Detailed Action
This is a Final Office action in response to communications received on 8/17/2026. Claims 1-11 were amended. Claims 1-11 are pending and are examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s amendments, filed 8/17/2026, to claim(s) 3 and 8 correcting the claim to omit capitalized “If” and mid-claim period is sufficient to overcome the objection to the aforementioned claim. Accordingly, the objection to claim(s) 3 and 8 as filed in 4 of the Non-Final Office action filed 5/15/2026 is withdrawn.
Applicant’s amendments, filed 8/17/2026, to claim(s) 1 correcting the claim to remove terms having antecedent basis issues and “too high” language are sufficient to overcome the rejection to the aforementioned claim(s). Accordingly, the rejection of claim(s) 1-11 under 112, second paragraph, as filed in (10) and (11) of the Non-Final Office action filed 5/15/2026 is withdrawn.
Applicant’s amendments, filed 8/17/2026, to claim(s) 11 correcting the claim to omit placeholder language are sufficient to overcome the interpretation under 112f and associated 112b rejection to the aforementioned claim(s). Accordingly, the rejection of claim(s) 11 under 112, second paragraph, as filed in (13) of the Non-Final Office action filed 5/15/2026 is withdrawn.
Applicant’s arguments regarding the rejection under 35 U.S.C. 102 of the claims under Majmudar (US 12292915 B1) have been considered, and are found unpersuasive.
Applicant argues on page(s) 7-9 of the Remarks, filed 8/17/2026, the cited prior art fail to teach or suggest “calculating a trust score of the trusted part with respect to the model output using an input feature saliency method which determines an influence of tokens on the model output, the trust score being calculated from saliency values between the tokens of the trusted part and tokens of the model output” because “Majmudar's "trust score," by contrast, is generated by a classifier based on the source and content of a span. (See Majmudar, claims 1-2; col. 4, lines 16-25.) Majmudar's "trust score" is not a saliency measure of the trusted part's influence on the model output, and it is not calculated from saliency values between trusted-part tokens and model-output tokens”. However, Examiner respectfully disagrees. Majmudar explicitly states that a span corresponds to a portion of the prompt, and that a trust score and attention score is generated for the given span. These values are both used to generate a risk score, which corresponds to the claimed trust score. The attention values are explicitly defined as “a mathematical representation of the amount of attention (or weight) that the inference engine 106 paid to a respective span in order to generate the inference output” which correspond to the claimed saliency values, which, for example, in claim 2, are defined as attention values. Therefore, the limitations of the claim are taught sufficiently by Majmudar. Additionally, the teaching of a risk score exceeding a threshold is analogous to a trust score being below a threshold. As the risk score is inversely proportional to a level of trust, exceeding or being below a threshold would merely amount to a design choice and does not impact the operability or effect of the invention. Additionally, the risk score of a span would necessarily be comprised of the attention scores of the tokens that comprise the span, as it is explicitly taught that the spans are decomposed into tokens for analysis and the span is not simply limited to a single token.
The remaining arguments fail to comply with 37 C.F.R. 1.111(b) because they amount to a general allegation that the claims define a patentable invention without specifically pointing out how the language of the claims patentably distinguishes them from the references.
Consequently, the rejection of the claims under 35 U.S.C. 102 is sustained.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 1-11 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Regarding claims 3 and 8, the claims recites “the run variables of the sums”. There is insufficient antecedent basis for these terms in the claims.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1-11 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Majmudar (US 12292915 B1).
Regarding claim 1, Majmudar teaches the limitations of claim 1 substantially as follows:
Method for recognizing manipulation attacks in the form of prompt injections on large-language model-integrated applications which generate a prompt in order to pass it as input to the LLM, which generates a model output based on the prompt, (Majmudar; Col. 4, lines 16-18: systems and techniques evaluate language model (LM) prompts for potential security issues using attention-based analysis)
the prompt consisting of a trusted part which contains the instructions defined by the LLM-integrated application, over which an attacker by definition has no influence, and the prompt consisting of an untrusted part which comprises the data to be processed, over which the attacker by definition has full control, (Majmudar; Col. 4, lines 18-25: LM and/or LLM prompts may be constructed from not only the user input request (sometimes referred to as a query) (i.e., untrusted part), but also from pre-constructed prompt text, user knowledge/preferences, past interaction history, run-time information retrieved from back-end APIs (such as information retrieved from websites, a local restaurant search API, etc.) and/or other context (i.e., trusted part))
characterized in that a prompt injection is present if the trusted score of the trusted part is too high, (Majmudar; Col. 10, lines 30-36: if a first span has a trust score of 0.2 (indicating relatively low trust) and a high attention score of 0.77, the risk score may be (1/0.2)*0.77=3.85. This may be compared to a set of one or more thresholds to determine an action plan. For example, risk scores higher than 1.5 (i.e., too high) may be associated with a disengagement/termination action plan)
the untrusted part comprising the data to be processed, over which the attacker by definition has full control, characterized in that a prompt injection is present if the trusted score of the trusted part on the model output is below a threshold, (Majmudar; Col. 10, lines 30-36: if a first span has a trust score of 0.2 (indicating relatively low trust) (i.e., below a threshold) and a high attention score of 0.77, the risk score may be (1/0.2)*0.77=3.85. This may be compared to a set of one or more thresholds to determine an action plan. For example, risk scores higher than 1.5 may be associated with a disengagement/termination action plan)
the trust score of the trusted part for the model output being calculated using a method which determines the influence of a token on the model output, (Majmudar; Col. 10, lines 30-36: if a first span has a trust score of 0.2 (indicating relatively low trust) and a high attention score of 0.77, the risk score may be (1/0.2)*0.77=3.85. This may be compared to a set of one or more thresholds to determine an action plan. For example, risk scores higher than 1.5 may be associated with a disengagement/termination action plan (i.e., determines the influence of a token on the model output))
the prompt being broken down by a tokenizer into tokens which can be words, parts of words, letters or characters. (Majmudar; Col. 6, lines 56-59: The encoder network of a transformer comprises a set of encoding layers that processes the input data one layer after another. Each encoder layer generates encodings (referred to herein as “tokens”))
Regarding claim 2, Majmudar teaches the limitations of claim 1.
Majmudar teaches the limitations of claim 2 as follows:
The method according to the preceding claim 1, wherein the method that determines the influence of a token on the model output, an input feature saliency method is used. (Majmudar; Col. 10, lines 3-11: The attention component 152 may be implemented in a variety of ways, some of which include perturbation-based methods such as local interpretable model-agnostic explanations (“LIME”) and Shapley additive explanations (“SHAP”), gradient-based methods such as AllenNLP, attention-based methods such as employing multi-head attention units (such as those described above), and LLM-based methods used to explain activation scores for neurons in language models)
Regarding claim 3, Majmudar teaches the limitations of claim 2.
Majmudar teaches the limitations of claim 3 as follows:
The method according to the preceding claim 2, wherein be S.sub.t the trusted part of the prompt, S.sub.g the model output, S.sub.t the number of tokens in a text S, L the layers of the LLM to be taken into account, H the attention heads of the LLM to be taken into account and A the attention values generated during the generation of S.sub.g generated attention values, then the trust score is (See equation in claim 3) If score (S.sub.t, S.sub.g)≤threshold then there is a prompt injection. (Majmudar; Col. 10, lines 54-63: depending on the implementation, higher scores output by classifier 150 may indicate lower trust and lower scores may indicate higher trust. Additionally, higher attention scores output by attention component 152 may represent lower attention during inference and lower attention scores may represent higher attention. Accordingly, the foregoing example is merely meant to be illustrative and the particular logic used to determine whether a span is risky based on trust scores and attention scores may vary according to the desired implementation)
Regarding claim 4, Majmudar teaches the limitations of claim 3.
Majmudar teaches the limitations of claim 4 as follows:
The method according to the preceding claim 3, wherein the LLM is based on a transformer architecture that uses a self-attention mechanism in which relationships between tokens are mapped, preferably using a multi-head attention in which one attention value is calculated per token pair and layer for each attention head. (Majmudar; Col. 10, lines 3-11: The attention component 152 may be implemented in a variety of ways, some of which include perturbation-based methods such as local interpretable model-agnostic explanations (“LIME”) and Shapley additive explanations (“SHAP”), gradient-based methods such as AllenNLP, attention-based methods such as employing multi-head attention units (such as those described above), and LLM-based methods used to explain activation scores for neurons in language models (i.e., using a multi-head attention in which one attention value is calculated per token pair and layer for each attention head))
Regarding claim 5, Majmudar teaches the limitations of claim 4.
Majmudar teaches the limitations of claim 5 as follows:
The method according to the preceding claim 4, wherein a classifier based on a neural network, which receives the attention values as input, outputs the confidence that a prompt injection is present. (Majmudar; Col. 10, lines 12-14: For a given span in the prompt, the prompt validation component 148 determine both a trust score (using classifier 150) and an attention score (using attention component 152))
Regarding claim 6, Majmudar teaches the limitations of claim 5.
Majmudar teaches the limitations of claim 6 as follows:
The method according to the preceding claim 5, wherein the attention values are generated by a local LLM, the local LLM can be significantly smaller than the LLM which generates the model output, since even small models are able to determine by means of the attention method whether an already given model output has been forced by a prompt injection or not, wherein the prompt as well as the model output are inputs for a small local LLM which calculates the attention values. (Majmudar; Col. 10, lines 10-11: LLM-based methods used to explain activation scores for neurons in language models)
Regarding claim 7, Majmudar teaches the limitations of claim 2.
Majmudar teaches the limitations of claim 7 as follows:
The method according to the preceding claim 2, wherein SHAP or LIME is used as the input feature saliency method. (Majmudar; Col. 10, lines 3-11: The attention component 152 may be implemented in a variety of ways, some of which include perturbation-based methods such as local interpretable model-agnostic explanations (“LIME”) and Shapley additive explanations (“SHAP”), gradient-based methods such as AllenNLP, attention-based methods such as employing multi-head attention units (such as those described above), and LLM-based methods used to explain activation scores for neurons in language models)
Regarding claim 8, Majmudar teaches the limitations of claim 7.
Majmudar teaches the limitations of claim 8 as follows:
The method according to the preceding claim 7, be S.sub.t the trusted part of the prompt, S.sub.g the model output, |S| the number of tokens in a text. Let furthermore be SHAP is the matrix of SHAP values for the prompt with attached generated output text, then the trust score is (See equation in claim 8) If score (S.sub.t, S.sub.g)≤threshold then there is a prompt injection, where w.sub.t and w.sub.g are the run variables of the sums, the sums iterate over each token of trusted part and model output. (Majmudar; Col. 10, lines 3-11: The attention component 152 may be implemented in a variety of ways, some of which include perturbation-based methods such as local interpretable model-agnostic explanations (“LIME”) and Shapley additive explanations (“SHAP”) (i.e., iterative), gradient-based methods such as AllenNLP, attention-based methods such as employing multi-head attention units (such as those described above), and LLM-based methods used to explain activation scores for neurons in language models)
Regarding claim 9, Majmudar teaches the limitations of claim 1.
Majmudar teaches the limitations of claim 9 as follows:
The method according to the preceding claim 1, wherein an adjustment of the threshold is made to influence the false positive and false negative rate of the method, wherein preferably in an application scenario requiring a lower false negative rate at the expense of a higher false positive rate, the threshold must be increased. (Majmudar; Col. 10, lines 54-63: depending on the implementation, higher scores output by classifier 150 may indicate lower trust and lower scores may indicate higher trust. Additionally, higher attention scores output by attention component 152 may represent lower attention during inference and lower attention scores may represent higher attention. Accordingly, the foregoing example is merely meant to be illustrative and the particular logic used to determine whether a span is risky based on trust scores and attention scores may vary according to the desired implementation (i..e., adjustable threshold))
Regarding claim 10, Majmudar teaches the limitations of claim 1.
Majmudar teaches the limitations of claim 10 as follows:
The method according to preceding claim 1, wherein the trusted part corresponds to the system prompts and/or the untrusted part corresponds to the user prompts. (Majmudar; Col. 4, lines 18-25: LM and/or LLM prompts may be constructed from not only the user input request (sometimes referred to as a query) (i.e., untrusted user prompts), but also from pre-constructed prompt text, user knowledge/preferences, past interaction history, run-time information retrieved from back-end APIs (such as information retrieved from websites, a local restaurant search API, etc.) and/or other context (i.e., system prompts))
Regarding claim 11, Majmudar teaches the limitations of claim 1.
Majmudar teaches the limitations of claim 11 as follows:
An apparatus characterized by a memory and a processing unit configured to run the method according to claim 1. (Majmudar; Col. 4, lines 16-18: systems and techniques evaluate language model (LM) prompts for potential security issues using attention-based analysis)
Prior Art Considered But Not Relied Upon
Vaknin (US 20250209208 A1) which teaches a device which may obtain a prompt for input to a language model. The device identifies a plurality of topics present in the prompt. The device determines that the prompt is malicious based on a variation in the plurality of topics.
Maddux (US 20250173438 A1) which teaches a computing system which provides an attention matrix to a trained neural network to determine a likelihood that a prompt is malicious. Responsive to determining that the prompt is likely a malicious prompt, the computing system initiates a remedial action.
Conclusion
For the above-stated reasons, claims 1-11 are rejected.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BLAKE ISAAC NARRAMORE whose telephone number is (303)297-4357. The examiner can normally be reached on Monday - Friday 0700-1700 MT.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi T Arani can be reached on (571) 272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BLAKE I NARRAMORE/Examiner, Art Unit 2438
