greater than a third preset threshold, determine that the model chain to be verified is incoherent (Algorithm 1; lines 6-7: "6 else if C→ cweight > δ3 then 7 return False" teaches that when the parameter distribution continuity property cweight (parameter distribution continuity index) is greater than a third preset threshold δ3, the model chain to be verified is determined to be incoherent);
in response to the initial parameter distribution index being greater than a fourth preset threshold, determine that the model chain to be verified is incoherent (Algorithm 1; lines 8-9: "8 else if C→ dinit > δ4 then 9 return False" teaches that when the distribution of the initial parameters property dinit (initial parameter distribution index) is greater than a fourth preset threshold δ4, the model chain to be verified is determined to be incoherent);
calculate a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determine that the model chain to be verified is incoherent (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd (fifth threshold), and that when the independence among initialized parameters property ppca (initial parameter randomness index) is greater than the fifth threshold, the model chain to be verified is determined to be incoherent); and
calculate a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determine that the model chain to be verified is incoherent (Algorithm 1; lines 13-17: "13 estDisMean, estDisSTD = estimateChainDistance(C) ; // Estimate the range of dchain of forged model chains based on randomly re-initializing. 14 if dchain < estDisMean − 30 × estDisSTD then 15 return True; 16 else 17 return False" teaches calculating estDisMean − 30 × estDisSTD (sixth threshold), and that when the small distance between the initial model and converged model property dchain (model chain distance index) is greater than the sixth threshold, the model chain to be verified is determined to be incoherent).
Regarding Claim 13,
Liu et al. teaches the computer device of claim 12.
Liu et al. further teaches wherein the processor is further configured to: randomly sample a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculate parameter randomness indexes of the plurality of initial models (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd as a fifth threshold, and that calculating the fifth threshold comprises randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating independence among initialized parameters properties ppca (initial parameter randomness indexes) of the plurality of initial models); and
calculate an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models, and calculate the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd as a fifth threshold, and that calculating the fifth threshold comprises calculating an estPCAmean (average value) and a estPCAstd (standard deviation) of the independence among initialized parameters properties ppca (initial parameter randomness indexes) of the plurality of initial models).
Regarding Claim 14,
Liu et al. teaches the computer device of claim 12.
Liu et al. further teaches wherein the processor is further configured to: randomly sample a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculate an average and a standard deviation of parameter distances between the plurality of initial models and a converged model in the model chain to be verified (Algorithm 1; lines 13-17: "13 estDisMean, estDisSTD = estimateChainDistance(C) ; // Estimate the range of dchain of forged model chains based on randomly re-initializing. 14 if dchain < estDisMean − 30 × estDisSTD then 15 return True; 16 else 17 return False" teaches calculating estDisMean − 30 × estDisSTD (sixth threshold), and that calculating the sixth threshold comprises randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating an estDisMean (average) and a estDisSTD (standard deviation) of parameter distances between the plurality of initial models and a converged model in the model chain to be verified); and
obtain the sixth threshold by calculation based on an average value and the standard deviation of the parameter distances between the plurality of initial models and the converged model in the model chain to be verified (Algorithm 1; lines 13-17: "13 estDisMean, estDisSTD = estimateChainDistance(C) ; // Estimate the range of dchain of forged model chains based on randomly re-initializing. 14 if dchain < estDisMean − 30 × estDisSTD then 15 return True; 16 else 17 return False" teaches calculating estDisMean − 30 × estDisSTD (sixth threshold), and that calculating the sixth threshold comprises calculating an estDisMean (average) and a estDisSTD (standard deviation) of parameter distances between the plurality of initial models and a converged model in the model chain to be verified).
Regarding Claim 15,
Liu et al. teaches a non-transitory computer readable storage medium having computer programs stored thereon, wherein when the computer programs are executed by a computing device, a method for verifying an ownership of a deep learning (DL) model based on a training process proof is implemented (Section 1, third paragraph: "we propose PoT (Provenance of Training), a model ownership verification mechanism that simultaneously achieves robustness, exclusiveness, and training data privacy protection ... PoT leverages entire provenance of the model training process, which is naturally bound to the specific model. The core is building a coherent model chain from the intermediate model checkpoints saved during model training from scratch, such that the model owner can easily verify the model chain coherence without exposing any training data" teaches a method (claim 15 is a computer readable storage medium corresponding to method claim 1) for verifying ownership of a model based on a training process proof), the method comprising:
obtaining a Gaussian mixture distribution for initialization of a DL model to be verified, a model chain to be verified of the DL to be verified, and a corresponding verification dataset, wherein the model chain to be verified is composed of model parameters of the DL model to be verified in each training epoch (Section 3.2, second paragraph: "We initialize the model parameters with a special Gaussian Mixture Model (GMM) distribution to make the distribution change obviously" teaches obtaining a Gaussian mixture distribution for initialization of the model to be verified. Section 4, second-third paragraphs: "We call the checkpoint sequence generated during model training a model chain. In the following sections, we use M to denote the model protected by PoT, Ci to denote the checkpoint, and C = {C0, C1, ..., CN−1, CN} to denote the model chain. Note that the last checkpoint CN is exactly the protected model M ... The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously" teaches obtaining Gaussian Mixture Model (GMM) distribution and a model chain to be verified of the model to be verified. Section 2.2, first paragraph: "we assume that the verifier possesses a validation dataset Dval with similar distribution to that of the original owner" teaches obtaining a validation dataset (verification dataset));
calculating, based on the Gaussian mixture distribution, the model chain to be verified and the verification dataset, an accuracy monotonicity index, a parameter distance monotonicity index, a parameter distribution continuity index, an initial parameter distribution index, an initial parameter randomness index and a model chain distance index of the model chain to be verified (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified); and
obtaining an ownership verification result of the DL model to be verified by determining an authenticity of the model chain to be verified based on the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Section 4.3, first paragraph: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully" teaches obtaining an ownership verification result by determining an authenticity of the model chain based on the aforementioned properties (the indexes) of the model chain to be verified being satisfied).
Regarding Claim 16,
Liu et al. teaches the storage medium of claim 15.
Liu et al. further teaches wherein calculating the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified, comprises: calculating, based on the model chain to be verified and the verification dataset, an accuracy of each model in the model chain to be verified on the verification dataset in sequence, and calculating a Pearson correlation coefficient between the accuracy and the training epoch as the accuracy monotonicity index (Section 4.1, paragraphs relating to property 1: "(1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy). Given a validation dataset Dval with a data distribution similar to Dtrain, the validation accuracies of the checkpoints
{C0,C1, · · · ,CN} over Dval are likely to be monotonically nondecreasing. Formally, for most of the timestamp i, acc(Ci, Dval) ≥ acc(Cj, Dval) ∀j ≤ i. We define a metric to quantitatively measure this property by calculating the Spearman’s rank correlation coefficient [10] between the accuracy and the number of training epochs:
PNG
media_image13.png
50
286
media_image13.png
Greyscale
where rank acc(Ci, Dval) denotes the ranking index of the accuracy of Ci in the model chain. A model chain with higher ρacc indicates a higher confidence in its authenticity. Note that there are corner cases where the validation accuracy is not sufficiently monotonic, e.g., the model overfits to the dataset or the task is overly hard. We use early stop during verification to alleviate the overfitting issue and constrain the metric to deal with the non-monotonicity" teaches calculating, based on the model chain and validation dataset Dval (verification dataset), an accuracy (acc(Ci, Dval)) of each model in the model chain based on the verification dataset in sequence and calculating ρacc (Pearson correlation coefficient) between the accuracy (acc(Ci, Dval)) and the training epoch as the monotonicity of validation accuracy property (accuracy monotonicity index));
calculating a parameter distance between a model in the model chain to be verified and a converged model, and calculating a Pearson correlation coefficient between the parameter distance and the training epoch as the parameter distance monotonicity index, wherein the converged model is a final model in the model chain to be verified (Section 3.4, second paragraph: "In model training, the model parameters will eventually converge to a local optimum from the initial position, and the distance between the intermediate model and converged model will gradually change. Given the gradient descent algorithm’s nature of convergence, the parameters of the model under training shall gradually approach to an optimum that is close to the initial model. Thus the weight distance between the intermediate model and converged model is monotonically non-increasing. We illustrate this observation in Figure 3 where we plot, for multiple model training processes, the parameter distances between the intermediate checkpoints and the final converged models over the epochs" teaches calculating a weight distance (parameter distance) between an intermediate model (model in the model chain to be verified) and a converged model. Section 4.1, paragraphs relating to property 5: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance). Given that the training of the model converges normally, the distance between the intermediate checkpoint and the converged model decreases monotonically to zero, i.e., the following in equality on the model distance is expected to hold: d(C1, CN) ≥ d(C2, CN) ≥ … ≥ d(CN-1, CN) ≳ 0. Property 5 can also be measured using the Spearman’s rank correlation coefficient of the distance sequence:
PNG
media_image14.png
56
316
media_image14.png
Greyscale
" teaches calculating ρdis (Pearson correlation coefficient) between the weight distance (parameter distance) and the training epoch as the monotonicity of weight distance property (parameter distance monotonicity index));
obtaining the parameter distribution continuity index by calculating a parameter distribution distance between two consecutive models in the model chain to be verified in sequence (Section 4.1, paragraphs relating to property 2: "(2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·,·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity). Given that the model is trained with a sufficiently small learning rate, for any two consecutive checkpoints Ci and Ci+1 and a small threshold δ, the weights in all the L layers should satisfy: ∀l ∈ [1, L], EMD(P(
w
l
i
), P(
w
l
i
+
1
)) < δ. We quantify the property as follows:
PNG
media_image15.png
40
344
media_image15.png
Greyscale
cweight calculates the maximum of layer-wise parameter distribution distances between consecutive checkpoints. This property also prevents the adversary from directly concatenating model chains" teaches calculating a parameter distribution distance between consecutive models in the model chain to be verified in sequence in order to obtain the parameter distribution continuity property (parameter distribution continuity index));
obtaining the initial parameter distribution index by calculating a parameter distribution distance between an initial model in the model chain to be verified and the Gaussian mixture distribution (Section 4.1, paragraphs relating to property 3: " (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters). The parameters of the initial model should conform to the required GMM distribution. Given an initial model C0, its weights in all layers should satisfy: ∀l ∈[1, L], EMD (P(
w
l
0
), PGMM(
w
l
0
)) ≈ 0. Property 3 can be quantified by calculating the distance between the distribution of initial parameters and the required GMM distribution. The property is quantified as:
PNG
media_image16.png
36
320
media_image16.png
Greyscale
In a nutshell, Eq. (4) calculates the maximum distance between the required distribution and the actual distribution across all layers" teaches calculating a parameter distribution distance between an initial model of the model chain to be verified and the GMM distribution (Gaussian mixture distribution) to obtain the distribution of the initial parameters property (initial parameter distribution index));
obtaining the initial parameter randomness index by calculating a randomness of parameters of the initial model in the model chain to be verified (Section 4.1, paragraphs relating to property 4: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. … Property 4 (Independence among Initialized Parameters). The parameters of the initial model should be independent. Given the weight w in an initialized layer, any two different parameters w[i] and w[j] in w should satisfy the following equation if we view them as random variables: cov(w[i],w[j]) = 0, where cov(·,·) is the covariance of two random variables. To verify Property 4,we need to evaluate whether the parameters of the initial model are independently and randomly initialized. In §3.3, we show that the verification of parameter independence can be achieved with the PCA algorithm. Here we further elaborate the detailed procedures. First, group the parameters in the same layer according to their relationship (e.g., the parameters belonging to the same neuron in a linear layer or belonging to the same channel in a kernel filter of a convolutional layer are viewed as a group). Second, run the PCA algorithm on the grouped parameters, and get the explained variance ratio of the first principle components:
PNG
media_image17.png
40
338
media_image17.png
Greyscale
where MaxExplainedRatio(·) returns the largest explained variance ratio in the PCA result, and Group(·) is the parameter grouping function. In verification, a large ppca suggests that the initial model of the model chain is not likely to be randomly initialized" teaches calculating a randomness of parameters of the initial model in the model chain to be verified to obtain the independence among initialized parameters property (initial parameter randomness index)); and
obtaining the model chain distance index by calculating a parameter distance between the initial model and the converged model in the model chain to be verified (Section 4.1, paragraphs relating to property 6: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. … Property 6 (Small Distance between the Initial Model and Converged Model). Given that the DNN model is sufficiently complex, it is highly possible that the distance of the converged model to the initial model in the same model chain is much smaller than that to other randomly initialized models. Formally, given the initial model C0 and converged model CN in a model chain C and any other random model Mrand initialized with the same method as C0, the following inequality holds with a high probability: d(C0, CN)≪ d(Mrand, CN). Property 6 can be quantified as follows:
PNG
media_image18.png
28
246
media_image18.png
Greyscale
This property prevents the adversary from constructing a fake model chain by concatenating several short model chains, because the distance pattern is discontinuous and non-monotonic" teaches calculating a parameter distance between the initial model and the converged model in the model chain to be verified to obtain the small distance between the initial model and converged model property (model chain distance index)).
Regarding Claim 17,
Liu et al. teaches the storage medium of claim 16.
Liu et al. further teaches wherein the accuracy monotonicity index is calculated as:
PNG
media_image29.png
54
328
media_image29.png
Greyscale
where ρacc represents the accuracy monotonicity index, N represents a total number of training epochs, rank(∙) represents a ranking of an accuracy of an intermediate model in the model chain to be verified, acc(Ci, Dval) represents an accuracy of an i-th intermediate model Ci in the model chain to be verified on the verification dataset, and Dval represents the verification dataset (Equation (2); Section 4.1, paragraphs relating to property 1: "(1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy). Given a validation dataset Dval with a data distribution similar to Dtrain, the validation accuracies of the checkpoints {C0,C1, · · · ,CN} over Dval are likely to be monotonically nondecreasing. Formally, for most of the timestamp i, acc(Ci, Dval) ≥ acc(Cj, Dval) ∀j ≤ i. We define a metric to quantitatively measure this property by calculating the Spearman’s rank correlation coefficient [10] between the accuracy and the number of training epochs:
PNG
media_image13.png
50
286
media_image13.png
Greyscale
where rank acc(Ci, Dval) denotes the ranking index of the accuracy of Ci in the model chain. A model chain with higher ρacc indicates a higher confidence in its authenticity. Note that there are corner cases where the validation accuracy is not sufficiently monotonic, e.g., the model overfits to the dataset or the task is overly hard. We use early stop during verification to alleviate the overfitting issue and constrain the metric to deal with the non-monotonicity" teaches calculating the monotonicity of validation accuracy property (accuracy monotonicity index) using equation (2) (the given equation));
the parameter distance monotonicity index is calculated as:
PNG
media_image30.png
56
304
media_image30.png
Greyscale
where ρdis represents the parameter distance monotonicity index, N represents the total number of training epochs, rank(∙) represents a ranking of an Euclidean distance of parameters between the intermediate model and the converged model in the model chain to be verified, and d(Ci, CN) represents an Euclidean distance of parameters between the i-th intermediate model Ci and the converged model CN in the model chain to be verified (Equation (6); Section 4.1, paragraphs relating to property 5: "Section 3.4, second paragraph: "In model training, the model parameters will eventually converge to a local optimum from the initial position, and the distance between the intermediate model and converged model will gradually change. Given the gradient descent algorithm’s nature of convergence, the parameters of the model under training shall gradually approach to an optimum that is close to the initial model. Thus the weight distance between the intermediate model and converged model is monotonically non-increasing. We illustrate this observation in Figure 3 where we plot, for multiple model training processes, the parameter distances between the intermediate checkpoints and the final converged models over the epochs" teaches calculating a weight distance (parameter distance) between an intermediate model (model in the model chain to be verified) and a converged model. Section 4.1, paragraphs relating to property 5: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance). Given that the training of the model converges normally, the distance between the intermediate checkpoint and the converged model decreases monotonically to zero, i.e., the following in equality on the model distance is expected to hold: d(C1, CN) ≥ d(C2, CN) ≥ … ≥ d(CN-1, CN) ≳ 0. Property 5 can also be measured using the Spearman’s rank correlation coefficient of the distance sequence:
PNG
media_image14.png
56
316
media_image14.png
Greyscale
" teaches calculating ρdis (Pearson correlation coefficient) between the weight distance (parameter distance) and the training epoch as the monotonicity of weight distance property (parameter distance monotonicity index)" teaches calculating the monotonicity of weight distance property (parameter distance monotonicity index) using equation (6) (the given equation));
the parameter distribution continuity index is calculated as:
PNG
media_image31.png
34
354
media_image31.png
Greyscale
where cweight represents the parameter distribution continuity index, N represents a total number of training epochs, L represents a number of layers of the model,
w
l
i
represents a parameter matrix of an l-th layer of the i-th intermediate model in the model chain to be verified, P(⋅) represents a distribution of parameters, and EMD(⋅,⋅) represents an Earth Mover’s Distance between two distributions (Equation (3); Section 4.1, paragraphs relating to property 2: "(2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·,·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity). Given that the model is trained with a sufficiently small learning rate, for any two consecutive checkpoints Ci and Ci+1 and a small threshold δ, the weights in all the L layers should satisfy: ∀l ∈ [1, L], EMD(P(
w
l
i
), P(
w
l
i
+
1
)) < δ. We quantify the property as follows:
PNG
media_image15.png
40
344
media_image15.png
Greyscale
cweight calculates the maximum of layer-wise parameter distribution distances between consecutive checkpoints. This property also prevents the adversary from directly concatenating model chains" teaches calculating the parameter distribution continuity property (parameter distribution continuity index) using equation (3) (the given equation));
the initial parameter distribution index is calculated as follows:
PNG
media_image32.png
42
292
media_image32.png
Greyscale
where dinit represents the initial parameter distribution index, L represents a number of layers of the model, EMD(⋅,⋅) represents an Earth Mover’s Distance between the two distributions, P(⋅) represents a distribution of parameters,
w
l
0
represents a parameter matrix of the l-th layer of the initial model, and PGMM(⋅) represents the Gaussian mixture distribution (Equation (4); Section 4.1, paragraphs relating to property 3: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters). The parameters of the initial model should conform to the required GMM distribution. Given an initial model C0, its weights in all layers should satisfy: ∀l ∈[1, L], EMD (P(
w
l
0
), PGMM(
w
l
0
)) ≈ 0. Property 3 can be quantified by calculating the distance between the distribution of initial parameters and the required GMM distribution. The property is quantified as:
PNG
media_image16.png
36
320
media_image16.png
Greyscale
In a nutshell, Eq. (4) calculates the maximum distance between the required distribution and the actual distribution across all layers" teaches calculating the distribution of the initial parameters property (initial parameter distribution index) using equation (4) (the given equation));
the initial parameter randomness index is calculated by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified (Equation (5); Section 4.1, paragraphs relating to property 4: "(3) Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w). This constraint is important because an adversary may forge a model chain by directly manipulating the stolen model to generate a fake “initial model” that is not randomly initialized. Therefore, in a model ownership dispute, the parameters of the initial model should be checked to verify whether the parameters are initialized according to the requirement. Based on the analysis above, we can obtain the following two properties of the initial model parameters. … Property 4 (Independence among Initialized Parameters). The parameters of the initial model should be independent. Given the weight w in an initialized layer, any two different parameters w[i] and w[j] in w should satisfy the following equation if we view them as random variables: cov(w[i],w[j]) = 0, where cov(·,·) is the covariance of two random variables. To verify Property 4,we need to evaluate whether the parameters of the initial model are independently and randomly initialized. In §3.3, we show that the verification of parameter independence can be achieved with the PCA algorithm. Here we further elaborate the detailed procedures. First, group the parameters in the same layer according to their relationship (e.g., the parameters belonging to the same neuron in a linear layer or belonging to the same channel in a kernel filter of a convolutional layer are viewed as a group). Second, run the PCA algorithm on the grouped parameters, and get the explained variance ratio of the first principle components:
PNG
media_image17.png
40
338
media_image17.png
Greyscale
where MaxExplainedRatio(·) returns the largest explained variance ratio in the PCA result, and Group(·) is the parameter grouping function. In verification, a large ppca suggests that the initial model of the model chain is not likely to be randomly initialized" teaches calculating the independence among initialized parameters property (initial parameter randomness index) by calculating a variance proportion of a maximum principal component in principal component analysis results of each layer of the initial model in the model chain to be verified using equation (5)); and
the model chain distance index is calculated as:
PNG
media_image33.png
28
140
media_image33.png
Greyscale
where dchain represents the model chain distance index, and d(C0, CN) represents an Euclidean distance of parameters between the initial model C0 and the converged model CN in the model chain to be verified (Equation (7); Section 4.1, paragraphs relating to property 6: "(4) Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. … Property 6 (Small Distance between the Initial Model and Converged Model). Given that the DNN model is sufficiently complex, it is highly possible that the distance of the converged model to the initial model in the same model chain is much smaller than that to other randomly initialized models. Formally, given the initial model C0 and converged model CN in a model chain C and any other random model Mrand initialized with the same method as C0, the following inequality holds with a high probability: d(C0, CN)≪ d(Mrand, CN). Property 6 can be quantified as follows:
PNG
media_image18.png
28
246
media_image18.png
Greyscale
This property prevents the adversary from constructing a fake model chain by concatenating several short model chains, because the distance pattern is discontinuous and non-monotonic" teaches calculating the small distance between the initial model and converged model property (model chain distance index) using equation (7) (the given equation)).
Regarding Claim 18,
Liu et al. teaches the storage medium of claim 15.
Liu et al. further teaches wherein obtaining the ownership verification result of the DL model to be verified by determining the authenticity of the model chain to be verified comprises: determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets a corresponding threshold (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold to determine the authenticity of the model chain to obtain the ownership verification result of the DL model);
in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is incoherent, determining the model chain to be verified is incoherent, and a trainer of the DL model does not have an ownership of the DL model to be verified (Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold and that when an index does not meet a threshold, then the model chain to be verified is incoherent and ownership of the model to be verified is not verified (i.e. the trainer does not have ownership of the model)); and
in response to determining any of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index is that the model chain to be verified is coherent, determining the model chain to be verified is coherent, and the trainer of the DL model has an ownership of the DL model to be verified (Algorithm 1; Section 4.3, first-third paragraphs: "Ownership verification in PoT is conceptually simple: only the entity possessing a coherent model chain that satisfies all the aforementioned properties can claim ownership successfully. Adopting PoT is lightweight, since the construction of a coherent model chain is straightforward for the party that performs actual training. However, designing the verification protocol is non-trivial. In particular, values of certain properties (e.g., Properties 4 and 6) can be largely influenced by the complexity of models and datasets. Therefore, we leverage two strategies to perform the property verification. For properties whose values are less affected (such as Properties 1, 2, 3, and 5), we consider a model chain to satisfy these properties as long as their values are within the predefined thresholds. Meanwhile, for Property 4, since the verifier knows the architecture and the initialization method of the model, we need the verifier to randomly re-initialize the model several times and compute the property value to estimate its valid range. Property 4 of a coherent model chain should be within this range because its initial model is randomly initialized, and the incurred overhead for range estimation is low. Property 6 is verified in a similar way by randomly sampling the initial model to estimate a range of rejection. The basic idea is that dchain of a coherent model chain is much smaller than that of a model chain with a forged initial checkpoint, so the valid dchain should be smaller than the lower bound of the estimated range. The verification proceeds as follows. It firstly uses a threshold-based approach to verify ρacc, ρdis, cweight, and dinit. Then it estimates the valid range of ppca and dchain by randomly sampling initial models and verifies the model chains with the estimated ranges. A model chain is coherent only if it passes the verification of all the properties. We further provide the verification algorithm in Appendix A and discuss the threshold selection in Appendix B" teaches judging whether each of the indexes of the model chain to be verified meets a corresponding threshold and that when all indexes meet a threshold, then the model chain to be verified is coherent and ownership of the model to be verified is verified (i.e. the trainer does have ownership of the model)).
Regarding Claim 19,
Liu et al. teaches the storage medium of claim 18.
Liu et al. further teaches wherein determining the authenticity of the model chain to be verified by judging whether each of the accuracy monotonicity index, the parameter distance monotonicity index, the parameter distribution continuity index, the initial parameter distribution index, the initial parameter randomness index and the model chain distance index of the model chain to be verified meets the corresponding threshold, comprises: in response to the accuracy monotonicity index being less than a first preset threshold, determining that the model chain to be verified is incoherent (Section 4, third paragraph - Section 4.1, last paragraph: "The requirement for model owners to use PoT is light: they only need to initialize the model according to a specific Gaussian Mixture Model (GMM) distribution and conduct the normal training procedure with L2 regularization (weight decay) (see details in § 4.2). In a model ownership dispute, the verifier regulates the process by favoring the party providing a coherent model chain that satisfies key properties simultaneously … We present the property definitions used by PoT in §4.1, and describe the details of training and verification with PoT in §4.2 and 4.3 … Our observations and measurements in §3 lead to six key properties that a coherent model chain should hold. (1) Validation Accuracy. In §3.1, we analyze the property of checkpoints’ validation accuracies, which is formally defined as follows: Property 1 (Monotonicity of Validation Accuracy) … (2) Parameter Distribution Distance. In §3.2, we empirically show that model parameter distribution keeps evolving without sharp changes during training due to incremental parameter updates. Hereafter, We denote the weight distribution of w as P(w), which can be approximated with the histogram in practice. We use EMD(·, ·) to denote the Earth Mover’s Distance between two distributions. Formally, we can obtain the following property: Property 2 (Parameter Distribution Continuity) … (3)Initial Model Parameters. In §3.3, we empirically show that the mutual independence among the initial model parameters can reveal whether the model is randomly initialized. In PoT, the parameters of a protected DNN model are randomly initialized with a specific GMM distribution, where the required GMM distribution for a weight w is represented as PGMM(w) … Based on the analysis above, we can obtain the following two properties of the initial model parameters. Property 3 (Distribution of the Initial Parameters) … Property 4 (Independence among Initialized Parameters) … (4)Weight Distance. In §3.4, we empirically study the natural properties of the weight distance during model training. Our observations can be further formalized as the following two properties that a legitimate model chain shall hold. Property 5 (Monotonicity of Weight Distance) … Property 6 (Small Distance between the Initial Model and Converged Model)" teaches using the GMM (Gaussian mixture distribution), the model chain to be verified and the validation dataset Dval (verification dataset) to calculate a monotonicity of validation accuracy property (accuracy monotonicity index), a parameter distribution continuity property (parameter distribution continuity index), a distribution of the initial parameters property (initial parameter distribution index), an independence among initialized parameters property (initial parameter randomness index), a monotonicity of weight distance property (parameter distance monotonicity index), and a small distance between the initial model and converged model property (model chain distance index) of the model chain to be verified. Algorithm 1; lines 2-3: "2 if C→ ρacc < δ1 then 3 return False; // Report C to be incoherent" teaches that when the monotonicity of validation accuracy property ρacc (accuracy monotonicity index) is less than a first preset threshold δ1, the model chain to be verified is determined to be incoherent);
in response to the parameter distance monotonicity index being less than a second preset threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 4-5: "4 else if C→ ρdis < δ2 then 5 return False" teaches that when the monotonicity of weight distance property ρdis (parameter distance monotonicity index) is less than a second preset threshold δ2, the model chain to be verified is determined to be incoherent);
in response to the parameter distribution continuity index being greater than a third preset threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 6-7: "6 else if C→ cweight > δ3 then 7 return False" teaches that when the parameter distribution continuity property cweight (parameter distribution continuity index) is greater than a third preset threshold δ3, the model chain to be verified is determined to be incoherent);
in response to the initial parameter distribution index being greater than a fourth preset threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 8-9: "8 else if C→ dinit > δ4 then 9 return False" teaches that when the distribution of the initial parameters property dinit (initial parameter distribution index) is greater than a fourth preset threshold δ4, the model chain to be verified is determined to be incoherent);
calculating a fifth threshold, and in response to the initial parameter randomness index being greater than the fifth threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd (fifth threshold), and that when the independence among initialized parameters property ppca (initial parameter randomness index) is greater than the fifth threshold, the model chain to be verified is determined to be incoherent); and
calculating a sixth threshold, and in response to the model chain distance index being greater than the sixth threshold, determining that the model chain to be verified is incoherent (Algorithm 1; lines 13-17: "13 estDisMean, estDisSTD = estimateChainDistance(C) ; // Estimate the range of dchain of forged model chains based on randomly re-initializing. 14 if dchain < estDisMean − 30 × estDisSTD then 15 return True; 16 else 17 return False" teaches calculating estDisMean − 30 × estDisSTD (sixth threshold), and that when the small distance between the initial model and converged model property dchain (model chain distance index) is greater than the sixth threshold, the model chain to be verified is determined to be incoherent).
Regarding Claim 20,
Liu et al. teaches the storage medium of claim 19.
Liu et al. further teaches wherein calculating the fifth threshold comprises: randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating parameter randomness indexes of the plurality of initial models (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd as a fifth threshold, and that calculating the fifth threshold comprises randomly sampling a plurality of initial models by using the Gaussian mixture distribution for random initialization, and calculating independence among initialized parameters properties ppca (initial parameter randomness indexes) of the plurality of initial models); and
calculating an average value and a standard deviation of the parameter randomness indexes of the plurality of initial models, and calculating the fifth threshold based on the average value and the standard deviation of the parameter randomness indexes (Algorithm 1; lines 10-12: "10 estPCAmean, estPCAstd = estimatePCAratio(C) ; // Estimate the range of valid ppca by randomly reinitializing the protected model for several times and calculate ppca. 11 if C→ ppca > estPCAmean + 10 × estPCAstd then 12 return False" teaches calculating estPCAmean + 10 × estPCAstd as a fifth threshold, and that calculating the fifth threshold comprises calculating an estPCAmean (average value) and a estPCAstd (standard deviation) of the independence among initialized parameters properties ppca (initial parameter randomness indexes) of the plurality of initial models).
Applicant cannot rely upon the certified copy of the foreign priority application to overcome this rejection because a translation of said application has not been made of record in accordance with 37 CFR 1.55. When an English language translation of a non-English language foreign application is required, the translation must be that of the certified copy (of the foreign application as filed) submitted together with a statement that the translation of the certified copy is accurate. See MPEP §§ 215 and 216.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Jia et al. (“Proof-of-Learning: Definitions and Practice”) teaches a concrete proof-of-learning mechanism, wherein the integrity of a training procedure can be verified and used to obtain a model and can also be used to show proof of ownership.
Rees (US 11,521,121 B2) teaches a method for generating a machine-learning model and encoding ownership information in the machine-learning model, wherein ownership can be determined based on detecting that information about the filter is embedded in parameters of the machine learning model.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRIAN J HALES whose telephone number is (571)272-0878. The examiner can normally be reached M-F 9:00am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamran Afshar can be reached at (571) 272-7796. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRIAN J HALES/Examiner, Art Unit 2125
/KAMRAN AFSHAR/Supervisory Patent Examiner, Art Unit 2125
