Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Drawings
The drawings are objected to because Tracking System 100 is drawn in Fig.1 as separate and distinct from the big oval (which includes the prompt checker, code tracking database, etc..). Per examiner’s understanding from the specification, the big oval is not separate and distinct, but rather is the zooming-in of the Tracking System 100. Fig. 1 needs to be revised to show that this relationship between the big oval and the Tracking System 100, drawn inside the Memory 102. This could be revised, for example, through adding dotted lines between the big oval and Tracking System 100. Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Specification
The disclosure is objected to because of the following informalities:
In [0017]: “checks prompts from an AI system that generates code” should read “checks prompts to an AI system that generates code”
In [0020]: “…response 118” should read as “… prompt 118”
In [0032]: “containing internal guidelines the input prompt 112 should meet is accessed”. It is not clear what is meant by “meet is accessed”
In [0049]: “modified response” may need to read as “modified prompt”
In [0063]: “The auditor 610, which may be a done manually …” should read “The auditor 610, which may be done manually …” (without “a”)
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION —The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 2, 6-7, 9, 13-14, 16 and 20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 2 recites the limitation “the code tracking database” in line 5 of the claim. There is insufficient antecedent basis for this limitation. Claim 1 recites “an updateable code tracking database” but not “the code tracking database”. Examiner is not sure if “the code tracking database” is the same as “an updateable code tracking database” or a different database.
Claim 6 is dependent on claim 5 which means that it inherits all the limitations of claim 5. Claim 5 provides the limitation mentioning “wherein the input prompt received from the third party application”. However, claim 6 states “wherein the input prompt received from the internal Al application” which is in contradiction with the inherited limitation from claim 5. For examination purposes, Examiner will interpret claim 6 as being dependent on claim 4 instead of being dependent on claim 5.
Claim 7 recites the limitation “the code tracking database” in lines 4-5 of the claim. There is insufficient antecedent basis for this limitation. Claim 1 recites “an updateable code tracking database” but not “the code tracking database”. Examiner is not sure if “the code tracking database” is the same as “an updateable code tracking database” or a different database.
Claim 9 recites the limitation “the code tracking database” in line 5 of the claim. There is insufficient antecedent basis for this limitation. Claim 1 recites “an updateable code tracking database” but not “the code tracking database”. Examiner is not sure if “the code tracking database” is the same as “an updateable code tracking database” or a different database.
Claim 13 is dependent on claim 12 which means that it inherits all the limitations of claim 12. Claim 12 provides the limitation mentioning “wherein the input prompt received from the third party application”. However, claim 13 states “wherein the input prompt received from the internal Al application” which is in contradiction with the inherited limitation from claim 12. For examination purposes, Examiner will interpret claim 13 as being dependent on claim 11 instead of being dependent on claim 12.
Claim 14 recites the limitation “the code tracking database” in lines 3-4 of the claim. There is insufficient antecedent basis for this limitation. Claim 1 recites “an updateable code tracking database” but not “the code tracking database”. Examiner is not sure if “the code tracking database” is the same as “an updateable code tracking database” or a different database.
Claim 16 recites the limitation “the code tracking database” in line 5 of the claim. There is insufficient antecedent basis for this limitation. Claim 1 recites “an updateable code tracking database” but not “the code tracking database”. Examiner is not sure if “the code tracking database” is the same as “an updateable code tracking database” or a different database.
Claim 20 is dependent on claim 19 which means that it inherits all the limitations of claim 18. Claim 18 provides the limitation mentioning “wherein the input prompt received from the third party application”. However, claim 20 states “wherein the input prompt received from the internal Al application” which is in contradiction with the inherited limitation from claim 19. For examination purposes, Examiner will interpret claim 20 as being dependent on claim 18 instead of being dependent on claim 19.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent thereof, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
As to claim 1, the claim(s) recited(s) – “A method comprising: receiving, at an Al system, an input prompt instructing an Al model to generate code; detecting confidential content in the input prompt; upon determining the input prompt does not surpass a threshold value for an acceptable amount of confidential content, redacting the confidential content found in the input prompt, modifying the input prompt to ensure the input prompt is understandable to the Al system after redacting the confidential content; generating code using the Al system based on the modified input prompt; and logging the generated code from the Al model in an updateable code tracking database.”
The steps of -“ detecting confidential content in the input prompt; upon determining the input prompt does not surpass a threshold value for an acceptable amount of confidential content, redacting the confidential content found in the input prompt, modifying the input prompt to ensure the input prompt is understandable to the Al system after redacting the confidential content; generating code using the Al system based on the modified input prompt” are reasonably directed to mere data gathering, mental processes, observations, evaluations, judgements and opinions, and mere instructions to apply using AI system. See MPEP 2106.04(a).
The judicial exception is not integrated into a practical application. In particular, the claim recites additional elements – “AI system”, “AI model”, “threshold”, and “code tracking database”, which is generic mere structures to apply the abstract idea on a device or merely use a device as a tool to perform the abstract idea. See MPEP 2106.06(f). The claim further recites - “receiving, at an Al system, an input prompt instructing an Al model to generate code”, and “logging the generated code from the Al model in an updateable code tracking database , which are mere data gathering, record-keeping, storing, and mere instructions to apply using the AI system as a tool wherein a human with the aid a of the AI system receives an input prompt, and which are insignificant extra solution activity to the judicial exception. See MPEP 2106.05(g). Accordingly, these do not integrate the abstract idea into a practical application because they do not impose meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. See MPEP 2106.04(d).
The identified additional elements, whether considered individually and in a combination, further do not amount to significantly more than the judicial exception because the elements merely apply the abstract idea or are WURC to be implemented on a generic computer and therefore the identified claim does not amount to significantly more. See MPEP 2106.05(b), MPEP 2106.05(f) and MPEP 2106.05(d).
As to claim 2, the rejection of claim 1 is incorporated, the claim(s) recited(s) the additional limitations – “The method of claim 1 further comprising: receiving, at the Al system, a code submission; checking whether or not the code submission contains Al generated portions; and updating the code tracking database with data indicating the Al generated and non Al generated portions of the code submission.”
The step of “checking whether or not the code submission contains Al generated portions” is reasonably directed to mental processes, observations, evaluations, judgements and opinions. See MPEP 2106.04(a).
The judicial exception is not integrated into a practical application. In particular, the claim recites additional elements – “AI system”, “code submission”, and “code tracking database” which is generic mere structures to apply the abstract idea on a device or merely use a device as a tool to perform the abstract idea. See MPEP 2106.06(f). The claim further recites the steps of – “receiving, at the Al system, a code submission;” and “updating the code tracking database with data indicating the Al generated and non Al generated portions of the code submission”, which are mere data gathering, record-keeping, storing, and mere instructions to apply using the AI system as a tool, and which is insignificant extra solution activity to the judicial exception. See MPEP 2106.05(g). Accordingly, these do not integrate the abstract idea into a practical application because they do not impose meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. See MPEP 2106.04(d).
The identified additional elements, whether considered individually and in a combination, further do not amount to significantly more than the judicial exception because the elements merely apply the abstract idea or are WURC to be implemented on a generic computer and therefore the identified claim does not amount to significantly more. See MPEP 2106.05(f) and MPEP 2106.05(d).
As to claim 3, the rejection of claim 1 is incorporated, the claim(s) recited(s) the additional limitations – “The method of claim 1 further comprising: receiving, at the Al system, a code submission; manually auditing the code submission by comparing the code submission to existing code in the updatable code tracking database; and determining whether or not portions of the code submission are Al generated based on the comparison”.
The steps of – “manually auditing the code submission by comparing the code submission to existing code in the updatable code tracking database; and determining whether or not portions of the code submission are Al generated based on the comparison” recite the functions of manually auditing, comparing, and determining which could be done by human using computer as a tool and are reasonably directed to mental processes, observations, evaluations, judgements and opinions. See MPEP 2106.04(a).
The judicial exception is not integrated into a practical application. In particular, the claim recites additional elements – “AI system”, “code submission”, and “code tracking database” which is generic mere structures to apply the abstract idea on a device or merely use a device as a tool to perform the abstract idea. See MPEP 2106.06(f). The claim further recites the step of – “receiving, at the Al system, a code submission” which is mere data gathering, and mere instructions to apply using the AI system as a tool, and which is insignificant extra solution activity to the judicial exception. See MPEP 2106.05(g). Accordingly, these do not integrate the abstract idea into a practical application because they do not impose meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. See MPEP 2106.04(d).
The identified additional elements, whether considered individually and in a combination, further do not amount to significantly more than the judicial exception because the elements merely apply the abstract idea or are WURC to be implemented on a generic computer and therefore the identified claim does not amount to significantly more. See MPEP 2106.05(f) and MPEP 2106.05(d).
As to claim 4, the rejection of claim 1 is incorporated, the claim(s) recited(s) the additional limitations – “The method of claim 1, wherein the input prompt is received from a third party Al application or an internal Al application”.
The claim recites additional elements – “input prompt”, “third party AI application”, and “internal AI application” which is generic mere structures to apply the abstract idea on a device or merely use a device as a tool to perform the abstract idea. See MPEP 2106.06(f). The claim further recites the step of – “input prompt is received from a third party Al application or an internal Al application” which is mere data gathering, and mere instructions to apply using AI application as a tool, and which is insignificant extra solution activity to the judicial exception. See MPEP 2106.05(g). Accordingly, these do not integrate the abstract idea into a practical application because they do not impose meaningful limits on practicing the abstract idea. See MPEP 2106.04(d).
The identified additional elements, whether considered individually and in a combination, further do not amount to significantly more than the judicial exception because the elements merely apply the abstract idea or are WURC to be implemented on a generic computer and therefore the identified claim does not amount to significantly more. See MPEP 2106.05(f) and MPEP 2106.05(d).
As to claim 5, the rejection of claim 4 is incorporated, the claim(s) recited(s) the additional limitations – “The method of claim 4, wherein the input prompt received from the third party application is intercepted after being received by the Al system, and a check is imposed on the intercepted input prompt”.
The steps of – “a check is imposed on the intercepted input prompt” recite the functions of imposing a check which is reasonably directed to mental processes, observations, evaluations, judgements and opinions. See MPEP 2106.04(a).
The claim recites additional elements – “third party AI application”, “AI system”, and “input prompt” which is generic mere structures to apply the abstract idea on a device or merely use a device as a tool to perform the abstract idea. See MPEP 2106.06(f). The claim further recites the step of – “wherein the input prompt received from the third party application is intercepted after being received by the Al system” which is mere data gathering, and mere instructions to apply using AI system as a tool, and which is insignificant extra solution activity to the judicial exception. See MPEP 2106.05(g). Accordingly, these do not integrate the abstract idea into a practical application because they do not impose meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. See MPEP 2106.04(d).
The identified additional elements, whether considered individually and in a combination, further do not amount to significantly more than the judicial exception because the elements merely apply the abstract idea or are WURC to be implemented on a generic computer and therefore the identified claim does not amount to significantly more. See MPEP 2106.05(f) and MPEP 2106.05(d).
As to claim 6, the rejection of claim 4 is incorporated, the claim(s) recited(s) the additional limitations – “The method of , wherein the input prompt received from the internal Al application is tracked and recorded such that a check is imposed in parallel with the tracking and recording of the prompt”. The step of – “a check is imposed in parallel with the tracking and recording of the prompt” recite the functions of imposing a check which is reasonably directed to mental processes, observations, evaluations, judgements and opinions. See MPEP 2106.04(a).
The claim recites additional elements – “input prompt” and “internal AI application” which is generic mere structures to apply the abstract idea on a device or merely use a device as a tool to perform the abstract idea. See MPEP 2106.06(f). The claim further recites the step of – “wherein the input prompt received from the internal Al application is tracked and recorded” which is mere data gathering, record-keeping, storing and mere instructions to apply using internal AI application as a tool, and which is insignificant extra solution activity to the judicial exception. See MPEP 2106.05(g). Accordingly, these do not integrate the abstract idea into a practical application because they do not impose meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. See MPEP 2106.04(d).
The identified additional elements, whether considered individually and in a combination, further do not amount to significantly more than the judicial exception because the elements merely apply the abstract idea or are WURC to be implemented on a generic computer and therefore the identified claim does not amount to significantly more. See MPEP 2106.05(f) and MPEP 2106.05(d).
As to claim 7, the rejection of claim 4 is incorporated, the claim(s) recited(s) the additional limitations – “The method of claim 4 wherein checking the input prompt comprises a rule based check and a guardrails check, wherein the rule based check and the guardrails check comprises comparing the input prompt to a set of rules defined in the code tracking database”.
The steps of – “checking the input prompt comprises a rule based check and a guardrails check, wherein the rule based check and the guardrails check comprises comparing the input prompt to a set of rules defined in the code tracking database” recite the functions of checking and comparing which are reasonably directed to mental processes, observations, evaluations, judgements and opinions. See MPEP 2106.04(a).
The claim recites additional elements – “input prompt” and “set of rules defined in the code tracking database” which is generic mere structures to apply the abstract idea on a device or merely use a device as a tool to perform the abstract idea. See MPEP 2106.06(f). Accordingly, these do not integrate the abstract idea into a practical application because they do not impose meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea. See MPEP 2106.04(d).
The identified additional elements, whether considered individually and in a combination, further do not amount to significantly more than the judicial exception because the elements merely apply the abstract idea or are WURC to be implemented on a generic computer and therefore the identified claim does not amount to significantly more. See MPEP 2106.05(f) and MPEP 2106.05(d).
As to claims 8-14, reference is made to a system that corresponds to claimed method discussed above (see above on how limitations are treated for claims 1-7 respectively), wherein all claim limitations also have been addressed and/or covered in cited areas as set forth above. Thus, accordingly, these claims are also obvious.
As to claims 15-20, reference is made to a computer-readable medium that corresponds to claimed method discussed above (see above on how limitations are treated for claim 1-6 respectively), wherein all claim limitations also have been addressed and/or covered in cited areas as set forth above. Thus, accordingly, these claims are also obvious.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 4-7, 8, 11-14, 15, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over O’Neal (US Publication US 2024/0394404 A1) in view of Cappel (US Patent US 11,995,180 B1), further in view of Luitjens (US Publication US 2024/0346162 A1), and further in view of Lin (US Publication US 2024/0427566 A1).
As to claim 1, O’Neal teaches A method comprising: receiving, at an Al system, an input prompt; ([0004] the method can include receiving by a control platform, a user data prompt or query directed to at least one AI system); detecting confidential content in the input prompt; ([0004] “The security and control platform may execute or run a security control protocol on the user data prompt. This can for example include scanning for sensitive information/data that should not be part of the prompt and should not be publicly disclosed); modifying the input prompt to the Al system after redacting the confidential content; ([0004] based on this security protocol and/or results of its execution, the security and control platform can then generate an approved prompt, e.g., that has no sensitive or confidential information, that may then be provided, sent, or communicated to the AI system, [0063] The data protection module 817 can also implement data filtering, blocking, masking, anonymization, and replacing of sensitive or private data with non-sensitive data. These protective actions can be undertaken by the data protection module 817 based on … set by the various other modules and their configured rules and settings.).
O’Neal does not teach upon determining the input prompt does not surpass a threshold value for an acceptable amount of confidential content, redacting the confidential content found in the input prompt.
However, in analogous art, Cappel (Col. 12, Lines 1-17: FIG. 13 is a diagram 1300 in which, at 1310, an output of a GenAI model is received. The output can be received, for example, by … analysis engine ... A determination is made, at 1320, whether the output indicates that the corresponding prompt was malicious … based on a similarity analysis between a blocklist and the received data. The determination can be made by one or more of analysis engine … The malicious prompts are known to result in undesired behavior by the GenAI model such as information leakage, bypassing of security measures, generation or consumption of malicious content, etc. Col.11, Lines 20-29: matches would have to be of a certain similarity threshold in order to be deemed malicious or otherwise problematic. Col. 12, Lines 28-38: …One or more of analysis engine 152 and analysis engine 170 can receive an analyze the output. It is then determined, at 1420, whether the output indicates comprises sensitive information based on a similarity analysis between a blocklist and the received data. Col.12, 39-46: … In some cases, the consuming application or process modifies the output to remove, redact, or transform the some portion of the sensitive information upon a determination that the output contains sensitive information).
O’Neal teaches different data protection module actions on prompts based on the detection of sensitive or confidential content and configured rules and settings as mentioned above. Cappel teaches a threshold-based determination if the sensitive or confidential content in the prompt exceeds a certain threshold of similarity, and upon determination redacting the sensitive or malicious content. Cappel establishes the use of a threshold which can be applied to O’Neal to determine when to apply the different data protection module actions of O’Neal (e.g. redact vs. filter vs. block).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine O’Neal with a threshold-based determination for an acceptable amount of confidential content as taught by Cappel. And to base the data protection module actions of O’Neal accordingly to redact the prompt if it is less than an acceptable amount of confidential content.
A person having ordinary skill in the art would have been motivated to make this combination with a reasonable expectation of success, to modify the input prompt containing sensitive or confidential information according to a threshold-based determination in order to save computing resources when the input prompt exceeds a % of similarity for confidential content (Cappel, Col.1, Lines 57-60).
O’Neal-Cappel does not teach modify the input prompt to ensure the input prompt is understandable to the AI system.
However, in analogous art, Luitjens teaches redacting the confidential content found in the input prompt, modifying the input prompt to ensure the input prompt is understandable to the Al system after redacting the confidential content; ([0006] For each data element, the proxy service may generate a mapping between the original value of the data element and a placeholder element (e.g., "Adam" and "[Person_00l]"). The proxy service may replace the original data element with the placeholder element in the prompt, [0007] … the computing device may send the modified prompt to the server hosting the generative AI model. The server may process the modified prompt by tokenizing each data element).
O’Neal-Cappel and Luitjens teachings are both motivated to protect against data leakage through prompts and reduce the security vulnerabilities that may be caused due to the passage of sensitive or confidential information in input prompts to AI systems. O’Neal-Cappel teaches a secure control platform, which upon detecting sensitive or confidential content in a prompt, teaches in [0110] the generation of an approved redacted prompt to comprise of least one of masking, blocking, and/or replacing a portion of the content. Luitjens does not explicitly teach the term “understandable to the AI system” but teaches in [0085] the replacement of sensitive or confidential data elements with suitable replacement values. Examiner interprets this Luitjens 162 redaction, using suitable replacement technique, to produce a modified input prompt capable of meeting the criteria “to be understandable to the AI system” as it preserves the integrity of the structure/syntax in the modified prompt
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine O’Neal-Cappel prompt-security system which regulates the content of user-AI interactions with Luitjens prompt de-identification through suitable replacement of sensitive or confidential data in an input prompt to ensure the prompt is understandable to the AI system.
A person having ordinary skill in the art would have been motivated to make this combination with a reasonable expectation of success, to reduce the security vulnerabilities which may stem from the data leakage of sensitive or confidential information on the part of a user or system (Luitjens, [0004]).
O’Neal-Cappel-Luitjens does not teach input prompt instructing an Al model to generate code; generating code using the Al system based on the prompt; and logging the generated code from the Al model in an updateable code tracking database.
However, in analogous art, Lin teaches (Abstract, by constructing a prompt to a machine learning model to obtain new source code as an output, writing the new source code to the code repository. [0063] … code generation system in many embodiments of the invention can create a machine learning prompt. [0005] … by constructing a prompt to a machine learning model to obtain new source code as an output, writing the new source code to the code repository, [0051] The prompt module 312 can generate prompts to the LLM models for generating code according to the project information. It may take the general task specified in project information as a base prompt and utilize RAG to incorporate intervention information and/or additional project information (e.g., location and structure of code, etc. [0077] … Source code produced by providing the prompt to an LLM can be written 610 to the code repository).
O’Neal-Cappel-Luitjens teaches submitting the modified and understandable input prompt to an AI system to obtain AI-generated content, while Lin teaches submitting an input prompt to machine learning models to obtain AI-generated code and log the AI-generated code in a code repository.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine O’Neal-Cappel-Luitjens with the teachings of Lin about AI system(s) using machine learning models for code generation.
A person having ordinary skill in the art would have been motivated to make this combination with a reasonable expectation of success, considering the benefit using generative artificial intelligence (AI), in particular large language models (LLMs), “to perform complex software development tasks given the parameters of the task and a database of source code to work with” (Lin, [0032]).
As to claim 4, O’Neal further teaches the input prompt is received from a third party Al application or an internal Al application; ([0063] Data may be protected via a data protection module 817 which undertakes live monitoring and analysis of inputs/prompts of users 801, 807 and/or the AI system 806 outputs, and detects private or sensitive information. [0025] … these AI-enabled systems, AI models, third party AI services and chatbots are collectively and interchangeably referred to herein as "AI system(s)"). (EN: Moreover, the secure layer of O’Neal is shown as receiving - by a message broker of a control platform - a user input (Ref. 1002 in Fig. 10) originating from 3rd party AI systems (Ref. 706 and 806 in Fig. 7 and Fig. 8 respectively) as well as originating from internal AI APIs (Ref. 704 and 804 in Fig. 7 and Fig. 8 respectively). Thus, accordingly, this claim is obvious.
As to claim 5, O’Neal further teaches the input prompt received from the third party application is intercepted after being received by the Al system, and a check is imposed on the intercepted input prompt; ([0063] Data may be protected via a data protection module 817 which undertakes live monitoring and analysis of inputs/prompts of users 801, 807 and/or the AI system 806 outputs, and detects private or sensitive information. [0025] … these AI-enabled systems, AI models, third party AI services and chatbots are collectively and interchangeably referred to herein as "AI system(s)". [0080] The running of the internal AI model(s) … can include dynamically classifying the user data prompt, and checking/validating the user prompt against policies or personas as implemented by other modules such as the security module 811 and or the control module 812, and can include assuring quality of the results of other modules such as the data protection module 817). Thus, accordingly, this claim is obvious.
As to claim 6, the rejection of claim 4 is incorporated, O’Neal further teaches wherein the input prompt received from the internal Al application is tracked and recorded such that a check is imposed in parallel with the tracking and recording of the prompt; ([0080] The running of the internal AI model(s) 821-823, can include dynamically classifying the user data prompt, and checking/validating the user prompt against policies or personas as implemented by other modules such as the security module. (EN: The logging and checking/validating of the input prompt are performed together and Examiner interprets that as a in parallel).
As to claim 7, O’Neal’s teaching regarding the checking input prompt is already incorporated from claim 1, O’Neal further teaches checking the input prompt comprises a rule based check and a guardrails check, wherein the rule based check and the guardrails check comprises comparing the input prompt to a set of rules defined in the code tracking database; ([0065] The control AI model 821 may use specific workflows and parameters to validate input and/or output data by using pattern detection, keyword search, and cross engine validation via profiles set by other modules. These parameters are configurable to include data protection, compliance, and IT security checks as well. [0074] The dynamic profiles utilize the data around how the user interacts with the platform (e.g., prompt intent, types of files uploaded, other profile details) to decide which recommendations and notifications to surface. [0075] The control platform provides various security functionalities (e.g., deny, lists, allow lists, keyword filters), as well as more advanced features for flagged AI systems. For example, the control platform may flag and notify users of types of content generated by an AI system as determined by the profiles. [0079] Method 1000 then proceeds to executing 1004, by a secure layer 803 of the control platform, a security control protocol on the user data prompt. For example, the security module 811 may apply profiles or rules on the user 801, 807 which are then applied to the user data prompt received by the message broker 810… Likewise, the controls module 812 may set any policies or regulatory frameworks relevant to the user role, persona, group or profile or policies relevant to the enterprise/organization. These profiles or settings may be applied by the controls module 812 or by another module such as the data protection module 817, [0063] The control platform 800 may also include a support module 815 which comprises administrator tools, a knowledge base, and best practices policies. [0067] … it can use the knowledge base to know if the user query/input/prompt contains secrets/sensitive information and filter the user prompt before it gets to the AI systems 806. This model interfaces directly with the controls module 812 to inform profiles, roles, or personas. See also O’Neal [0060] and [0061]). (EN: O’Neal as mentioned above O’Neal teaches checking for syntax (e.g. keywords) and semantic (e.g. for user intent). Examiner interprets the further teaching of the knowledge base, mentioned above and taught by O’Neal, as a repository that can be in the code tracking database).
As to claims 8 and 11-14, these are the system version of the claimed method discussed above (see above on how limitations are treated for claims 1, 4-7 respectively) wherein all claim limitations also have been addressed and/or covered in cited areas as set forth above. Thus, accordingly, these claims are also obvious.
As to claims 15 and 18-20, these are the computer-readable medium version of the claimed method discussed above (see above on how limitations are treated for claims 1, 4-6 respectively) wherein all claim limitations also have been addressed and/or covered in cited areas as set forth above. Thus, accordingly, these claims are also obvious.
Claims 2, 9 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over O’Neal (US Publication US 2024/0394404 A1) in view of Cappel (US Patent US 11,995,180 B1), further in view of Luitjens (US Publication US 2024/0346162 A1), further in view of Lin (US Publication US 2024/0427566 A1), further in view of Weinstein (US Publication US 2025/0286872 A1), and further in view of Toub (US Publication 2014/0173561 A1).
As to claim 2, the incorporation of claim 1 is incorporated, O’Neal-Cappel-Luitjens-Lin does not teach receiving, at the Al system, a code submission; checking whether or not the code contains Al generated portions.
However, in analogous art, Weinstein ([0015] An organization may want to identify proprietary information contained … such as to identify contributions of a machine-learning (ML) model (e.g., ML-generated source code). [0017] … protecting intellectual property through the use of digital signatures includes generating a database of digital signatures of posts/outputs of a ML model (e.g., an internal/proprietary ML model and/or an external/public ML model), generating a digital signature of source code submitted … and comparing it to the database of digital signatures to quickly and efficiently identify source code that contains or likely contains posts of the ML model, and selectively performing one or more actions based on the comparison. [0019] As disclosed herein, digital signatures may be computed based on portions (i.e., snippets) of file contents, descriptors of files and/or file directory structures, and/or metadata, at one or more configurable/selectable levels of granularity (e.g., based on configurable policies), [0025] Computing platform 100 may further include a signature database 112 that stores digital signatures 104, a user interface (UI) 114 that receives user content 110 from a user, and/or a policy manager 122 that manages policies 124, 126, and 128 for signature generator 102, signature matching engine 116, and action tool 120, respectively. [0030] Signature generator 102 may generate multiple digital signatures 104 for a unit of reference content 106, at multiple respective levels of granularity. Signature generator 102 may, for example, construct multiple strings for a unit of reference content 106, where a first string (i.e., a least granular string) includes relatively few features (e.g., relatively few and/or relatively short snippets, and/or relatively little/few metadata/descriptors. Signature generator 102 may generate a digital signature 104 for each string. Levels of granularity may be configurable ... Levels of granularity may be configured/selected to control accuracy versus efficiency. [0031] Signature generator 102 may compute one or more types of digital signatures based on one or more encoding schemes, such as a cyclic redundancy check (CRC) code, and/or a hash function. At 204, signature generator 102 generates digital signature(s) 108 of user content 110, such as described above with respect to digital signatures 104. In one embodiment, the digital signature generation method for user content 110 is the same as the digital signature generation method for reference content 106. [0034] At 206, signature matching engine 116 compares digital signature 108 of user content 110 to digital signatures 104 of reference content 106 to identify digital signatures 104 that match digital signature(s) 108 (i.e., matching digital signatures) See also [0029], [0035]-[0037]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine O’Neal-Cappel-Luitjens-Lin with the proprietary content protection system as taught by Weinstein.
A person having ordinary skill in the art would have been motivated to make this combination, with a reasonable expectation of success, to protect intellectual property contributions, such as contributions of machine-learning models, through the use of digital signatures (Weinstein, [0013]).
O’Neal-Cappel-Luitjens-Lin-Weinstein does not teach updating the code tracking database with data indicating the Al generated and non Al generated portions of the code submission.
However, in analogous art, Toub teaches ([0049] metadata file 304 may include a mapping between various source code entities of source code file 302 … and metadata concerning such entities that is stored within metadata file 304. Such a mapping may enable external entities to locate within metadata file 304 metadata about a particular source code entity that exists within source code file 302. For example, metadata file 304 may include one or more entries, wherein each entry comprises an identification of a particular entity that exists within source code file 302 and metadata concerning the identified entity. In one example implementation, each entry may identify a region within source code file 302 at which a source code entity is located (e.g., by specifying a start line number, a start character number, an end line number, and an end character number, or in some other manner) and metadata associated with the source code entity located at that region. However, this is only one example, and persons skilled in the relevant art( s) will readily appreciate that a variety of different methods may be used to map between source code entities and metadata associated therewith. [0053] In addition to storing metadata 122 in association with source code 120, metadata manager 124 may also be configured to create, update or delete metadata 122. Such operations may be performed based on certain actions taken by a developer with respect to source code 120. For example, metadata manager 124 may create and store metadata in association with a particular source code file when a developer first checks the particular source code file into repository 106. Metadata manager 124 may also update such file-level metadata whenever the particular source code file is subsequently checked out or checked back in to repository 106. Such file-level metadata may include, for example, historical information relating to the creation and updating of the source code file. Metadata manager 124 may also be configured to create, update or delete metadata associated with source code entities that are more granular than files, such as classes, functions, lines, statements, expressions, or other entities. [0064] metadata manager 408 may create metadata that links the copied source code entity in source code file 704 to code store 702 from which it originated… Such linking may enable tracking of source code entities originating from a particular code store).
O’Neal-Cappel-Luitjens-Lin-Weinstein teach receiving the code submission and identifying the AI-generated code portions (contributions of a machine learning (ML) model) from the non-AI-generated code portions through the digital fingerprint mechanism taught by Weinstein mentioned above. Toub teaches attaching/saving metadata to source code at a configurable granular level (file, function, class, etc.) and that such metadata can provide history about the creation of the code among many other metadata. It also teaches about creating the metadata when a code is first created and then updating the metadata on new code submission (like when a developer checks in code). History of creation of code can be understood to encompass code provenance, i.e. whether it is created by AI or not. O’Neal-Cappel-Luitjens-Lin-Weinstein and Toub are in analogous art.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine O’Neal-Cappel-Luitjens-Lin-Weinstein with the source code metadata logging functionality as taught by Toub and employ it to log AI-provenance metadata for AI-generated code, when code has been matched to code-tracking database, and for non-AI-generated, otherwise.
A person having ordinary skill in the art would have been motivated to make this combination, with a reasonable expectation of success, to enable metadata to be accessed independently of the source code with which it is associated (Toub, [0005]).
As to claims 9 and 16, these are the system and computer-readable medium version of the claimed method discussed above (see above on how limitations are treated for claim 2) wherein all claim limitations also have been addressed and/or covered in cited areas as set forth above. Thus, accordingly, these claims are also obvious.
Claims 3, 10, and 17 are rejected under 35 U.S.C. 103 as being unpatentable over O’Neal (US Publication US 2024/0394404 A1) in view of Cappel (US Patent US 11,995,180 B1), further in view of Luitjens (US Publication US 2024/0346162 A1), further in view of Lin (US Publication US 2024/0427566 A1), and further in view of Weinstein (US Publication US 2025/0286872 A1).
As to claim 3, the rejection of claim 1 is incorporated, O’Neal-Cappel-Luitjens-Lin does not teach receiving, at the Al system, a code submission; manually auditing the code submission by comparing the code submission to existing code in the updatable code tracking database; and determining whether or not portions of the code submission are Al generated based on the comparison.
However, in analogous art, Weinstein ([0015] An organization may want to identify proprietary information contained … such as to identify contributions of a machine-learning (ML) model (e.g., ML-generated source code), [0017] … protecting intellectual property through the use of digital signatures includes generating a database of digital signatures of posts/outputs of a ML model (e.g., an internal/proprietary ML model and/or an external/public ML model), generating a digital signature of source code submitted … and comparing it to the database of digital signatures to quickly and efficiently identify source code that contains or likely contains posts of the ML model, and selectively performing one or more actions based on the comparison. Actions may
include, without limitation, initiating an audit of the source code and/or alerting a user that the source code contains or likely contains posts of the ML model, [0025] Computing platform 100 may further include a signature database 112 that stores digital signatures 104, a user interface (UI) 114 that receives user content 110 from a user, and/or a policy manager 122 that manages policies 124, 126, and 128 for signature generator 102, signature matching engine 116, and action tool 120, respectively).
(EN: Examiner interprets the fact of presence of a user interface UI to allow for user to submit content (code submission) and allows for interaction with the user alerting the user about the presence of AI-generated code – in the context of the instant application - can be understood to satisfy the “manually auditing” since the claim did not otherwise provide specific manual audit/comparison algorithm/steps).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine O’Neal-Cappel-Luitjens-Lin with the proprietary content protection system as taught by Weinstein.
A person having ordinary skill in the art would have been motivated to make this combination, with a reasonable expectation of success, to protect intellectual property contributions, such as contributions of machine-learning models, using digital signatures (Weinstein, [0013]).
As to claims 10 and 17, these are the system and computer-readable medium version of the claimed method discussed above (see above on how limitations are treated for claim 3) wherein all claim limitations also have been addressed and/or covered in cited areas as set forth above. Thus, accordingly, these claims are also obvious.
Conclusion
The prior art made of record and not relied upon is considered pertinent to
applicant's disclosure:
Gousios (US Patent US-12430446-B1) related to a software composition analysis tool to find code copied from third-party libraries.
Werner (US Publication US-20200314068-A1) related to building and continuously updating a classified token database from trained confidential content.
Any inquiry concerning this communication or earlier communications from the Examiner should be directed to CHRISTIANE SHOUSHA whose telephone number is 571-270-7569. The Examiner can normally be reached Monday - Thursday (8:00 am - 5:00 pm).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, LEWIS BULLOCK JR. can be reached at 571-272-3759. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/C.S./Examiner, Art Unit 2199
/LEWIS A BULLOCK JR/Supervisory Patent Examiner, Art Unit 2199
Prosecution Insights