DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is responsive to the original application filed on 3/26/2024. Acknowledgment is made with respect to a claim of priority to British application GB2113771.6 filed on 9/27/2021, British application GB2114251.8 filed on 10/5/2021, and PCT application PCT/EP2022/076689 filed on 9/26/2022.
Specification
The specification is objected to as failing to provide proper antecedent basis for the claimed subject matter. See 37 CFR 1.75(d)(1) and MPEP § 608.01(o). Correction of the following is required: Claim 26 recites “[a] storage medium” but the originally filed specification fails to provide any antecedent support for the claimed storage medium. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 3-5, 8, 9, 16, and 17 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 3 recites the limitation “applying a perturbation to a starting input for that iteration in a direction in the input space that is defined by the gradient of the surrogate loss function” (emphasis added). There is insufficient antecedent basis for the claimed “surrogate loss function”. For examination purposes, the limitation will be interpreted to mean “applying a perturbation to a starting input for that iteration in a direction in the input space that is defined by the gradient of the surrogate attack loss function” (emphasis added). Dependent claim 4 depends on indefinite claim 3 and is also rejected under 35 USC § 112(b) by virtue of this dependency. Appropriate correction is required.
Claim 5 recites the limitation ““a wherein the (or each) perturbation has a fixed magnitude” (emphasis added). There is insufficient antecedent basis for the claimed “the (or each) perturbation”. For examination purposes, the limitation will be interpreted to mean “wherein the perturbed initial input has a fixed magnitude” (emphasis added). Appropriate correction is required.
Claim 8 recites the limitation “wherein 2N queries are performed in the primary attack process in each iteration” (emphasis added). There is insufficient antecedent basis for the claimed “each iteration”. For examination purposes, the limitation will be interpreted to mean “wherein 2N queries are performed in the primary attack process in each iteration of multiple iterations” (emphasis added). Appropriate correction is required.
Claim 9 recites the limitation “wherein the backup process is limited by a query cap or other predetermined termination condition” (emphasis added). There is insufficient antecedent basis for the claimed “the backup process”. For examination purposes, the limitation will be interpreted to mean “wherein the backup attack process is limited by a query cap or other predetermined termination condition” (emphasis added). Appropriate correction is required.
Claim 16 recites the limitation “further comprising identifying and mitigating a problem with the perception component based on adversarial input(s) that has been found” (emphasis added). It is unclear if one or more adversarial inputs have been found based on the “(s)” attached to the word “input”. For examination purposes, the limitation will be interpreted to mean “further comprising identifying and mitigating a problem with the perception component based on at least one adversarial [[input(s)]] input that has been found” (emphasis added). Dependent claim 17 depends on indefinite claim 16 and is also rejected under 35 USC § 112(b) by virtue of this dependency. Appropriate correction is required.
Claim 17 recites the limitation “further comprising modifying the perception component so that the adversarial input no longer satisfies the attack objective” (emphasis added). As stated above with respect to claim 16, it is unclear if one or more adversarial inputs have been found when claim 16 allows more than one adversarial input. For examination purposes, the limitation will be interpreted to mean “further comprising modifying the perception component so that the at least one adversarial input no longer satisfies the attack objective” (emphasis added). Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 26 is rejected under 35 U.S.C. § 101 because the claimed invention is directed towards non-statutory subject matter. The claims do not fall within at least one of the four categories of patent eligible subjected matter because the claimed invention is directed towards signals per se.
With respect to independent claim 26, the originally filed specification fails to disavow any transitory signals as part of the claimed storage medium. Under a broadest reasonable interpretation of the claim language, the “storage medium” of claim 26 may encompass transitory signals and is thus directed towards signals per se. Examiner suggests amending claim 26 to recite "A non-transitory storage medium". Appropriate correction is required.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-12, 15, 18, 25, and 26 are rejected under 35 USC § 103 as being obvious over Ma et al. (Ma et al., “Switching Transferable Gradient Directions for Query-Efficient Black-Box Adversarial Attacks”, May 13, 2021, arXiv:2009.07191v2, pp. 1-18, hereinafter “Ma”) in view of Tashiro et al. (Tashiro et al., “Diversity Can Be Transferred: Output Diversification for White- and Black-box Attacks”, Oct. 30, 2020, arXiv:2003.06878v3, pp. 1-25, hereinafter “Tashiro”).
Regarding claim 1, Ma discloses [a] computer-implemented method of generating black-box adversarial inputs in an input space of a perception component using one or more surrogate models of the perception component, the method comprising: (Abstract; “We propose a simple and highly query-efficient black-box adversarial attack named SWITCH, which has a state-of-the-art performance in the score-based setting. SWITCH features a highly efficient and effective utilization of the gradient of a surrogate model ˆ g w.r.t. the input image, i.e., the transferable gradient”; and §2, “Black-box attacks”; where SWITCH is a score-based black-box attack that exploits the surrogate model’s gradient as guidance)
receiving an initial input to the perception component and one or more output scores computed by the perception component from the initial input; and (Algorithm 1, Lines 1-2; the algorithm discloses the victim’s loss on the benign input is computed as L-last (the output score), and x_adv (the initial input) is initialized to the benign image; and §2, “Black-box attacks”; “In this study, we focus on the score-based attack, in which the adversary can obtain the output scores of the target model”; and Equation 2; the equation discloses the models logits or output scores that are received into the experiment)
repeatedly perturbing the initial input until an adversarial input is found that satisfies an attack objective when inputted to the perception component, (Algorithm 1, “while not successful”; and §4.1, “Evaluation Metric”; “we report a successful attack if the attack successfully finds an adversarial example within 10,000 queries”)
the initial input repeatedly perturbed by: performing a primary attack process based on the initial input, to compute one or more perturbed inputs, each perturbed input computed in the primary attack process by evaluating a gradient of a surrogate attack loss function based on the initial input, and (Figure 1, left part, up to SwitchRGF; and Algorithm 1; the primary attack corresponds to lines 4-15 and is based on a gradient of the surrogate attack loss L as in line 4, xadv being initialized to x on line 1)
perturbing the initial input based on the gradient of the surrogate attack loss function, (Algorithm 1, Line 6)
the surrogate attack loss function encoding the attack objective in terms of one or more output scores computed by a surrogate model of the one or more surrogate models; (Loss function L defined in equation 2, when applied to surrogate model 1 as in line 4)
wherein if a perturbed input of the one or more perturbed inputs is determined to satisfy a promising attack condition, the primary attack process is repeated based on that perturbed input, (Algorithm 1, Line 9, (Direct acceptance) or lines 11-14 (acceptance after switching gradient direction))
wherein it is determined whether the perturbed input satisfies the promising attack condition by comparing the one or more output scores computed by the perception component from the initial input (Algorithm 1, Line 2, Llast with one or more output scores computed by the perception component from the perturbed input; (Algorithm 1, Line 8; comparison of Llast with L1, calculated on Line 7 based on the perturbed input. Similar for lines 12 and 13)
wherein if the primary attack process terminates without finding any perturbed input satisfying the promising attack condition: (Else on line 15, i.e. also L2 failed to be larger than Llast)
(i) a backup attack process is performed, which is a search of the input space of the perception component for perturbed inputs satisfying the promising attack condition that is randomized …, until a perturbed input satisfying the promising attack condition is found, and (Algorithm 1, Lines 16-19; use a Random Gradient Free method as a backup attack process; and Abstract; “To improve the robustness of SWITCH, we further propose SWITCHRGF in which the update follows the direction of a random gradient-free (RGF) estimate when neither ˆ g nor its opposite direction can increase the objective”, wherein the RGF fallback is randomized)
(ii) the primary attack process is repeated based on the perturbed input found to satisfy the promising attack condition in the backup attack process (Algorithm 1, Lines 8 and 22-25; After using RGF, Algorithm 1 continues, looping back to the while loop on line 3, triggering another round of the primary attack process)
Ma fails to explicitly disclose but Tashiro discloses a backup attack process is performed, which is a search of the input space of the perception component for perturbed inputs satisfying the promising attack condition that is randomized but guided by the one or more surrogate models (Algorithm 1, Lines 4-9; each ODS direction is built from a randomly chosen surrogate and a random weight vector w, and the search runs until a loss-increasing or promising input is found; and §3.2; “we employ ODS to sample update directions instead of random sampling. Given a target classifier f, we cannot directly calculate the ODS perturbation vODS(x,f,wd) because gradients of the target model f are unknown. Instead, we introduce a surrogate model g and calculate the ODS vector vODS(x,g,wd)”).
Ma and Tashiro are analogous art because both are concerned with adversarial learning. Before the effective filing date of the claimed invention, it would have been obvious to one skilled in adversarial learning to combine the backup attack process of Tashiro with the method of generating black-box adversarial inputs of Ma to yield to the predictable result of (i) a backup attack process is performed, which is a search of the input space of the perception component for perturbed inputs satisfying the promising attack condition that is randomized but guided by the one or more surrogate models, until a perturbed input satisfying the promising attack condition is found, and (ii) the primary attack process is repeated based on the perturbed input found to satisfy the promising attack condition in the backup attack process. The motivation for doing so would be to improve the performance of existing white box and black-box attacks and reduce the number of queries needed for state-of-the-art black-box attacks (Tashiro; Abstract).
Regarding claim 25, it is a computer system claim corresponding to the steps of claim 1 and is rejected for the same reasons as claim 1.
Regarding claim 26, it is a storage medium claim corresponding to the steps of claim 1 and is rejected for the same reasons as claim 1.
Regarding claim 2, the rejection of claim 1 is incorporated and Ma further discloses wherein the gradient of the surrogate attack loss function is normalized (Algorithm 1, Line 5).
Regarding claim 3, the rejection of claim 1 is incorporated and Ma further discloses performed in multiple iterations, wherein, for each iteration, the primary attack process computes the or each perturbed input by applying a perturbation to a starting input for that iteration in a direction in the input space that is defined by the gradient of the surrogate loss function, the starting input being the initial input for a first iteration, and, for every subsequent iteration, the perturbed input found to satisfy the promising attack condition in a previous iteration (Algorithm 1, Lines 6 and 11).
Regarding claim 4, the rejection of claims 1 and 3 are incorporated and Ma further discloses wherein up to two perturbations are applied to the starting input in each iteration, in the direction of the gradient and in an opposite direction respectively (Algorithm 1, Lines 6 and 11).
Regarding claim 5, the rejection of claim 1 is incorporated and Ma further discloses wherein the (or each) perturbation has a fixed magnitude (Algorithm 1, Line 5).
Regarding claim 6, the rejection of claim 1 is incorporated and Ma further discloses wherein the promising attack condition is defined in terms of a victim attack loss function defined in terms of one or more output scores of the perception component (Algorithm 1, Lines 2 and 7).
Regarding claim 7, the rejection of claim 1 is incorporated and Ma further discloses wherein the primary attack process performs a number of queries on a victim, wherein the number of queries is defined by a number of surrogate models and a number of directions considered for each gradient of the surrogate attack loss function (Abstract; “In SWITCH, only one or two queries are needed per iteration, but it is still effective due to the rich information provided by the transferable gradient, thereby resulting in unprecedented query efficiency”; and §3; this hold true for the single surrogate model m).
Regarding claim 8, the rejection of claims 1 and 7 are incorporated and Ma further discloses wherein two directions are considered for each gradient, for each surrogate model, and wherein 2N queries are performed in the primary attack process in each iteration, where N is the number of surrogate models (Abstract; “In SWITCH, only one or two queries are needed per iteration, but it is still effective due to the rich information provided by the transferable gradient, thereby resulting in unprecedented query efficiency”; and §3; this hold true for the single surrogate model m).
Regarding claim 9, the rejection of claim 1 is incorporated and Ma further discloses wherein the backup process is limited by a query cap or other predetermined termination condition (§4.1, “Evaluation Metric”; “we report a successful attack if the attack successfully finds an adversarial example within 10,000 queries”).
Regarding claim 10, the rejection of claim 1 is incorporated and Ma further discloses wherein the surrogate attack loss function that encodes the attack objective is a deterministic function of one or more output scores of the surrogate model (Equation 1; the max-margin logit loss is a deterministic function of the surrogate logits).
Regarding claim 11, the rejection of claims 1 and 3 are incorporated and Ma fails to explicitly disclose but Tashiro discloses wherein, in each iteration of the primary attack process, each perturbed input is computed by perturbing the starting input of that iteration based on a gradient of a randomized transformation of one or more output scores of a surrogate model of the one or more surrogate models (Algorithm 1, Lines 5-6; the ODS direction is the gradient of a randomly weighted logit sum).
The motivation to combine Ma and Tashiro is the same as discussed above with respect to claim 1.
Regarding claim 12, the rejection of claim 1 is incorporated and Ma fails to explicitly disclose but Tashiro discloses wherein the backup attack process uses an Output-Diversified Sampling (ODS) approach, or a bandit optimiser supplied with surrogate gradients, or surrogate gradients as a biasing prior (Algorithm 1; and Abstract).
The motivation to combine Ma and Tashiro is the same as discussed above with respect to claim 1.
Regarding claim 15, the rejection of claim 1 is incorporated and Ma further discloses wherein a query on the perception component is performed for a given perturbed input to determine whether the given perturbed input fulfils the attack objective and, failing that, whether the given perturbed input satisfies the promising attack condition (Algorithm 1, Line 3 and the rest of the loop).
Regarding claim 18, the rejection of claim 1 is incorporated and Ma further discloses wherein each input comprises one of the following modalities of perception data, or any combination thereof: image data, lidar data or radar data (§4.1; “CIFAR-10 [23],CIFAR-100[23],and TinyImageNet[34], are used for the experiments”, which is image data).
Claims 16, 17, 19, and 21 are rejected under 35 USC § 103 as being obvious over Ma in view of Tashiro and further in view of Tu et al. (Tu et al., “Physically Realizable Adversarial Examples for LiDAR Object Detection”, Apr. 2, 2020, arXiv:2004.00543v2, pp. 1-10, hereinafter “Tu”).
Regarding claim 16, the rejection of claim 1 is incorporated and Ma fails to explicitly disclose but Tu discloses identifying and mitigating a problem with the perception component based on adversarial input(s) that has been found (§3.4; “we first propose random data augmentation as a simple defense mechanism. Next, we consider adversarial training [8] for a stronger defense against adversarial attacks”, the data-augmentation defense or retraining is the identifying and mitigating a problem as claimed and Abstract).
Ma, Tashiro, and Tu are analogous art because all are concerned with adversarial attacks and machine learning. Before the effective filing date of the claimed invention, it would have been obvious to one skilled in adversarial learning to combine the problem mitigation of Tu with the method of generating black-box adversarial inputs of Ma and the backup process of Tashiro to yield to the predictable result of identifying and mitigating a problem with the perception component based on adversarial input(s) that has been found. The motivation for doing so would be to provide for adversarial defense using data augmentation (Tu; Abstract).
Regarding claim 17, the rejection of claim 1 is incorporated and Ma fails to explicitly disclose but Tu discloses modifying the perception component so that the adversarial input no longer satisfies the attack objective (§3.4; “we first propose random data augmentation as a simple defense mechanism. Next, we consider adversarial training [8] for a stronger defense against adversarial attacks”, and Abstract).
The motivation to combine Ma, Tashiro, and Tu is the same as discussed above with respect to claim 16.
Regarding claim 19, the rejection of claim 1 is incorporated and Ma fails to explicitly disclose but Tu discloses wherein the perception component is for use in a robotic system for perceiving physical structure in an environment in which the robot robotic system is operating and wherein the modified perception component is incorporated in the robotic system (Abstract; “we demonstrate that placing an adversarial object on the rooftop of any target vehicle to hide the vehicle entirely from LiDAR detectors with a success rate of 80%”; and Figure 1).
The motivation to combine Ma, Tashiro, and Tu is the same as discussed above with respect to claim 16.
Regarding claim 21, the rejection of claim 1 is incorporated and Ma fails to explicitly disclose but Tu discloses wherein the modification of the perception component is achieved through re-training, re-architecting or otherwise reconfiguring the perception component (§3.4; “we first propose random data augmentation as a simple defense mechanism. Next, we consider adversarial training [8] for a stronger defense against adversarial attacks”, and Abstract).
The motivation to combine Ma, Tashiro, and Tu is the same as discussed above with respect to claim 16.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Brent Hoover whose telephone number is (303)297-4403. The examiner can normally be reached Monday - Friday 9-5 MST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Abdullah Kawsar can be reached at 571-270-3169. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRENT JOHNSTON HOOVER/Primary Examiner, Art Unit 2127
