DETAILED ACTION
This is a non-final Office action in response to communications received on 7/08/2025. Claims 1-20 are pending and are examined. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Drawings
The drawings filed 7/08/2025 are acknowledged.
Foreign Priority or Provisional
Priority to 3/21/2025 is recognized.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or non-obviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Liu (2021/0110066) in view of Constable US 20240330466).
Regarding claim 1, Liu discloses the limitations substantially as follows:
A device for hardware assisted artificial intelligence (Al) model attestation, the device comprising:
an interface to communicate beyond a chiplet that includes the device (paras. [0034]: interface of client device for communicating beyond the AI chipset);
a memory to hold a local repository (para. [0057]: storing AI-models in DP accelerator); and
processing circuitry to:
obtain, via the interface, an Al model for execution on the chiplet (Liu, paras. [0015], [0018], [0025], [0034], [0058]: a DP accelerator with a chipset executes an AI model (i.e. executing the AI model on a chiplet) that it obtains from a host device);
derive a set of identifiers for the Al model (Liu, paras. [0017], [0037]: deriving a watermark to be used an identifier of an AI model comprising a subset of coefficients or parameters such as weights within the AI model);
communicate, via the interface, the set of identifiers to an attestation authority (paras. [0026], [0028], [0052], [0059]: communicating encrypted data to the host device including the AI model and watermark of the AI model);
receive a confirmation from the attestation authority that the Al model is authentic (paras. [0018]-[0019], [0064], [0077], [0111]: the host device validates the AI model and communicates with the DP accelerator to perform one or more operations using the now validated AI model, whereas additional calls for more operations are not made if the validation was unsuccessful); and
register the Al model in the local repository (Liu, paras. [0057], Fig. 2B: storing AI models in memory of the DP accelerator).
Liu does not explicitly disclose the remaining limitations of claim 1 as follows:
search the local repository to determine that the Al model is not registered with the chiplet;
register the Al model in the local repository based on the confirmation.
However, in the same field of endeavor, Constable discloses the limitations of claim 1 as follows:
search the local repository to determine that the Al model is not registered with the chiplet (paras. [0029], [0082], [0096]-[0097], [0122]: initialization circuitry uploads a received SWF and AI runtime for a runtime model that is only stored in the temporary memory of the integrated circuits until verified (i.e. not yet registered));
receive a confirmation from the attestation authority that the Al model is authentic (paras. [0098]: TEE informs client device that model has been flagged as invalid);
register the Al model in the local repository based on the confirmation (paras. [0097]-[0098]: a model that is flagged as invalid is discarded and not stored in long-term memory whereas a model that is valid is stored/registered).
Liu and Constable are both from the same field of endeavor verifying the integrity of AI-models. It would have been obvious to one of ordinary skill before the effective filing data of the invention to integrate Constable’s method of only storing validated AI-based models with the system of Liu in order to save resources and time by only validating AI-models that need to be validated and only storing AI-models that have been validated.
Regarding claims 2 and 12, Liu and Constable teach the limitations of the device of claim 1 and the non-transitory machine readable media of claim 11.
Liu teaches the limitations of claims 2 and 12 as follows:
wherein the processing circuitry is to obtain communication parameters for the attestation authority from a chiplet assembly controller for a chiplet assembly to which the chiplet belongs (Liu, paras [0026], [0045]: obtaining keys for communicating encrypted AI model data to the host device from a TPM secure boot and root key of the chipset).
Regarding claims 3 and 13, Liu and Constable teach the limitations of the device of claims 1-2 and the non-transitory machine readable media of claims 11-12.
Liu teaches the limitations of claims 3 and 13 as follows:
wherein the communication parameters for the attestation authority are retrieved as part of a boot sequence for the chiplet (Liu, paras [0026]: obtaining keys for communicating encrypted AI model data to the host device from a root key of the chipset).
Regarding claims 4 and 14, Liu and Constable teach the limitations of the device of claim 1 and the non-transitory machine readable media of claim 11.
Liu teaches the limitations of claims 4 and 14 as follows:
wherein the set of identifiers includes a model identifier, a version, or a producer of the Al model (Liu, paras. [0020], [0022]: parameters of the watermark identify the AI-model and can include a signature kernel which identifies the watermark (i.e. model identifier)).
Regarding claims 5 and 15, Liu and Constable teach the limitations of the device of claim 1 and the non-transitory machine readable media of claim 11.
Liu teaches the limitations of claims 5 and 15 as follows:
wherein the set of identifiers includes a hash of a portion of the Al model (Liu, paras. [0022]: generating a hash of the input data to be signed including the AI model).
Regarding claims 6 and 16, Liu and Constable teach the limitations of the device of claim 1 and the non-transitory machine readable media of claim 11.
Liu teaches the limitations of claims 6 and 16 as follows:
wherein the set of identifiers includes a set of weights or parameters for neurons in the Al model (Liu, paras. [0017], [0020], [0024]: watermark includes parameters such as weights within the watermark of one or nodes of the AI model) (see also Constable, paras. [0054]: neurons).
Regarding claims 7 and 17, Liu and Constable teach the limitations of the device of claim 1 and the non-transitory machine readable media of claim 11.
Constable teaches the limitations of claims 7 and 17 as follows:
wherein the processing circuitry is to execute the Al model based on registering the Al model (paras. [0097]-[0098]: allowing the implementation of the AI model based on storing the model in long term memory (i.e. registering the AI model)).
The same motivation to combine utilized in claims 1 and 11 is equally applicable in the instant claim.
Regarding claims 8 and 18, Liu and Constable teach the limitations of the device of claim 1 and the non-transitory machine readable media of claim 11.
Liu teaches the limitations of claims 8 and 18 as follows:
wherein, to communicate the set of identifiers, the processing circuitry is to transmit a package to the attestation authority, the set of identifiers included in the package (Liu, paras. [0022], [0026], [0028]: communicating the set of parameters of the watermark to the host device in an encrypted and hashed form).
Regarding claims 9 and 19, Liu and Constable teach the limitations of the device of claims 1, 8 and the non-transitory machine readable media of claims 11, 18.
Liu teaches the limitations of claims 9 and 19 as follows:
wherein the package is encrypted (Liu, paras. [0022]: hashing the input data to be signed including the AI model and encrypting it with a private key).
Regarding claims 10 and 20, Liu and Constable teach the limitations of the device of claims 1, 8-9 and the non-transitory machine readable media of claims 11, 18-19.
Liu teaches the limitations of claims 10 and 20 as follows:
wherein the package is encrypted with a private key of the chiplet (Liu, paras. [0022]: hashing the input data to be signed including the AI model and encrypting it with a private key of the DPI accelerator comprising the chipset).
Regarding claim 11, Liu teaches the limitations substantially as follows:
A non-transitory machine readable media including instructions for hardware assisted artificial intelligence (Al) model attestation, the instructions, when executed by processing circuitry of a chiplet, cause the processing circuitry to perform operations comprising:
obtaining an Al model for execution on the chiplet(Liu, paras. [0015], [0018], [0025], [0034], [0058]: a DP accelerator with a chipset executes an AI model (i.e. executing the AI model on a chiplet) that it obtains from a host device);
deriving a set of identifiers for the Al model (Liu, paras. [0017], [0037]: deriving a watermark to be used an identifier of an AI model comprising a subset of coefficients or parameters such as weights within the AI model);
communicating, via the interface, the set of identifiers to an attestation authority (paras. [0026], [0028], [0052], [0059]: communicating encrypted data to the host device including the AI model and watermark of the AI model);
receiving a confirmation from the attestation authority that the Al model is authentic (paras. [0018]-[0019], [0064], [0077], [0111]: the host device validates the AI model and communicates with the DP accelerator to perform one or more operations using the now validated AI model, whereas additional calls for more operations are not made if the validation was unsuccessful); and
registering the Al model in the local repository (Liu, paras. [0057], Fig. 2B: storing AI models in memory of the DP accelerator).
Liu does not explicitly disclose the remaining limitations of claim 1 as follows:
searching the local repository to determine that the Al model is not registered with the chiplet;
registering the Al model in the local repository based on the confirmation.
However, in the same field of endeavor, Constable discloses the limitations of claim 1 as follows:
searching the local repository to determine that the Al model is not registered with the chiplet (paras. [0029], [0082], [0096]-[0097], [0122]: initialization circuitry uploads a received SWF and AI runtime for a runtime model that is only stored in the temporary memory of the integrated circuits until verified (i.e. not yet registered));
receiving a confirmation from the attestation authority that the Al model is authentic (paras. [0098]: TEE informs client device that model has been flagged as invalid);
registering the Al model in the local repository based on the confirmation (paras. [0097]-[0098]: a model that is flagged as invalid is discarded and not stored in long-term memory whereas a model that is valid is stored/registered).
Liu and Constable are both from the same field of endeavor verifying the integrity of AI-models. It would have been obvious to one of ordinary skill before the effective filing data of the invention to integrate Constable’s method of only storing validated AI-based models with the system of Liu in order to save resources and time by only validating AI-models that need to be validated and only storing AI-models that have been validated.
Prior Art Considered But Not Relied Upon
Prior art considered but not relied upon includes:
1) Nimmagadda (US 2021/0383026) teaches verifying the integrity of an AI model blob by generating an identifier based on characteristics of an AI model in a source code and storing the identifier in a field of the AI blob (paras. [0016]-[0018]).
Conclusion
For the above-stated reasons, claims 1-20 are rejected.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHARON S LYNCH whose telephone number is (571)272-4583. The examiner can normally be reached on 10AM-6PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi T Arani can be reached on 571-272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHARON S LYNCH/Primary Examiner, Art Unit 2438
