DETAILED ACTION
This action is in response to arguments filed 2/23/2026. Claims 1-20 ae pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Acknowledgment is made of applicant's claim for foreign priority under 35 U.S.C. 119(a)-(d). The certified copy has been received.
Response to Arguments
Applicant's arguments filed 2/23/206 have been fully considered.
A) Applicant's arguments with respect to the 35 USC 112(b) rejection that the specification provides ample support for the claimed subject matter have been fully considered but they are not persuasive.
While applicant points to Figures 2B. 4, 5, and 7-11 and paragraphs [0018]-[0021] and [0118]-[0124] for written support for the claim limitations of “means for retrieving an AI model”, “means for decomposing the original model weights (W)”, “means for designating the first matrix (U) and the second matrix (V)”, “means for designating the third matrix (Σ)”, “means for encrypting”, “means for transferring”, “means for decrypting”, “means for applying the third matrix (Σ) to an adapter component”, “means for storing the inference results”, “means for performing non-sensitive computations”, “means for performing sensitive computations”, “means for synchronizing computational results”, ” means for training the AI model” and “means for using the third matrix (Σ)”. The written description of the specification does not implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function. Applicant should clarify the record by stating on the record what the corresponding structure for each of the listed means for functions.
B) Applicant's arguments with respect to the 35 USC 102(a)(1) rejection of claims 1, 8 and 15 that Alipay fails to disclose “designating, by the first processor, the third matrix (Z) for processing within a secure execution environment (SEE)” have been fully considered but they are not persuasive.
Alipay paragraph 0090-0091 states the fine- tuning structure (such as the aforementioned LoRA structure or P-tuning v2 structure) added to the trained industry language model will involve more industry-related data information. The industry-related data involved in the fine- tuning structure involves industry privacy to a certain extent ... in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE). While the paragraphs are do not use the term “matrix” Both LoRA structure and P-tuning v2 structure are matrix structures.
C) Applicant's arguments with respect to the 35 USC 102(a)(1) rejection of claims 1, 8 and 15 that Alipay fails to disclose “encrypting, by the first processor, the third matrix (∑) in the UEE; decrypting the encrypted third matrix (∑) by a second processor within the SEE)” have been fully considered but they are not persuasive.
Alipay paragraph 0088 states the features transmitted between TEE and REE are encrypted and decrypted to achieve the effect equivalent to homomorphic encryption and decryption of the features transmitted between TEE and REE, so as to achieve better protection of user privacy data (query data) in the process of processing user query data using a large language model, and the consumption of computing resources in TEE can be reduced to a certain extent. Also see figure 6.
D) Applicant's arguments with respect to dependent claims 2-7, 9-14 and 16-20 have been fully considered but they are not persuasive. See response to arguments B and C above.
Claim Interpretation
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 15 and 17-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim limitation “means for retrieving an AI model”, “means for decomposing the original model weights (W)”, “means for designating the first matrix (U) and the second matrix (V)”, “means for designating the third matrix (Σ)”, “means for encrypting”, “means for transferring”, “means for decrypting”, “means for applying the third matrix (Σ) to an adapter component”, “means for storing the inference results”, “means for performing non-sensitive computations”, “means for performing sensitive computations”, “means for synchronizing computational results”, ” means for training the AI model” and “means for using the third matrix (Σ)” invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1, 3-5, 8, 10-12, 15 and 17-19 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Alipay (CN 11790471) listed on IDS filed 10/27/2025.
With respect to claim 1 Alipay teaches a processor-implemented method of securing artificial intelligence (Al) models in a computing device (see Alipay paragraphs 0090-0091 i.e. the fine-tuning structure ... added to the trained industry language model will involve more industry-related data information. The industry-related data involved in the fine-tuning structure involves industry privacy to a certain extent ... in order to better protect the industry privacy involved in a large language model, such as an industry large language model....), the method comprising:
retrieving, by a first processor of the computing device, an Al model that includes original model weights (W) (see Alipay paragraph 0089 i.e. the large language model);
decomposing the original model weights (W) by the first processor into lower-rank matrices including a first matrix (U), a second matrix (V), and a third matrix (∑) (Alipay paragraph 0089 i.e. the fine-tuning structure added to the large language model may include, But is not limited to: Low-Rank Adaptation (LoRA) structure and deep prompt fine-tuning structure, namely Prompt Tuning v2 (P-tuning v2) structure, etc.)
designating, by the first processor, the first matrix (U) and the second matrix (V) for processing within an unsecured execution environment (UEE) (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE);
designating, by the first processor, the third matrix (Z) for processing within a secure execution environment (SEE) (see Alipay paragraph 0090-0091 i.e. the fine- tuning structure (such as the aforementioned LoRA structure or P-tuning v2 structure) added to the trained industry language model will involve more industry-related data information. The industry-related data involved in the fine- tuning structure involves industry privacy to a certain extent ... in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE);
encrypting, by the first processor, the third matrix (∑) in the UEE; transferring the encrypted third matrix (∑) to the SEE; decrypting the encrypted third matrix (∑) by a second processor within the SEE (see Alipay paragraph 0088 i.e. the features transmitted between TEE and REE are encrypted and decrypted to achieve the effect equivalent to homomorphic encryption and decryption of the features transmitted between TEE and REE, so as to achieve better protection of user privacy data (query data) in the process of processing user query data using a large language model, and the consumption of computing resources in TEE can be reduced to a certain extent);
applying the third matrix (∑) to an adapter component by the second processor in the SEE to perform secure computations and generate inference results (see Alipay paragraph 0093 i.e. the fine-tuning structure included in the large language model is a low-rank adapter LORA, wherein “Add” in FIG5 represents an addition operation on two input features); and
storing the inference results or third matrix (∑) in encrypted form in a secure memory within the SEE (see Alipay paragraphs 0095-0098 i.e. after the server obtains the query result of the query data in the TEE, in order to ensure the security of the query result, the method may further include the following steps 31-32: In step 31, in the TEE, the query result is encrypted using the encryption key pre- negotiated with the aforementioned client to obtain a ciphertext of the query result).
With respect to claim 3 Alipay teaches the method of claim 1, wherein designating the third matrix (Σ) as the secure component for processing within the SEE further comprises the first processor encrypting and storing the third matrix (Σ) in encrypted form in the secure memory within the SEE (see Alipay paragraphs 0095-0098 i.e. after the server obtains the query result of the query data in the TEE, in order to ensure the security of the query result, the method may further include the following steps 31-32: In step 31, in the TEE, the query result is encrypted using the encryption key pre- negotiated with the aforementioned client to obtain a ciphertext of the query result).
With respect to claim 4 Alipay teaches the method of claim 1, further comprising: performing non-sensitive computations involving the first matrix (U) and the second matrix (V) by the first processor in the UEE (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE); performing sensitive computations involving the third matrix (Σ) by the second processor within the SEE (see Alipay paragraphs 0091-0092 i.e. In view of the above situation, in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE); and synchronizing computational results between the SEE and UEE by one of the first or second processors (see Alipay paragraphs 0096 i.e. In one embodiment, after obtaining the query result of the query data in the TEE, the server can directly feed back the query result to the client, so that the client displays the query result to the user and paragraph 0095).
With respect to claim 5 Alipay teaches the method of claim 1, further comprising training the AI model using the first matrix (U) and the second matrix (V) by the first processor in the UEE for non-sensitive training data (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE), and using the third matrix (Σ) by the second processor in the SEE for sensitive training data (see Alipay paragraphs 0091 i.e. In view of the above situation, in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE).
With respect to claim 8 Alipay teaches a computing device, comprising: a first processor within an unsecured execution environment (UEE); a second processor within a secure execution environment (SEE); and a secure memory within the SEE (see Alipay paragraph 0005 i.e. According to a first aspect, a data processing method based on a large language model is provided, which is applied to a server, wherein the server is configured with a trusted execution environment TEE and a universal execution environment REE), wherein the first processor is configured to:
retrieve an Al model that includes original model weights (W) (see Alipay paragraph 0089 i.e. the large language model);
decompose the original model weights (W) by the first processor into lower-rank matrices including a first matrix (U), a second matrix (V), and a third matrix (∑) (Alipay paragraph 0089 i.e. the fine-tuning structure added to the large language model may include, But is not limited to: Low-Rank Adaptation (LoRA) structure and deep prompt fine-tuning structure, namely Prompt Tuning v2 (P-tuning v2) structure, etc.)
designate the first matrix (U) and the second matrix (V) for processing within an unsecured execution environment (UEE) (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE);
designate the third matrix (Z) for processing within a secure execution environment (SEE) (see Alipay paragraph 0090-0091 i.e. the fine- tuning structure (such as the aforementioned LoRA structure or P-tuning v2 structure) added to the trained industry language model will involve more industry-related data information. The industry-related data involved in the fine- tuning structure involves industry privacy to a certain extent ... in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE);
encrypt the third matrix (∑) in the UEE; transfer the encrypted third matrix (∑) to the SEE; and wherein the second processor is configured to decrypt the encrypted third matrix (∑) in the SEE (see Alipay paragraph 0088 i.e. the features transmitted between TEE and REE are encrypted and decrypted to achieve the effect equivalent to homomorphic encryption and decryption of the features transmitted between TEE and REE, so as to achieve better protection of user privacy data (query data) in the process of processing user query data using a large language model, and the consumption of computing resources in TEE can be reduced to a certain extent);
apply the third matrix (∑) to an adapter component to perform secure computations and generate inference results (see Alipay paragraph 0093 i.e. the fine-tuning structure included in the large language model is a low-rank adapter LORA, wherein “Add” in FIG5 represents an addition operation on two input features); and
store the inference results or third matrix (∑) in encrypted form in a secure memory within the SEE (see Alipay paragraphs 0097-0098 i.e. after the server obtains the query result of the query data in the TEE, in order to ensure the security of the query result, the method may further include the following steps 31-32: In step 31, in the TEE, the query result is encrypted using the encryption key pre- negotiated with the aforementioned client to obtain a ciphertext of the query result).
With respect to claim 10 Alipay teaches the computing device of claim 8, wherein designating the third matrix (Σ) as the secure component for processing within the SEE further comprises the first processor encrypting and storing the third matrix (Σ) in encrypted form in the secure memory within the SEE (see Alipay paragraphs 0095-0098 i.e. after the server obtains the query result of the query data in the TEE, in order to ensure the security of the query result, the method may further include the following steps 31-32: In step 31, in the TEE, the query result is encrypted using the encryption key pre- negotiated with the aforementioned client to obtain a ciphertext of the query result).
With respect to claim 11 Alipay teaches the computing device of claim 8, further comprising: performing non-sensitive computations involving the first matrix (U) and the second matrix (V) by the first processor in the UEE (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE); performing sensitive computations involving the third matrix (Σ) by the second processor within the SEE (see Alipay paragraphs 0091-0092 i.e. In view of the above situation, in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE); and synchronizing computational results between the SEE and UEE by one of the first or second processors (see Alipay paragraphs 0096 i.e. In one embodiment, after obtaining the query result of the query data in the TEE, the server can directly feed back the query result to the client, so that the client displays the query result to the user and paragraph 0095).
With respect to claim 12 Alipay teaches the computing device of claim 8, further comprising training the AI model using the first matrix (U) and the second matrix (V) by the first processor in the UEE for non-sensitive training data (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE), and using the third matrix (Σ) by the second processor in the SEE for sensitive training data (see Alipay paragraphs 0091 i.e. In view of the above situation, in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE).
With respect to claim 15 Alipay teaches a computing device comprising:
means for retrieving, by a first processor of the computing device, an Al model that includes original model weights (W) (see Alipay paragraph 0089 i.e. the large language model);
means for decomposing the original model weights (W) by the first processor into lower-rank matrices including a first matrix (U), a second matrix (V), and a third matrix (∑) (Alipay paragraph 0089 i.e. the fine-tuning structure added to the large language model may include, But is not limited to: Low-Rank Adaptation (LoRA) structure and deep prompt fine-tuning structure, namely Prompt Tuning v2 (P-tuning v2) structure, etc.)
means for designating, by the first processor, the first matrix (U) and the second matrix (V) for processing within an unsecured execution environment (UEE) (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE);
means for designating, by the first processor, the third matrix (Z) for processing within a secure execution environment (SEE) (see Alipay paragraph 0090-0091 i.e. the fine- tuning structure (such as the aforementioned LoRA structure or P-tuning v2 structure) added to the trained industry language model will involve more industry-related data information. The industry-related data involved in the fine- tuning structure involves industry privacy to a certain extent ... in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE);
means for encrypting, by the first processor, the third matrix (∑) in the UEE; means for transferring the encrypted third matrix (∑) to the SEE; means for decrypting the encrypted third matrix (∑) by a second processor within the SEE (see Alipay paragraph 0088 i.e. the features transmitted between TEE and REE are encrypted and decrypted to achieve the effect equivalent to homomorphic encryption and decryption of the features transmitted between TEE and REE, so as to achieve better protection of user privacy data (query data) in the process of processing user query data using a large language model, and the consumption of computing resources in TEE can be reduced to a certain extent);
means for applying the third matrix (∑) to an adapter component by the second processor in the SEE to perform secure computations and generate inference results (see Alipay paragraph 0093 i.e. the fine-tuning structure included in the large language model is a low-rank adapter LORA, wherein “Add” in FIG5 represents an addition operation on two input features); and
means for storing the inference results or third matrix (∑) in encrypted form in a secure memory within the SEE (see Alipay paragraphs 0097-0098 i.e. after the server obtains the query result of the query data in the TEE, in order to ensure the security of the query result, the method may further include the following steps 31-32: In step 31, in the TEE, the query result is encrypted using the encryption key pre- negotiated with the aforementioned client to obtain a ciphertext of the query result).
With respect to claim 17 Alipay teaches the computing device of claim 15, wherein means for designating the third matrix (Σ) as the secure component for processing within the SEE further comprises means for encrypting and storing the third matrix (Σ) in encrypted form within the SEE (see Alipay paragraphs 0095-0098 i.e. after the server obtains the query result of the query data in the TEE, in order to ensure the security of the query result, the method may further include the following steps 31-32: In step 31, in the TEE, the query result is encrypted using the encryption key pre- negotiated with the aforementioned client to obtain a ciphertext of the query result).
With respect to claim 18 Alipay teaches the computing device of claim 15, further comprising: means for performing non-sensitive computations involving the first matrix (U) and the second matrix (V) in the UEE (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE); performing sensitive computations involving the third matrix (Σ) by the second processor within the SEE (see Alipay paragraphs 0091-0092 i.e. In view of the above situation, in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE); and synchronizing computational results between the SEE and UEE by one of the first or second processors (see Alipay paragraphs 0096 i.e. In one embodiment, after obtaining the query result of the query data in the TEE, the server can directly feed back the query result to the client, so that the client displays the query result to the user and paragraph 0095).
With respect to claim 19 Alipay teaches the computing device of claim 15, further comprising means for training the AI model using the first matrix (U) and the second matrix (V) by the first processor in the UEE for non-sensitive training data (see Alipay paragraph 0095 i.e. the operation of splicing the prefix features of the input features corresponding to a single network layer before the input features corresponding to the network layer can be performed in the REE), and using the third matrix (Σ) by the second processor in the SEE for sensitive training data (see Alipay paragraphs 0091 i.e. In view of the above situation, in order to better protect the industry privacy involved in a large language model, such as an industry large language model, in one embodiment, the large language model may also include a fine-tuning structure, and the fine-tuning structure is deployed in the TEE).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 2, 7, 9, 15, 16 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Alipay (CN 11790471) in view of Hu et al “LoRA: Low-Rank Adaptation of Large Language Models” listed on IDS filed 10/27/2025.
With respect to claim 2 Alipay teaches the method of claim 1, where in the third matrix (Σ) is low-rank adapter LoRA. Alipay does not disclose wherein the third matrix (Σ) is a diagonal matrix that includes singular values of the original model weights (W) derived from the decomposition operations that include sensitive, private, or personal data characteristics or features (see Alipay paragraph 0088 i.e. low-rank adapter LoRA and fine-tuning strategies, referred to as large model parameter efficient fine-tuning (PEFT)).
Hu teaches wherein the third matrix (Σ) is a diagonal matrix that includes singular values of the original model weights (W) derived from the decomposition operations that include sensitive, private, or personal data characteristics or features (see Hu section H.4 Amplification Factor).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Hu to have used the Amplification Factor of LoRA as a way to achieve our reported accuracy for the downstream specific task when the ∆W mostly contains task-specific directions (see section H.4 Amplification Factor). Therefore one would have been motivated to have used the Amplification Factor of LoRA.
With respect to claim 7 Alipay teaches the method of claim 1, wherein decomposing the original model weights (W) into the lower-rank matrices including the first matrix (U), the second matrix (V), and the third matrix (Σ) comprises the first processor using a matrix decomposition algorithm to decompose the original model weights (W) into the first matrix (U), the second matrix (V), and the third matrix (Σ).
Hu teaches wherein decomposing the original model weights (W) into the lower-rank matrices including the first matrix (U), the second matrix (V), and the third matrix (Σ) comprises the first processor using a matrix decomposition algorithm to decompose the original model weights (W) into the first matrix (U), the second matrix (V), and the third matrix (Σ) (see Hu section 5.1 Baseline i.e. LoRA adds trainable pairs of rank decomposition matrices in parallel to existing weight matrices. As mentioned in Section 4.2, we only apply LoRA to Wq and Wv in most experiments for simplicity. The number of trainable parameters is determined by the rank r and the shape of the original weights: |Θ| = 2 × LˆLoRA × dmodel × r, where LˆLoRA is the number of weight matrices we apply LoRA to).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Hu to have used the LoRA is LoRA adds trainable pairs of rank decomposition matrices in parallel to existing weight matrices (see Hu section 5.1 Baseline). Therefore one would have been motivated to have used LoRA to add trainable pairs of rank decomposition matrices in parallel.
With respect to claim 9 Alipay teaches the computing device of claim 8, where in the third matrix (Σ) is low-rank adapter LoRA. Alipay does not disclose wherein the third matrix (Σ) is a diagonal matrix that includes singular values of the original model weights (W) derived from the decomposition operations that include sensitive, private, or personal data characteristics or features.
Hu teaches wherein the third matrix (Σ) is a diagonal matrix that includes singular values of the original model weights (W) derived from the decomposition operations that include sensitive, private, or personal data characteristics or features (see Hu section H.4 Amplification Factor).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Hu to have used the Amplification Factor of LoRA as a way to achieve our reported accuracy for the downstream specific task when the ∆W mostly contains task-specific directions (see section H.4 Amplification Factor). Therefore one would have been motivated to have used the Amplification Factor of LoRA.
With respect to claim 14 Alipay teaches the computing device of claim 8, wherein decomposing the original model weights (W) into the lower-rank matrices including the first matrix (U), the second matrix (V), and the third matrix (Σ) comprises the first processor using a matrix decomposition algorithm to decompose the original model weights (W) into the first matrix (U), the second matrix (V), and the third matrix (Σ).
Hu teaches wherein decomposing the original model weights (W) into the lower-rank matrices including the first matrix (U), the second matrix (V), and the third matrix (Σ) comprises the first processor using a matrix decomposition algorithm to decompose the original model weights (W) into the first matrix (U), the second matrix (V), and the third matrix (Σ) (see Hu section 5.1 Baseline i.e. LoRA adds trainable pairs of rank decomposition matrices in parallel to existing weight matrices. As mentioned in Section 4.2, we only apply LoRA to Wq and Wv in most experiments for simplicity. The number of trainable parameters is determined by the rank r and the shape of the original weights: |Θ| = 2 × LˆLoRA × dmodel × r, where LˆLoRA is the number of weight matrices we apply LoRA to).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Hu to have used the LoRA is LoRA adds trainable pairs of rank decomposition matrices in parallel to existing weight matrices (see Hu section 5.1 Baseline). Therefore one would have been motivated to have used LoRA to add trainable pairs of rank decomposition matrices in parallel.
With respect to claim 16 Alipay teaches the computing device of claim 15, where in the third matrix (Σ) is low-rank adapter LoRA. Alipay does not disclose wherein the third matrix (Σ) is a diagonal matrix that includes singular values of the original model weights (W) derived from the decomposition operations that include sensitive, private, or personal data characteristics or features.
Hu teaches wherein the third matrix (Σ) is a diagonal matrix that includes singular values of the original model weights (W) derived from the decomposition operations that include sensitive, private, or personal data characteristics or features (see Hu section H.4 Amplification Factor).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Hu to have used the Amplification Factor of LoRA as a way to achieve our reported accuracy for the downstream specific task when the ∆W mostly contains task-specific directions (see section H.4 Amplification Factor). Therefore one would have been motivated to have used the Amplification Factor of LoRA.
With respect to claim 20 Alipay teaches the computing device of claim 15, wherein means for decomposing the original model weights (W) into the lower-rank matrices including the first matrix (U), the second matrix (V), and the third matrix (Σ) comprises means for using a matrix decomposition algorithm to decompose the original model weights (W) into the first matrix (U), the second matrix (V), and the third matrix (Σ).
Hu teaches wherein means for decomposing the original model weights (W) into the lower-rank matrices including the first matrix (U), the second matrix (V), and the third matrix (Σ) comprises the first processor using a matrix decomposition algorithm to decompose the original model weights (W) into the first matrix (U), the second matrix (V), and the third matrix (Σ) (see Hu section 5.1 Baseline i.e. LoRA adds trainable pairs of rank decomposition matrices in parallel to existing weight matrices. As mentioned in Section 4.2, we only apply LoRA to Wq and Wv in most experiments for simplicity. The number of trainable parameters is determined by the rank r and the shape of the original weights: |Θ| = 2 × LˆLoRA × dmodel × r, where LˆLoRA is the number of weight matrices we apply LoRA to).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Hu to have used the LoRA is LoRA adds trainable pairs of rank decomposition matrices in parallel to existing weight matrices (see Hu section 5.1 Baseline). Therefore one would have been motivated to have used LoRA to add trainable pairs of rank decomposition matrices in parallel.
Claims 6 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Alipay (CN 11790471) in view of Zhang et al “TEESlice: Slicing DNN Models for Secure and Efficient Deployment” listed on IDS filed 10/27/2025.
With respect to claim 6 Alipay teaches the method of claim 1, but does not disclose further comprising monitoring data flows between the SEE and the UEE to detect updates or potential security breaches.
Zhang teaches further comprising monitoring data flows between the SEE and the UEE to detect updates or potential security breaches (see Zhang figure 2 “correctness monitor and section 4.3.3 i.e. Correctness Verification, One security concern of outsourcing DNN computation is that the computation results may be wrong and TEESlice should verify the correctness and raise the alarm as soon ae the outsourced results are wrong … TEESlice compares yTu and xTu. If the two values are equal, the outsourced result should be correct with high probability. Otherwise, TEESIice thinks the outsourced result is tampered and raises alarms).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Zhang to have the TEESlice compare yTu and xTu as a way to detect if the result has been tampered with (see Zhang figure 2 “correctness monitor and section 4.3.3). Therefore one would have been motivated to have monitor data flows to detect result that have been tampered with.
With respect to claim 13 Alipay teaches the computer device of claim 8, but does not disclose further comprising monitoring data flows between the SEE and the UEE to detect updates or potential security breaches.
Zhang teaches further comprising monitoring data flows between the SEE and the UEE to detect updates or potential security breaches (see Zhang figure 2 “correctness monitor and section 4.3.3 i.e. Correctness Verification, One security concern of outsourcing DNN computation is that the computation results may be wrong and TEESlice should verify the correctness and raise the alarm as soon ae the outsourced results are wrong … TEESlice compares yTu and xTu. If the two values are equal, the outsourced result should be correct with high probability. Otherwise, TEESIice thinks the outsourced result is tampered and raises alarms).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Alipay in view of Zhang to have the TEESlice compare yTu and xTu as a way to detect if the result has been tampered with (see Zhang figure 2 “correctness monitor and section 4.3.3). Therefore one would have been motivated to have monitor data flows to detect result that have been tampered with.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DEVIN E ALMEIDA whose telephone number is (571)270-1018. The examiner can normally be reached on Monday-Thursday from 7:30 A.M. to 5:00 P.M. The examiner can also be reached on alternate Fridays from 7:30 A.M. to 4:00 P.M.
If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Rupal Dharia, can be reached on 571-272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/DEVIN E ALMEIDA/Examiner, Art Unit 2492
Prosecution Insights