Security assurance of sandboxed generative artificial intelligence model

Abstract

A generative artificial intelligence (AI) system includes a generative AI model configured to generate an output based on a training data set. The AI system additionally includes a secure data vault system. The security data vault system additionally includes a sandbox system storing the generative AI model and operably coupled to the generative AI model to send an input to generate an output from the generative AI model, where the sandbox system includes an execution environment configured to execute the generative AI model. The execution environment is configured to limit execution of the generative AI model to a predefined range of memory addresses. The secure data vault system also includes a secure network service communicatively coupled to the sandbox system and configured to authenticate a connection to an external system and download an update package for the generative AI model from the external system when the connection is authenticated.

Description

[0001] Priority Statement

[0002] This patent application claims the benefit of priority to U.S. Application Serial No. 18 / 496,683, filed October 27, 2023, which is incorporated herein by reference in its entirety. Background Technology

[0003] Generative artificial intelligence (AI) includes models used to generate new data points (such as responses to text queries) that resemble examples in the training dataset. Furthermore, users are increasingly sharing media content items such as electronic images and videos with each other. Users are also increasingly utilizing their mobile devices to communicate with each other using messaging programs. Attached Figure Description

[0004] In the accompanying drawings (which are not necessarily drawn to scale), similar reference numerals may describe similar parts in different views. To facilitate identification of any particular element or action being discussed, one or more of the highest significant digits in the reference numerals refer to the drawing number in which the element was first introduced. Some non-limiting examples are shown in the accompanying drawings:

[0005] Figure 1 It is a diagrammatic representation of a networked environment in which the content of this disclosure can be deployed, based on some examples.

[0006] Figure 2 This is a block diagram illustrating details of an example of a secure data vault system based on some examples.

[0007] Figure 3 It is based on some examples stored in Figure 2 A diagram of various generative AI models in a secure data vault.

[0008] Figure 4 It is a graphical representation of a messaging system with both client-side and server-side functionalities, based on some examples.

[0009] Figure 5 It is a graphical representation based on examples such as data structures maintained in a database.

[0010] Figure 6 It is a graphical representation based on some example messages.

[0011] Figure 7 A system with a head-mounted wearable device is shown, based on some examples.

[0012] Figure 8 The process for retrieving and displaying certain group communication items (including media montages) is illustrated with some examples.

[0013] Figure 9 It is a graphical representation of a machine in the form of a computer system, within which a set of instructions can be executed to cause the machine to perform any or more of the methods discussed herein.

[0014] Figure 10 It is a block diagram showing the software architecture that can be implemented within it. Detailed Implementation

[0015] Generative AI models are a class of artificial intelligence models designed to generate data based on training data, typically in the form of text, images, and / or audio. In some examples, generative AI models are used to generate augmented reality (AR) and / or virtual reality (VR) content. Data (e.g., data provided via camera systems and microphones included in various devices such as mobile devices) is provided as input to the generative AI model. The AR and / or VR system then uses the output generated by the generative AI model to add certain virtual content, such as images, videos, audio, text, etc., to the corresponding AR and / or VR environment. Devices that support AR experiences using any of these methods are referred to herein as "AR devices," and devices that support VR experiences are referred to herein as "VR devices."

[0016] The techniques described in this paper provide a secure data vault system for hosting generative AI models. A secure data vault system is an isolated and secure environment within an operating system (OS) (such as AR OS). The secure data vault system maintains separation from user applications while allowing users / creators to retain control over their data. The secure data vault system includes a “sandbox” that allows users to perform certain computations (e.g., via generative AI models) on raw and computational data within the sandbox. Raw data includes data from camera devices, microphones, and other sensors. Raw data is shared with the secure data vault system via privileged areas of the OS, allowing the secure data vault system to manage the use of raw data. Computational data is data generated from the raw data, for example, via generative AI models, or data generated without using camera devices, microphones, and other sensors. Raw data is stored within the secure data vault system, while computational data is allowed to leave the secure data vault system subject to certain policy enforcement measures, as further described below.

[0017] In some implementations, the secure data vault system is part of the operating system but includes hardware components for providing isolation and trust. The secure data vault system can also apply generative AI systems to provide enhanced security and privacy. For example, some AI models are trained to take raw data as input and then output blurred images, videos, etc., to protect privacy. For instance, a user might be wearing AR and / or VR devices and inadvertently see a credit card bill placed on a table. The AI ​​model would then blur the credit card bill to protect privacy.

[0018] Networked computing environment

[0019] Figure 1 This is a block diagram illustrating an example interactive system 100 for facilitating interactions on a network, such as exchanging text messages, making text-to-audio and video calls, or playing games. Interactive system 100 includes multiple user systems 102, each hosting multiple applications including an interactive client 104 and other applications 106. Each interactive client 104 is communicatively coupled to other instances of the interactive client 104 (e.g., hosted on corresponding other user systems 102), an interactive server system 110, and a third-party server 112 via one or more communication networks including a network 108 (e.g., the Internet). The interactive client 104 may also communicate with the locally hosted applications 106 using an application programming interface (API).

[0020] Each user system 102 may include multiple user devices, such as mobile devices 114, head-mounted wearable devices 116, and computer client devices 118, which are communicatively connected to exchange data and messages.

[0021] Interactive client 104 interacts with other interactive clients 104 and with interactive server system 110 via network 108. The data exchanged between interactive clients 104 (e.g., interaction 120) and between interactive client 104 and interactive server system 110 includes functions (e.g., commands for activating functions) and payload data (e.g., text, audio, video, or other multimedia data).

[0022] Interactive server system 110 provides server-side functionality to interactive client 104 via network 108. While some functions of interactive system 100 are described herein as being performed by interactive client 104 or interactive server system 110, the location of certain functions within interactive client 104 or interactive server system 110 may be a design choice. For example, it may be technically preferred that specific technologies and functions are initially deployed within interactive server system 110, but that technology and functions are later migrated to interactive client 104 of user system 102, which has sufficient processing power.

[0023] The interactive server system 110 supports various services and operations provided to the interactive client 104. Such operations include sending data to and receiving data from the interactive client 104, and processing data generated by the interactive client 104. This data may include message content, client device information, geolocation information, media enhancements and overlays, message content persistence conditions, entity relationship information, and live event information. Data exchange within the interactive system 100 is activated and controlled via functions available through the user interface (UI) of the interactive client 104.

[0024] Specifically, the focus now shifts to interactive server system 110. Application Programming Interface (API) server 122 is coupled to interactive server 124 and provides it with a programming interface, making the functionality of interactive server 124 accessible to interactive client 104, other applications 106, and third-party server 112. Interactive server 124 is communicatively coupled to database server 126, thereby facilitating access to database 128, which stores data associated with the interactions processed by interactive server 124. Similarly, web server 130 is coupled to interactive server 124 and provides a web-based interface to interactive server 124. For this purpose, web server 130 handles incoming network requests via Hypertext Transfer Protocol (HTTP) and several other related protocols.

[0025] Application Programming Interface (API) server 122 receives and sends interactive data (e.g., command and message payloads) between interactive server 124 and user system 102 (as well as interactive client 104 and other applications 106) and third-party server 112. Specifically, API server 122 provides a set of interfaces (e.g., routines and protocols) that interactive client 104 and other applications 106 can invoke or query to activate the functionality of interactive server 124. Application Programming Interface (API) server 122 exposes various functions supported by interaction server 124, including account registration; login functionality; sending interactive data from one interaction client 104 to another interaction client 104 via interaction server 124; transferring media files (e.g., images or videos) from interaction client 104 to interaction server 124; setting up media data sets (e.g., stories); retrieving the friend list of users in user system 102; retrieving messages and content; adding and deleting entities (e.g., friends) against an entity relationship graph (e.g., entity graph 510); locating friends in the entity relationship graph; and opening (e.g., application events associated with interaction client 104).

[0026] Also shown is a secure data vault system 132 suitable for processing raw data from devices 114, 116, and 118. As previously described, the raw data includes data generated via camera devices, microphones, and / or other sensors (such as gyroscopes, navigation systems (e.g., GPS, inertial navigation systems), temperature sensors, etc.) included in devices 114, 116, and 118. In some embodiments, the raw data is processed only via the secure data vault system 132, thus providing data isolation and security.

[0027] In practice, the secure data vault system is an isolated and secure environment within an operating system (OS) (such as an AR OS). The secure data vault system remains separate from application 106 while allowing users / creators to maintain control over their data. In some implementations, the secure data vault system is part of the OS but includes hardware components for providing isolation and trust, as further described below. The secure data vault system also enables the local execution of machine learning and generative AI models that use raw data as input. That is, certain generative AI models are trained to take raw data as input and then output AR “tokens,” such as virtual content suitable for overlaying real-world images. These generative AI models are executed locally by the secure data vault system 132 in the corresponding devices 114, 116, and 118, not in external systems (such as external servers or cloud-based systems).

[0028] Figure 2 This is a block diagram illustrating further details of an example of a secure data vault system 132 according to some examples. In the depicted example, the secure data vault system 132 includes an application programming interface (API) 202, which is used by developers to interface with the secure data vault system 132 and perform certain functions of the secure data vault system 132. In some implementations, a developer-provided API (such as the depicted public developer API 204) is used to interface with the secure data vault system 132 via API 202.

[0029] API 202 includes function calls, methods, object-oriented classes, etc., and can perform certain functions provided by the secure data vault system 132. In some implementations, API 202 may include certain security functions, such as authenticating developer use of API 202 via receiving a security token, login / password combination, challenge / response authentication, secure handshake authentication, etc. Once the session is authenticated, the secure data vault system 132 can receive raw data via privileged access OS API 206. More specifically, privileged access OS API 206 is used solely by the secure data vault system 132 and not by any other system to receive raw data.

[0030] As described above, the raw data includes camera device data, microphone data, and / or sensor data from various sensors included in devices such as devices 114, 116, and 118 (e.g., AR devices, VR devices). In some embodiments, the OS is also authorized to access the raw data, for example, to test the camera device, microphone, and / or other sensors, to calibrate the camera device, microphone, and / or other sensors, etc. By isolating the raw data when using the camera device, microphone, and / or other sensors, making it processable only via the secure data vault system 132, the techniques described herein improve security and enhance privacy. For example, users of devices 114, 116, and 118 can enjoy AR experiences including new images and / or videos created via the generative AI model 208. The secure data vault system 132 will fully execute the generative AI model 208 within the execution environment 212 to enhance security and privacy.

[0031] In other words, execution environment 212 is completely enclosed within sandbox environment 210. The sandbox environment provides additional isolation and security. For example, sandbox environment 210 ensures that any actions performed within it remain isolated from the rest of the system, thus preventing potential harm from malware or unintended consequences from the code. In some examples, execution environment 212 restricts the execution of instructions or code to a predefined memory range (e.g., a start memory address and an end memory address). By isolating applications or code (such as code used to execute generative AI model 208), sandbox environment 210 reduces the risk of security vulnerabilities (such as buffer overflows or privilege escalation) impacting the entire system. If one or more generative AI models 208 executing within sandbox environment 210 behave unexpectedly or become unresponsive, the generative AI model can be terminated without affecting the rest of the system. Sandbox environment 210 may additionally utilize virtualization techniques to create completely separate virtual machines (VMs) or containers to host the isolated execution environment 212. In some implementations, sandbox environment 210 is a separate hardware system. For example, field-programmable gate arrays (FPGAs), separate microprocessors, custom circuit systems, etc., can be provided as part of devices 114, 116, 118 and used as sandbox environments 210. Thus, attack vectors are minimized, for example, by minimizing exposed code that could be maliciously modified.

[0032] The secure data vault system 132 imposes constraints on data sharing both on-device and off-device (network). In some implementations, the secure data vault system 132 may communicate only with a trusted set of features. A list of permitted processes / features can be placed in a security compatibility matrix 214. For example, columns in the security compatibility matrix 214 list the various functions provided by the secure data vault system 132, and rows in the security compatibility matrix 214 list the processes that can access these functions. Thus, a process can call API 202 and request the execution of a function, including functions related to generative AI models (e.g., providing output based on input, upgrading to a newer model version, etc.), and can then check the security compatibility matrix 214 to verify that the process has permission to execute that function.

[0033] Also shown is a secure network service 216 included in the secure data vault system 132. Secure network service 216 is used to communicate with external systems to update AI model 208, execution environment 212, and / or security compatibility matrix 214. Secure network service 216 can use technologies such as Transport Layer Security (TLS) in Hypertext Transfer Protocol Security (HTTPS) download-only mode. That is, in some examples, secure network service 216 can be used only to download information, such as an updated version of generative AI model 208. Authentication for downloads via secure network service 216 can be provided via challenge / response hardware technology (e.g., via a hardware security token device that provides multi-factor authentication), key usage, time-slot downloads (e.g., where downloads only occur at a given time of day), etc.

[0034] Display and rendering system 218 is also included in secure data vault system 132. This display and rendering system 218 is adapted to dynamically create a three-dimensional (3D) representation and to display, for example, as an overlay on a real-time view of the surrounding environment provided by a camera device. Sound can also be provided via display and rendering system 218.

[0035] The display and rendering system 218 also includes the use of output from the generative AI model 208 to render certain virtual content. For example, the generative AI model can be used in games to create filters, stickers, animations, etc., based on input data. For instance, camera data can include real-time images of people in a room, and the generative AI model 208 can then create virtual animations of the people. Similarly, game content can be generated in real-time via the generative AI model 208.

[0036] The display and rendering system 218 further includes security features, such as using a generative AI model 208 to detect and blur images and / or sounds that may be considered private. As previously mentioned, certain documents (e.g., driver's licenses, credit cards, social security cards, passports) may have already been viewed during an AR session. The generative AI model 208 can detect the presence of private information and collaborate with the display and rendering system 218 to blur images and / or mute sounds, thereby protecting privacy. In some implementations, the display and rendering system 218 may also provide the user with notification of the presence of private information. By providing an isolated, secure, and local execution environment via the sandbox environment 210, the secure data vault system 132 enhances privacy and user security across various AR systems.

[0037] Figure 3This is a block diagram illustrating further details of a generative AI model 208 based on some examples. In the depicted examples, the generative AI model 208 includes various model types, such as a variational autoencoder (VAE) model 302, a generative adversarial network (GAN) model 304, a recurrent neural network (RNN) model 306, a Transformer model 308, an autoencoder model 310, and other models 312. The VAE model 302 learns a probabilistic mapping between data and a latent space and can be used for tasks such as image generation and data compression. The GAN model 304 consists of a generator and a discriminator trained in a competitive manner.

[0038] RNN model 306 computation depends on the previous time step. RNN models 306 have connections that loop back to themselves, allowing them to maintain hidden states representing information about previous elements in the sequence they have processed. This hidden state enables RNN models 306 to exhibit dynamic temporal behavior, making them well-suited for tasks involving sequences. Transformer model 308 is based on a neural network architecture designed to process sequential data, primarily focusing on natural language processing tasks such as machine translation and text generation. Transformer model 308 was introduced in the 2017 paper "Attention is All You Need" by Vaswani et al. Autoencoder model 310 is a type of model that learns to reconstruct input data from lower-dimensional representations. Other models 312 are also used, such as variants of Large Language Models (LLMs).

[0039] In the depicted implementation, training dataset 314 is used to train various generative AI models 208. In some examples, training dataset 314 is not part of the secure data vault system 132, but only the trained generative AI models 208 are used internally by the secure data vault system 132. Training dataset 314 includes AR and VR data, such as images, videos, audio, text, labels, animations, filters, etc., created during the use of AR and VR devices. Other data, such as “records” of AR and VR experiences while using AR and VR devices, are also part of training dataset 314. The training overview for generative AI model 208 is as follows:

[0040] Data collection and preprocessing:

[0041] Collect diverse and extensive datasets containing data from areas of interest. These datasets can include VR / AR recordings, audio, images, videos, books, articles, websites, and other textual sources.

[0042] The data is preprocessed by tokenizing the text into smaller units (such as word or subword fragments, image fragments, video fragments, etc.) and performing any necessary cleaning and formatting.

[0043] Lexicalization and vocabulary creation:

[0044] Lexicalization transforms data (e.g., text) into units that the model can process, such as subwords or words. Lexicalization is used to create a vocabulary that the model uses during training.

[0045] A vocabulary is constructed from the lexical units in the training data. This vocabulary defines the set of lexical units that the model can recognize and generate.

[0046] Model initialization:

[0047] If you are fine-tuning an existing model, initialize the generative AI model 208 with random weights or pre-trained weights.

[0048] Pre-training:

[0049] The model is pre-trained on a large amount of data in an unsupervised manner. During pre-training, the model learns to predict the next word in a sequence (e.g., autoregressive language modeling) or performs other unsupervised tasks, such as masked language modeling.

[0050] Techniques such as batch processing, distributed computing, and parallel processing are used to efficiently process large amounts of data.

[0051] Loss function:

[0052] Define an appropriate loss function for the pre-training task, such as cross-entropy loss.

[0053] optimization:

[0054] Choose an optimization algorithm (e.g., Adam, SGD) and tune hyperparameters such as learning rate, batch size, and weight decay.

[0055] Apply gradient clipping to prevent gradient explosion.

[0056] train:

[0057] Train the model on a pre-training task for a large number of iterations or periods. This step may take some time.

[0058] Monitor training progress, track loss values, and use evaluation metrics to assess model performance.

[0059] Fine-tuning:

[0060] After pre-training, the model can be fine-tuned on domain-specific or downstream tasks by adding task-specific layers and training the model on labeled data.

[0061] Fine-tuning allows the pre-trained generative AI model 208 to be adapted to specific applications, such as text classification, language translation, or question answering.

[0062] Regularization:

[0063] Apply regularization techniques, such as dropout or weight decay, to prevent overfitting.

[0064] Verification and evaluation:

[0065] The optimal model checkpoint is selected using a validation dataset based on performance metrics relevant to the task (e.g., displaying AR / VR content).

[0066] The model was evaluated on a separate test dataset to assess its generalization performance.

[0067] The trained generative AI model 208 is then deployed as part of the secure data vault system 132. In operation, the secure data vault system 132 provides various inputs to the generative AI model 208. For example, during AR / VR activities, camera data, audio, and positioning information (e.g., gyroscope information, geolocation information) can be provided as input 316 to the generative AI model 208. The generative AI model 208 then produces output 318, such as images, videos, text, audio, animations, labels, filters, etc. The output 318 is then provided via a display (including an AR / VR display).

[0068] System Architecture

[0069] Figure 4This is a block diagram illustrating further details of an interactive system 100 according to some examples. Specifically, the interactive system 100 is shown as including an interactive client 104 and an interactive server 124. The interactive system 100 comprises multiple subsystems supported on the client side by the interactive client 104 and on the server side by the interactive server 124. In some examples, these subsystems are implemented as microservices. A microservice subsystem (e.g., a microservice application) may have components that enable it to operate independently and communicate with other services. Example components of a microservice subsystem may include:

[0070] Functional logic: Functional logic implements the functions of the microservice subsystem and represents the specific capabilities or functions provided by the microservice.

[0071] API Interface: Microservices can communicate with each other using well-defined APIs or interfaces, employing lightweight protocols such as REST or messaging. The API interface defines the inputs and outputs of a microservice subsystem, and how it interacts with other microservice subsystems within the interactive system 100.

[0072] Data storage: The microservice subsystem can be responsible for its own data storage, which can be in the form of a database, cache, or other storage mechanism (e.g., using database server 126 and database 128). This allows the microservice subsystem to operate independently of other microservices in the interactive system 100.

[0073] Service discovery: Microservice subsystems can find and communicate with other microservice subsystems in the interacting system 100. The service discovery mechanism enables microservice subsystems to locate and communicate with other microservice subsystems in a scalable and efficient manner.

[0074] Monitoring and logging: It may be necessary to monitor and log microservice subsystems to ensure availability and performance. Monitoring and logging mechanisms enable the tracking of the health and performance of microservice subsystems.

[0075] In some examples, the interactive system 100 may employ a monolithic architecture, a service-oriented architecture (SOA), a function-as-a-service (FaaS) architecture, or a modular architecture:

[0076] The example subsystem is discussed below.

[0077] Image processing system 402 provides various functions that enable users to capture and enhance (e.g., annotate or otherwise modify or edit) media content associated with a message.

[0078] The camera device system 404 includes (e.g., in a camera device application) control software that interacts with and controls the hardware camera device hardware of the user system 102 (e.g., directly or via operating system controls) to modify and enhance real-time images captured and displayed via the interactive client 104.

[0079] Enhancement system 406 provides functionality related to the generation and distribution of enhancements (e.g., media overlays) for images captured in real time by the camera device of user system 102 or retrieved from the memory of user system 102. For example, enhancement system 406 is operable to select, present, and display media overlays (e.g., image filters or image lenses) for interactive client 104 to enhance real-time images received via camera device system 404 or stored images retrieved from memory 702 of user system 102. These enhancements are selected by enhancement system 406 and presented to the user of interactive client 104 based on some inputs and data, such as:

[0080] The geographical location of user system 102; and

[0081] User entity relationship information of users in user system 102.

[0082] Enhancements may include audio and visual content and visual effects. Examples of audio and visual content include images, text, logos, animations, and sound effects. Examples of visual effects include color overlays. Audio and visual content or visual effects may be applied to media content items (e.g., photos or videos) at user system 102 for transmission in messages, or to video content such as video content streams or feeds sent from interactive client 104. Therefore, image processing system 402 can interact with and support various subsystems of communication system 408, such as messaging system 410 and video communication system 412.

[0083] Media overlays may include text or image data that can be superimposed on photographs taken by user system 102 or video streams produced by user system 102. In some examples, media overlays may be location overlays (e.g., Venice Beach), names of live events, or names of businesses (e.g., beach cafes). In other examples, image processing system 402 uses the geographic location of user system 102 to identify media overlays that include the names of businesses located at the geographic location of user system 102. Media overlays may include additional tags associated with businesses. Media overlays may be stored in database 128 and accessed through database server 126.

[0084] Image processing system 402 provides a user-based publishing platform that allows users to select geographical locations on a map and upload content associated with those locations. Users can also specify which media overlays should be provided to other users. Image processing system 402 generates a media overlay that includes the uploaded content and associates it with the selected geographical location.

[0085] The augmented creation system 414 supports augmented reality developer platforms and includes applications for content creators (e.g., artists and developers) to create and publish interactive clients 104, such as augmented reality experiences. The augmented creation system 414 provides content creators with a library of built-in features and tools, including, for example, custom shaders, tracking technologies, and templates.

[0086] In some examples, the enhancement creation system 414 provides a merchant-based publishing platform that allows merchants to select specific enhancements associated with geographic locations via a bidding process. For instance, the enhancement creation system 414 associates the media overlay of the highest-bidding merchant with a corresponding geographic location for a predefined amount of time.

[0087] Communication system 408 is responsible for enabling and processing various forms of communication and interaction within interactive system 100, and includes messaging system 410, audio communication system 416, and video communication system 412. Messaging system 410 is responsible for enabling temporary or time-limited access to content by interactive client 104. Messaging system 410 includes (e.g., in a short-lived timer system) multiple timers that selectively enable access (e.g., for presentation and display) of messages and associated content via interactive client 104 based on duration and display parameters associated with a message or set of messages (e.g., a story). Audio communication system 416 enables and supports audio communication (e.g., real-time audio chat) between multiple interactive clients 104. Similarly, video communication system 412 enables and supports video communication (e.g., real-time video chat) between multiple interactive clients 104.

[0088] The user management system 418 is operationally responsible for managing user data and profiles, and maintaining entity information about users of the interactive system 100 and the relationships between users (e.g., stored in entity table 508, entity diagram 510, and profile data 502).

[0089] The collection management system 420 is operationally responsible for managing collections or sets of media (e.g., collections of text, images, video, and audio data). Collections of content (e.g., messages, including images, videos, text, and audio) can be organized into “event libraries” or “event stories.” Such collections can be made available for a specified time period (e.g., the duration of the event to which the content relates). For example, content related to a concert can be available as a “story” for the duration of the concert. The collection management system 420 can also be responsible for publishing icons that notify the user interface of the interactive client 104 of the availability of specific collections. The collection management system 420 includes curation functions that enable collection managers to manage and curate specific content collections. For example, a curation interface enables event organizers to curate collections of content related to a specific event (e.g., removing inappropriate content or redundant messages). Additionally, the collection management system 420 employs machine vision (or image recognition technology) and content rules to automatically curate content collections. In some examples, users may be compensated for including user-generated content in a collection. In such cases, the collection management system 420 operates to automatically pay such users for using their content.

[0090] Map system 422 provides various geographic location (e.g., geolocation) functions and supports interactive client 104 in presenting map-based media content and messages. For example, map system 422 enables the display of user icons or avatars (e.g., stored in profile data 502) on the map to indicate the current or past locations of the user's "friends," as well as media content (e.g., a collection of messages including photos and videos) generated by such friends within the context of the map. For example, a message posted by a user from a specific geographic location to interactive system 100 can be displayed to the specific user's "friends" on the map interface of interactive client 104 within the context of the map at that specific location. The user can also share his or her location and status information (e.g., using an appropriate status avatar) with other users of interactive system 100 via interactive client 104, which is similarly displayed to the selected user within the context of the map interface of interactive client 104.

[0091] Game system 424 provides various game functions within the context of interactive client 104. Interactive client 104 provides a game interface with a list of available games that can be launched by a user within the context of interactive client 104 and played with other users of interactive system 100. Interactive system 100 also enables specific users to invite other users to play specific games by sending invitations from interactive client 104. Interactive client 104 also supports audio, video, and text messaging (e.g., chat) within the context of game content, provides leaderboards for games, and also supports providing in-game rewards (e.g., game currency and items).

[0092] External resource system 426 provides interactive client 104 with an interface to communicate with remote servers (e.g., third-party server 112) to launch or access external resources (i.e., applications or applets). Each third-party server 112 hosts applications or smaller versions of applications (e.g., game applications, utility applications, payment applications, or ride-sharing applications) based on markup languages ​​(e.g., HTML5). Interactive client 104 can launch web-based resources (e.g., applications) by accessing HTML5 files from the third-party server 112 associated with the web-based resource. The application hosted by third-party server 112 is programmed in JavaScript using a software development kit (SDK) provided by interactive server 124. The SDK includes application programming interfaces (APIs) with functionality that can be called or activated by the web-based application. Interactive server 124 hosts a JavaScript library that provides access to a given external resource for specific user data of interactive client 104. HTML5 is an example of a technology for programming games, but applications and resources programmed using other technologies can be used.

[0093] To integrate the SDK's functionality into the web-based resource, the third-party server 112 downloads the SDK from the interactive server 124, or the third-party server 112 otherwise receives the SDK. Once downloaded or received, the SDK is included as part of the application code of the web-based external resource. The code of the web-based resource can then call or activate certain functions of the SDK to integrate the features of the interactive client 104 into the web-based resource.

[0094] The SDK stored on the interactive server system 110 effectively bridges the gap between external resources (e.g., application 106 or applet) and the interactive client 104. This provides users with a seamless experience communicating with other users on the interactive client 104 while preserving the look and feel of the interactive client 104. To bridge communication between the external resources and the interactive client 104, the SDK facilitates communication between the third-party server 112 and the interactive client 104. A bridging script running on the user system 102 establishes two unidirectional communication channels between the external resources and the interactive client 104. Messages are sent asynchronously between the external resources and the interactive client 104 via these communication channels. Each SDK function activation is sent as a message and callback. Each SDK function is implemented by constructing a unique callback identifier and sending a message with that callback identifier.

[0095] By using the SDK, not all information from the interactive client 104 is shared with the third-party server 112. The SDK limits which information is shared based on the needs of the external resources. Each third-party server 112 provides the interactive server 124 with an HTML5 file corresponding to the web-based external resource. The interactive server 124 can add a visual representation (e.g., box design or other graphics) of the web-based external resource to the interactive client 104. Once the user selects the visual representation or instructs the interactive client 104 to access the features of the web-based external resource through the interactive client 104's GUI, the interactive client 104 obtains the HTML5 file and instantiates the resource for accessing the features of the web-based external resource.

[0096] Interactive client 104 presents a graphical user interface (GUI) for an external resource (e.g., a login page or title screen). During, before, or after presenting the login page or title screen, interactive client 104 determines whether the initiated external resource has previously been authorized to access user data of interactive client 104. In response to determining that the initiated external resource has previously been authorized to access user data of interactive client 104, interactive client 104 presents another GUI of the external resource, including its functionality and characteristics. In response to determining that the initiated external resource has not previously been authorized to access user data of interactive client 104, after displaying the login page or title screen of the external resource for a threshold time period (e.g., 3 seconds), interactive client 104 slides up a menu (e.g., animates the menu to appear from the bottom of the screen to the middle of the screen or other parts) to authorize the external resource to access user data. This menu identifies the type of user data that the external resource will be authorized to use. In response to receiving a user selection of the accept option, interactive client 104 adds the external resource to the list of authorized external resources and allows the external resource to access user data from interactive client 104. External resources are authorized by the interactive client 104 to access user data under the OAuth 2 framework.

[0097] Interactive client 104 controls the type of user data shared with external resources based on the type of authorized external resource. For example, access to a first type of user data (e.g., a two-dimensional avatar of a user with or without different avatar characteristics) is provided to external resources including complete applications (e.g., application 106). As another example, access to a second type of user data (e.g., payment information, a user's two-dimensional avatar, a user's three-dimensional avatar, and avatars with various avatar characteristics) is provided to external resources including smaller versions of the application (e.g., a web-based version of the application). Avatar characteristics include different ways of customizing the appearance and feel of the avatar (e.g., different poses, facial features, clothing, etc.).

[0098] The advertising system 428 enables third parties to purchase advertisements for presentation to end users via the interactive client 104, and also handles the delivery and presentation of these advertisements.

[0099] Artificial intelligence and machine learning system 430 provides various services to different subsystems within interaction system 100. For example, AI and machine learning system 430 operates in conjunction with image processing system 402 and camera device system 404 to analyze images and extract information such as objects, text, or faces. Image processing system 402 can then use this information to enhance, filter, or manipulate images. This information can also be used to train generative AI model 208 and to provide input to generative AI model 208. AI and machine learning system 430 can be used by augmentation system 406 to generate augmented content and augmented reality experiences, such as adding virtual objects or animations to real-world images. Communication system 408 and messaging system 410 can use AI and machine learning system 430 to analyze communication patterns and provide insights into how users interact with each other, and provide intelligent message classification and tagging, such as classifying messages based on sentiment or topic. AI and machine learning system 430 can also provide chatbot functionality for messaging interactions 120 between user systems 102 and between user systems 102 and interaction server system 110. The artificial intelligence and machine learning system 430 can also work with the audio communication system 416 to provide speech recognition and natural language processing capabilities, enabling users to interact with the interactive system 100 using voice commands.

[0100] Data Architecture

[0101] Figure 5 This is a schematic diagram illustrating a data structure 500 that can be stored in a database 504 of an interactive server system 110, according to certain examples. Although the contents of the database 504 are shown as including multiple tables, it should be understood that data can be stored in other types of data structures, such as object-oriented databases.

[0102] Database 504 includes message data stored in message table 506. For any given message, this message data includes at least message sender data, message receiver (or recipient) data, and a payload. See below for reference. Figure 5 Further details describe information that can be included in the message and is contained within the message data stored in message table 506.

[0103] Entity table 508 stores entity data and (for example, links to entity diagram 510 and profile data 502). Entities for which records are maintained in entity table 508 can include individuals, company entities, organizations, objects, locations, events, etc. Regardless of the entity type, any entity for which the interactive server system 110 stores data can be an identifiable entity. Each entity is assigned a unique identifier and an entity type identifier (not shown).

[0104] Entity Graph 510 stores information about relationships and associations between entities. As an example only, such relationships can be social, professional (e.g., working in a common company or organization), interest-based, or activity-based. Some relationships between entities can be one-way, such as an individual user subscribing to digital content from a business or publishing user (e.g., a newspaper or other digital media channel or brand). Other relationships can be two-way, such as the "friendship" relationships between various users of Interactive System 100.

[0105] Certain licenses and relationships can be attached to each relationship, and also to each direction of the relationship. For example, a two-way relationship (e.g., a friendship between individual users) can include authorization for the posting of digital content items between the individual users, but certain restrictions or filters can be imposed on the posting of such digital content items (e.g., based on content characteristics, location data, or time of day data). Similarly, a subscription relationship between an individual user and a business user can impose varying degrees of restrictions on the posting of digital content from the business user to the individual user, and can significantly restrict or prevent the posting of digital content from the individual user to the business user. As an example of an entity, a specific user can (e.g., through privacy settings) record certain restrictions in the records for that entity within entity table 508. Such privacy settings can be applied to all types of relationships in the context of interaction system 100, or selectively applied to certain types of relationships.

[0106] Profile data 502 stores various types of profile data about a specific entity. Based on privacy settings specified by the specific entity, profile data 502 can be selectively used and presented to other users of the interaction system 100. In the case of an individual, profile data 502 includes, for example, a username, phone number, address, settings (e.g., notification and privacy settings), and an avatar representation (or a set of such avatar representations) selected by the user. A specific user can then selectively include one or more of these avatar representations within the content of messages transmitted via the interaction system 100 and on a map interface displayed to other users by the interaction client 104. The set of avatar representations may include "status avatars," which present a graphical representation of a status or activity that the user can choose to transmit at a specific time.

[0107] In the case that the entity is a group, in addition to the group name, members and various settings for the relevant group (e.g., notifications), the profile data 502 for the group may similarly include one or more avatar representations associated with the group.

[0108] Database 504 also stores enhancement data, such as overlays or filters, in enhancement table 512. Enhancement data is associated with video (data for which is stored in video table 514) and images (data for which is stored in image table 516) and is applied to video and images.

[0109] In some examples, filters are displayed as overlays on images or videos during presentation to the receiving user. Filters can be of various types, including user-selected filters from a set of filters presented to the sending user by the interactive client 104 while the sending user is composing a message. Other types of filters include geolocation filters (also known as geographic filters), which can be presented to the sending user based on geographic location. For example, geolocation filters specific to nearby or particular locations can be presented by the interactive client 104 within the user interface based on geographic location information determined by the user system 102's Global Positioning System (GPS) unit.

[0110] Another type of filter is a data filter, which can be selectively presented to the sending user by the interactive client 104 during the message creation process based on other inputs or information collected by the user system 102. Examples of data filters include the current temperature at a specific location, the current speed of the sending user, the battery life of the user system 102, or the current time.

[0111] Other augmented data that can be stored in image table 516 includes augmented reality content items (e.g., corresponding to an application "lens" or augmented reality experience). Augmented reality content items can be real-time special effects and sounds that can be added to images or videos.

[0112] Collection table 518 stores data about collections of messages and associated image, video, or audio data, compiled into collections (e.g., stories or galleries). The creation of a specific collection can be initiated by a specific user (e.g., each user for whom records are maintained in entity table 508). A user can create a "personal story" in the form of a collection of content that has been created and sent / broadcast by that user. For this purpose, the user interface of interactive client 104 can include user-selectable icons to allow the sending user to add specific content to his or her personal story.

[0113] The collection can also constitute a "live story," which is a collection of content from multiple users created manually, automatically, or using a combination of manual and automatic technologies. For example, a "live story" can constitute a curated stream of user-submitted content from various locations and events. Users whose client devices have location services enabled and who are at a common location event at a specific time can be presented with the option to contribute content to a specific live story, for example, via the user interface of interactive client 104. Live stories can be identified to a user by interactive client 104 based on their location. The end result is a "live story" told from a collective perspective.

[0114] Another type of content collection is called a "location story," which allows users of user system 102 located in a specific geographic location (e.g., on a college or university campus) to contribute to a specific collection. In some examples, contributions to a location story may employ secondary authentication to verify that the end user belongs to a specific organization or other entity (e.g., is a student on a university campus).

[0115] As mentioned above, video table 514 stores video data, which in some examples is associated with messages for which records are maintained within message table 506. Similarly, image table 516 stores image data associated with messages for which message data is stored in entity table 508. Entity table 508 can associate various enhancements from enhancement table 512 with various images and videos stored in image table 516 and video table 514.

[0116] Data communication architecture

[0117] Figure 6 This is a schematic diagram illustrating the structure of message 600 according to some examples, generated by interactive client 104 for transmission to another interactive client 104 via interactive server 124. The content of a particular message 600 is used to populate message table 506 within database 504 accessible by interactive server 124. Similarly, the content of message 600 is stored in memory as "in-transit" or "in-flight" data for user system 102 or interactive server 124. Message 600 is shown to include the following example components:

[0118] Message Identifier 602: A unique identifier that identifies message 600.

[0119] Message text payload 604: The text to be generated by the user via the user interface of user system 102 and included in message 600.

[0120] Message image payload 606: Image data captured by the camera device component of user system 102 or retrieved from the memory component of user system 102 and included in message 600. The image data for the sent or received message 600 can be stored in image table 516.

[0121] Message video payload 608: Video data captured by the camera device component or retrieved from the memory component of the user system 102 and included in message 600. The video data for the sent or received message 600 can be stored in image table 516.

[0122] Message audio payload 610: Audio data captured by the microphone or retrieved from the memory component of the user system 102 and included in message 600.

[0123] Message enhancement data 612: Enhancement data (e.g., filters, labels, or other annotations or enhancements) representing enhancements to be applied to the message image payload 606, message video payload 608, or message audio payload 610 of message 600. Enhancement data for the sent or received message 600 can be stored in enhancement table 512.

[0124] Message duration parameter 614: A parameter value, in seconds, indicating the amount of time that the content of the message (e.g., message image payload 606, message video payload 608, message audio payload 610) should be presented to the user via the interactive client 104 or made accessible to the user.

[0125] Message geolocation parameter 616: Geographic location data (e.g., latitude and longitude coordinates) associated with the message's content payload. Multiple message geolocation parameter 616 values ​​may be included in the payload, each of which is associated with a content item included in the content (e.g., a specific image within the message image payload 606 or a specific video within the message video payload 608).

[0126] Message Story Identifier 618: An identifier value that identifies one or more sets of content (e.g., “story” identified in set table 518) associated with a specific content item in the message image payload 606 of message 600. For example, the identifier value can be used to associate multiple images within the message image payload 606 with multiple sets of content, respectively.

[0127] Message Tag 620: Each message 600 can be labeled with multiple tags, each of which indicates the subject of the content included in the message payload. For example, in the case where a specific image depicts an animal (e.g., a lion) is included in the message image payload 606, a tag value can be included within the message tag 620 indicating the relevant animal. Tag values ​​can be manually generated based on user input, or can be automatically generated using, for example, image recognition.

[0128] Message sender identifier 622: An identifier (e.g., message sending system identifier, email address, or device identifier) ​​indicating the user of the user system 102 on which message 600 is generated and from which message 600 is sent.

[0129] Message receiver identifier 624: An identifier (e.g., message sending and receiving system identifier, email address, or device identifier) ​​indicating the user of the user system 102 to which message 600 is addressed.

[0130] The content (e.g., values) of each component of message 600 can be pointers to locations in tables where content data values ​​are stored. For example, image values ​​in message image payload 606 can be pointers (or addresses) to locations within image table 516. Similarly, values ​​in message video payload 608 can point to data stored in image table 516, values ​​in message enhancement data 612 can point to data stored in enhancement table 512, values ​​in message story identifier 618 can point to data stored in set table 518, and values ​​in message sender identifier 622 and message receiver identifier 624 can point to user records stored in entity table 508.

[0131] Systems with head-worn devices

[0132] Figure 7 A system 700, including a head-worn wearable device 116 with a selector input device, is shown according to some examples. Figure 7 This is a high-level functional block diagram of an example head-mounted wearable device 116 that is communicatively coupled to mobile devices 114 and various server systems 704 (e.g., interactive server system 110) via various networks 108.

[0133] The head-mounted wearable device 116 includes one or more camera devices, each of which may be, for example, a visible light camera 706, an infrared emitter 708, and an infrared camera 710 that are communicatively and / or operatively coupled to the secure data vault system 132.

[0134] Mobile device 114 connects to head-mounted wearable device 116 using both low-power wireless connection 712 and high-speed wireless connection 714. Mobile device 114 also connects to server system 704 and network 716.

[0135] The head-mounted wearable device 116 also includes two image displays of an optical component image display 718. These two image displays 718 include an image display associated with the left lateral side of the head-mounted wearable device 116 and an image display associated with the right lateral side of the head-mounted wearable device 116. The head-mounted wearable device 116 also includes an image display driver 720, an image processor 722, a low-power circuitry system 724, and a high-speed circuitry system 726. The image displays 718 of the optical component are used to present images and videos to the user of the head-mounted wearable device 116, including images that may include a graphical user interface.

[0136] The image display driver 720 commands and controls the image display 718 of the optical components. The image display driver 720 can directly deliver image data to the image display 718 of the optical components for presentation, or it can convert the image data into a signal or data format suitable for delivery to the image display device. For example, the image data can be video data formatted according to compression formats such as H.264 (MPEG-4 Part 10), HEVC, Theora, Dirac, RealVideo RV40, VP8, VP9, ​​etc., and still image data can be formatted according to compression formats such as Portable Network Group (PNG), Joint Photographic Experts Group (JPEG), Tag Image File Format (TIFF), or Exchangeable Image File Format (EXIF).

[0137] The head-worn device 116 includes a frame and a stem (or temple) extending laterally from the frame. The head-worn device 116 also includes a user input device 728 (e.g., a touch sensor or a press button), which includes an input surface on the head-worn device 116. The user input device 728 (e.g., a touch sensor or a press button) is used to receive input selections from the user to manipulate a graphical user interface of the presented image.

[0138] Figure 7The components shown for the head-worn wearable device 116 are located on one or more circuit boards (e.g., PCBs or flexible PCBs) in the frame or temples. Alternatively or additionally, the depicted components may be located in a chunk, frame, hinge, or nose bridge of the head-worn wearable device 116. The left and right visible light camera devices 706 may include digital camera elements, such as complementary metal-oxide-semiconductor (CMOS) image sensors, charge-coupled devices, camera lenses, or any other corresponding visible light or light-capturing elements that can be used to capture data, including images of scenes with unknown objects.

[0139] The head-mounted wearable device 116 includes a memory 702 that stores instructions for performing a subset or all of the functions described herein. The memory 702 may also include a storage device.

[0140] like Figure 7 As shown, the high-speed circuit system 726 includes a high-speed processor 730, a memory 702, and a high-speed wireless circuit system 732. In some examples, the image display driver 720 is coupled to the high-speed circuit system 726 via a secure data vault system 132 and is operated by the display and rendering system 218 to drive the left and right image displays of the image display 718 of the optical components. The high-speed processor 730 can be any processor capable of managing the high-speed communication and operation of any general-purpose computing system required by the head-worn device 116 and is included in the display and rendering system 218. The high-speed processor 730 includes the processing resources required to manage high-speed data transmission over the high-speed wireless connection 714 to a wireless local area network (WLAN) using the high-speed wireless circuit system 732. In some examples, the high-speed processor 730 executes the operating system of the head-worn device 116 (such as a LINUX operating system or other such operating system), and this operating system is stored in the memory 702 for execution. Among other duties, the high-speed processor 730, which executes the software architecture of the head-worn device 116, is used to manage data transmission with the high-speed wireless circuit system 732. In some examples, the high-speed wireless circuit system 732 is configured to implement the Institute of Electrical and Electronics Engineers (IEEE) 802.11 communication standard, also referred to herein as WiFi®. In some examples, other high-speed communication standards can be implemented using the high-speed wireless circuit system 732.

[0141] The low-power wireless circuitry system 734 and high-speed wireless circuitry system 732 of the head-mounted wearable device 116 may include a short-range transceiver (Bluetooth™) and a wireless wide area network, local area network, or wide area network transceiver (e.g., cellular or WiFi®). The mobile device 114, including transceivers communicating via low-power wireless connection 712 and high-speed wireless connection 714, can be implemented using the architectural details of the head-mounted wearable device 116, as can other components of the network 716.

[0142] Memory 702 includes any storage device capable of storing various data and applications, including camera data generated by the left and right visible light imaging devices 706, the infrared imaging device 710, and the image processor 722, as well as images generated by the image display driver 720 for display on an image display 718 of the optical components. While memory 702 is shown as integrated with high-speed circuitry 726, in some examples, memory 702 may be a separate, independent component of the head-mounted wearable device 116. In some such examples, electrical wiring may provide a connection from the image processor 722 or the low-power processor 736 to memory 702 via a chip including a high-speed processor 730. In some examples, the high-speed processor 730 may manage addressing of memory 702, such that the low-power processor 736 will activate the high-speed processor 730 whenever a read or write operation involving memory 702 is required.

[0143] like Figure 7 As shown, the low-power processor 736 or high-speed processor 730 of the head-mounted wearable device 116 may be coupled to a camera device (visible light camera 706, infrared emitter 708, or infrared camera 710), an image display driver 720, a user input device 728 (e.g., a touch sensor or a press button), and a memory 702. In some embodiments, both the low-power circuitry 724 and the high-speed circuitry 726 are included in the secure data vault system 132.

[0144] The head-mounted wearable device 116 is connected to a host computer. For example, the head-mounted wearable device 116 is paired with the mobile device 114 via a high-speed wireless connection 714 or connected to the server system 704 via a network 716. The server system 704 may be one or more computing devices as part of a service or network computing system, for example, it includes a processor, memory, and network communication interfaces to communicate with the mobile device 114 and the head-mounted wearable device 116 via the network 716.

[0145] Mobile device 114 includes a processor and a network communication interface coupled to the processor. The network communication interface enables communication via network 716, low-power wireless connection 712, or high-speed wireless connection 714. Mobile device 114 may further store at least a portion of instructions in its memory to implement the functions described herein. In some embodiments, low-power circuitry system 724 and high-speed wireless circuitry system 732 are included in secure network service 216 and are used only for downloading data such as update packages to secure data vault system 132. For example, update packages may include computer instructions configured to update the sandbox system, secure network service 216, and / or display and rendering system 218 to a newer version. Update packages are encrypted, and then a key stored in sandbox system 210 is used to decrypt and verify the validity of the update package. In some examples, the key used to decrypt the update package is a fairly good privacy (PGP) private key. Therefore, a PGP public key shared by sandbox system 210 is used to encrypt the update package. Verification can then be performed by reading the header of the update package after decryption. The header may include, for example, a cyclic redundancy check (CRC) code to verify the integrity of the instructions included in the update packet.

[0146] The output components of the head-worn wearable device 116 include visual components, such as displays, including liquid crystal displays (LCDs), plasma display panels (PDPs), light-emitting diode (LED) displays, projectors, or waveguides. The image display of the optical components is driven by an image display driver 720. The output components of the head-worn wearable device 116 also include acoustic components (e.g., speakers), haptic components (e.g., vibration motors), other signal generators, etc. The input components (such as user input devices 728) of the head-worn wearable device 116, mobile device 114, and server system 704 may include alphanumeric input components (e.g., keyboards, touchscreens configured to receive alphanumeric input, photoelectric keyboards, or other alphanumeric input components), pointing-based input components (e.g., mice, touchpads, trackballs, joysticks, motion sensors, or other pointing instruments), haptic input components (e.g., physical buttons, touchscreens that provide the position and force of a touch or touch gesture, or other haptic input components), audio input components (e.g., microphones), etc.

[0147] The head-mounted wearable device 116 may also include additional peripheral device elements. Such peripheral device elements may include biometric sensors, additional sensors, or display elements integrated with the head-mounted wearable device 116. For example, peripheral device elements may include any I / O components, including output components, motion components, positioning components, or any other such elements described herein.

[0148] For example, biometric components include those for detecting expressions (e.g., hand gestures, facial expressions, vocal expressions, body posture, or eye tracking), measuring biosignals (e.g., blood pressure, heart rate, body temperature, sweating, or brain waves), and identifying people (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition). Biometric components may include brain-computer interface (BMI) systems that allow communication between the brain and external devices or machines. This can be achieved by recording brain activity data, translating that data into a computer-understandable format, and then using the resulting signals to control the device or machine.

[0149] Examples of BMI technology types include:

[0150] BMI based on electroencephalography (EEG) uses electrodes placed on the scalp to record electrical activity in the brain.

[0151] Invasive BMI, which uses electrodes surgically implanted into the brain.

[0152] Optogenetics BMI uses light to control the activity of specific nerve cells in the brain.

[0153] Any biometric data collected by the biometric component is captured and stored only with user approval and is deleted upon user request. Furthermore, such biometric data may be used for very limited purposes, such as authentication. To ensure the restricted and authorized use of biometric information and other personally identifiable information (PII), access to the data is limited to authorized personnel (if applicable). Any use of biometric data may be strictly limited to authentication purposes, and biometric data will not be shared or sold to any third party without the user's explicit consent. In addition, appropriate technical and organizational measures are implemented to ensure the security and confidentiality of this sensitive information.

[0154] Moving components include accelerometer components (e.g., accelerometers), gravity sensor components, rotation sensor components (e.g., gyroscopes), etc. Positioning components include position sensor components (e.g., GPS receiver components) for generating position coordinates, Wi-Fi or Bluetooth™ transceivers for generating positioning system coordinates, altitude sensor components (e.g., altimeters or barometers that detect air pressure, from which altitude can be determined), orientation sensor components (e.g., magnetometers), etc. Such positioning system coordinates can also be received from the mobile device 114 via low-power wireless circuitry system 734 or high-speed wireless circuitry system 732 through low-power wireless connection 712 and high-speed wireless connection 714.

[0155] Figure 8 This is an example process 800 suitable for use with the secure data vault system 132, according to some embodiments. In the depicted embodiment, at block 802, process 800 receives sensor data from various sensors of the AR and / or VR system (e.g., user system 102), such as sensors communicatively coupled to user system 102 (e.g., camera devices, microphones, gyroscopes, navigation system sensors, biometric sensors, etc.). In some embodiments, sensors are only coupled to the secure data vault system 132, and therefore only sensor signals are sent to the secure data vault system 132.

[0156] At block 804, process 800 processes sensor data within sandbox system 210. As previously described, sandbox system 210 can be a hardware-based system, such as an FPGA, one or more processors, and / or one or more custom chips. In operation, programs executable via sandbox system 210 (e.g., computer instructions) are isolated so that a program crash will not affect the unsandboxed system of the AR system. For example, sandbox system 210, via execution environment 212, does not allow execution of computer instructions outside a specified memory address range (e.g., memory external to sandbox system 210), and computer instructions are executed only by sandbox system 210.

[0157] Additionally, a security compatibility matrix is ​​used to restrict program execution within the sandbox system 210. For example, the security compatibility matrix includes rows storing unique process (e.g., computer program) identifier data, and columns storing instructions executable by the corresponding process identified by the process identifier data. That is, the columns include functions, methods, classes, and / or object-oriented objects executable by each process listed in the rows. In some examples, AI models are used to detect privacy information. For example, images, sounds, and / or geolocation information considered private can be detected via AI models. Then, processing of the sensor data at box 804 can blur images, mute sounds and / or add noise to sounds, remove geolocation information, etc., to protect user privacy. Processing of the sensor data at box 804 can also notify the user via text, images, and / or voice that privacy data is being detected and blurred.

[0158] Then, at box 806, process 800 renders the processed data. For example, an image with privacy data blurred by generative AI model 208 can be rendered via display and rendering system 218. Similarly, sound can be rendered with injected noise or muted to protect privacy. Output for AR / VR experiences can also be generated, for example, via generative AI model 208. Then, at box 808, the rendered image and / or sound is displayed together with the surrounding real-world environment. For example, a view of a driver's license being viewed can now be displayed blurred, while the surrounding real-world environment (such as the table where the driver's license is located) is displayed unblurred. The image also includes rendered 3D images of virtual objects, avatars, etc., which can be overlaid on the surrounding real-world environment. By applying the secure data vault system 132, the techniques described herein improve security and privacy.

[0159] Machine architecture

[0160] Figure 9This is a schematic representation of machine 900, within which instructions 902 (e.g., software, programs, applications, applets, or other executable code) can be executed to cause machine 900 to perform any or more of the methods discussed herein. For example, instructions 902 can cause machine 900 to perform any or more of the methods described herein. Instructions 902 transform the general, unprogrammed machine 900 into a specific machine 900 programmed to perform the described and illustrated functions in the described manner. Machine 900 can operate as a standalone device or can be coupled (e.g., networked) to other machines. In a networked deployment, machine 900 can operate as a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. Machine 900 may include, but is not limited to, server computers, client computers, personal computers (PCs), tablet computers, laptop computers, netbooks, set-top boxes (STBs), personal digital assistants (PDAs), entertainment media systems, cellular phones, smartphones, mobile devices, wearable devices (e.g., smartwatches), smart home devices (e.g., smart appliances), other smart devices, web devices, network routers, network switches, network bridges, or any machine capable of sequentially or otherwise executing instructions 902 specifying actions to be taken by machine 900. Furthermore, although only a single machine 900 is shown, the term "machine" should also be considered as a collection of machines that individually or jointly execute instructions 902 to perform any one or more of the methods discussed herein. Machine 900 may, for example, include user system 102 or any of a plurality of server devices forming part of interactive server system 110. In some examples, machine 900 may also include both client and server systems, wherein certain operations of a particular method or algorithm are performed on the server side and certain operations of said particular method or algorithm are performed on the client side.

[0161] Machine 900 may include a processor 904, a memory 906, and input / output (I / O) components 908 that can be configured to communicate with each other via a bus 910. In the example, processor 904 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, processors 912 and 914 that execute instruction 902. The term "processor" is intended to include multi-core processors, which may include two or more independent processors (sometimes referred to as "cores") capable of executing instructions simultaneously. Although Figure 9Multiple processors 904 are shown, but machine 900 may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0162] Memory 906 includes main memory 916, static memory 918, and memory cells 920, all of which are accessible by processor 904 via bus 910. Main memory 906, static memory 918, and memory cells 920 store instructions 902 that implement any one or more of the methods or functions described herein. Instructions 902 may also reside wholly or partially within main memory 916, static memory 918, machine-readable medium 922 within memory cells 920, at least one processor of processor 904 (e.g., within the processor's cache memory), or any suitable combination thereof during execution by machine 900.

[0163] I / O component 908 may include various components for receiving input, providing output, generating output, sending information, exchanging information, capturing measurement results, etc. The specific I / O component 908 included in a particular machine will depend on the type of machine. For example, a portable machine such as a mobile phone may include a touch input device or other such input mechanism, while a headless server machine is unlikely to include such a touch input device. It should be recognized that I / O component 908 may include... Figure 9 Many other components are not shown. In various examples, I / O component 908 may include user output component 924 and user input component 926. User output component 924 may include visual components (e.g., displays such as plasma display panels (PDPs), light-emitting diode (LED) displays, liquid crystal displays (LCDs), projectors, or cathode ray tube (CRT) displays), acoustic components (e.g., speakers), haptic components (e.g., vibration motors, resistance mechanisms), other signal generators, etc. User input component 926 may include alphanumeric input components (e.g., keyboards, touchscreens configured to receive alphanumeric input, photoelectric keyboards, or other alphanumeric input components), pointing-based input components (e.g., mice, touchpads, trackballs, joysticks, motion sensors, or other pointing instruments), haptic input components (e.g., physical buttons, touchscreens or other haptic input components that provide the position and force of a touch or touch gesture), audio input components (e.g., microphones), etc.

[0164] In other examples, I / O component 908 may include biometric component 928, motion component 930, environmental component 932, or positioning component 934, as well as a wide range of other components. For example, biometric component 928 includes components for detecting expressions (e.g., hand expressions, facial expressions, vocal expressions, body posture, or eye tracking), measuring biosignals (e.g., blood pressure, heart rate, body temperature, sweat, or brain waves), and recognizing people (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition). Biometric component may include a brain-computer interface (BMI) system that allows communication between the brain and external devices or machines. This can be achieved by recording brain activity data, converting this data into a computer-understandable format, and then using the resulting signals to control the device or machine.

[0165] Examples of BMI technology types include:

[0166] BMI based on electroencephalography (EEG) uses electrodes placed on the scalp to record electrical activity in the brain.

[0167] Invasive BMI, which uses electrodes surgically implanted into the brain.

[0168] Optogenetics BMI uses light to control the activity of specific nerve cells in the brain.

[0169] Any biometric data collected by the biometric component is captured and stored only with user approval and deleted upon user request. Furthermore, such biometric data may be used for very limited purposes, such as authentication. To ensure the restricted and authorized use of biometric information and other personally identifiable information (PII), access to the data is limited to authorized personnel (if necessary). Any use of biometric data may be strictly limited to authentication purposes, and the data will not be shared or sold to any third party without the user's explicit consent. In addition, appropriate technical and organizational measures are implemented to ensure the security and confidentiality of this sensitive information.

[0170] The moving part 930 includes an acceleration sensor part (e.g., an accelerometer), a gravity sensor part, and a rotation sensor part (e.g., a gyroscope).

[0171] The environmental component 932 includes, for example, one or more camera devices (with still image / photograph and video capabilities), lighting sensor components (e.g., photometers), temperature sensor components (e.g., one or more thermometers for detecting ambient temperature), humidity sensor components, pressure sensor components (e.g., barometers), acoustic sensor components (e.g., one or more microphones for detecting background noise), proximity sensor components (e.g., infrared sensors for detecting nearby objects), gas sensors (e.g., gas detection sensors for detecting the concentration of hazardous gases for safety purposes or for measuring pollutants in the atmosphere), or other components that can provide indications, measurements, or signals corresponding to the surrounding physical environment.

[0172] Regarding the camera device, user system 102 may have a camera device system including, for example, a front-facing camera on the front surface of user system 102 and a rear-facing camera on the rear surface of user system 102. The front-facing camera may be used, for example, to capture still images and videos (e.g., “selfies”) of the user of user system 102, which can then be enhanced with the aforementioned enhancement data (e.g., filters). For example, the rear-facing camera may be used to capture still images and videos in a more conventional camera device mode, wherein these images are similarly enhanced with enhancement data. In addition to the front-facing and rear-facing cameras, user system 102 may also include a 360° camera for capturing 360° photos and videos.

[0173] Furthermore, the camera system of user system 102 may include dual rear cameras (e.g., a main camera and a depth-sensing camera), or even triple, quadruple, or quintuple rear camera configurations on the front and rear sides of user system 102. For example, these multi-camera systems may include wide-angle cameras, ultra-wide-angle cameras, telephoto cameras, macro cameras, and depth sensors.

[0174] The positioning component 934 includes a position sensor component (e.g., a GPS receiver component), an altitude sensor component (e.g., an altimeter or barometer that detects air pressure and from which altitude can be obtained), an orientation sensor component (e.g., a magnetometer), etc.

[0175] Various technologies can be used to achieve communication. I / O component 908 also includes communication component 936, which is operable to couple machine 900 to network 938 or device 940 via a suitable coupling or connection. For example, communication component 936 may include a network interface component or another suitable device that interfaces with network 938. In other examples, communication component 936 may include wired communication components, wireless communication components, cellular communication components, near field communication (NFC) components, Bluetooth® components (e.g., Bluetooth® Low Energy), Wi-Fi® components, and other communication components for providing communication via other modalities. Device 940 may be another machine or any peripheral device from various peripheral devices (e.g., a peripheral device coupled via USB).

[0176] Furthermore, the communication component 936 can detect identifiers, or include components operable to detect identifiers. For example, the communication component 936 may include a radio frequency identification (RFID) tag reader component, an NFC smart tag detection component, an optical reader component (e.g., an optical sensor for detecting one-dimensional barcodes such as Universal Product Code (UPC) barcodes, multi-dimensional barcodes such as Quick Response (QR) codes, Aztec codes, Data Matrix, Dataglyph™, MaxiCode, PDF417, Ultra Code, UCC RSS-2D barcodes, and other optical codes), or an acoustic detection component (e.g., a microphone for identifying audio signals from the tag). Additionally, various information can be obtained via the communication component 936, such as location via Internet Protocol (IP) geolocation, location via Wi-Fi® signal triangulation, location by detecting NFC beacon signals that can indicate a specific location, etc.

[0177] Various memories (e.g., main memory 916, static memory 918, and the memory of processor 904) and storage unit 920 may store one or more sets of instructions and data structures (e.g., software) implemented or used by any or more of the methods or functions described herein. These instructions (e.g., instruction 902) cause various operations to implement the disclosed examples when executed by processor 904.

[0178] Instructions 902 can be sent or received over network 938 using a transmission medium via a network interface device (e.g., a network interface component included in communication component 936) and using any of several known transmission protocols (e.g., Hypertext Transfer Protocol (HTTP)). Similarly, instructions 902 can be sent or received using a transmission medium via coupling to device 940 (e.g., peer-to-peer coupling).

[0179] Software Architecture

[0180] Figure 10 This is a block diagram 1000 illustrating a software architecture 1002 that can be installed on any one or more of the devices described herein. The software architecture 1002 is supported by hardware, such as a machine 1004 including a processor 1006, memory 1008, and I / O components 1010. In this example, the software architecture 1002 can be conceptualized as a stack of layers, where each layer provides a specific function. The software architecture 1002 includes layers such as an operating system 1012, libraries 1014, frameworks 1016, and applications 1018. Operationally, application 1018 activates API call 1020 via the software stack and receives message 1022 in response to API call 1020.

[0181] Operating system 1012 manages hardware resources and provides public services. Operating system 1012 includes, for example, a kernel 1024, services 1026, and drivers 1028. Kernel 1024 serves as an abstraction layer between hardware and other software layers. For example, kernel 1024 provides memory management, processor management (e.g., scheduling), component management, networking and security settings, and other functions. Services 1026 can provide other public services to other software layers. Drivers 1028 are responsible for controlling or interfacing with the underlying hardware. For example, drivers 1028 may include display drivers, camera drivers, BLUETOOTH® or BLUETOOTH® low-power drivers, flash memory drivers, serial communication drivers (e.g., USB drivers), Wi-Fi® drivers, audio drivers, power management drivers, etc.

[0182] Library 1014 provides common low-level infrastructure used by application 1018. Library 1014 may include system library 1030 (e.g., the C standard library), which provides functions such as memory allocation, string manipulation, and mathematical functions. Additionally, library 1014 may include API library 1032, such as media libraries (e.g., libraries for supporting the rendering and manipulation of various media formats, such as Moving Picture Experts Group-4 (MPEG4), Advanced Video Coding (H.264 or AVC), Moving Picture Experts Group Layer-3 (MP3), Advanced Audio Coding (AAC), Adaptive Multi-Rate (AMR) audio codec, Joint Picture Experts Group (JPEG or JPG), or Portable Web Graphics (PNG)), graphics libraries (e.g., OpenGL frameworks for rendering graphic content on a display in two-dimensional (2D) and three-dimensional (3D) formats), database libraries (e.g., SQLite, which provides various relational database functions), web libraries (e.g., WebKit, which provides web browsing capabilities), and so on. Library 1014 may also include a wide variety of other libraries 1034 to provide many other APIs to application 1018.

[0183] Framework 1016 provides common high-level infrastructure for use by Application 1018. For example, Framework 1016 provides various graphical user interface (GUI) functions, high-level resource management, and high-level location services. Framework 1016 can provide a wide range of other APIs that can be used by Application 1018, some of which may be specific to a particular operating system or platform.

[0184] In the example, application 1018 may include home application 1036, contact application 1038, browser application 1040, book reader application 1042, location application 1044, media application 1046, messaging application 1048, game application 1050, and a variety of other applications such as third-party application 1052. Application 1018 is a program that performs the functions defined in the program. One or more applications of application 1018 can be created using various programming languages, such as object-oriented programming languages ​​(e.g., Objective-C, Java, or C++) or procedural programming languages ​​(e.g., C or assembly language). In a particular example, third-party application 1052 (e.g., an application developed by an entity other than a platform vendor using the Android™ or iOS™ Software Development Kit (SDK)) may be mobile software that runs on mobile operating systems such as iOS™, Android™, Windows® Phone, or other mobile operating systems. In this example, a third-party application 1052 can activate API call 1020 provided by the operating system 1012 to facilitate the functionality described herein.

[0185] Glossary

[0186] "Carrier signal" refers to any intangible medium, such as a medium capable of storing, encoding, or carrying instructions to be executed by a machine and including digital or analog communication signals, or other intangible medium that facilitates the communication of such instructions. Instructions can be sent or received over a network using a transmission medium via a network interface device.

[0187] "Client device" means any machine that interfaces with a communication network to obtain resources from one or more server systems or other client devices. Client devices can be, but are not limited to, mobile phones, desktop computers, laptop computers, portable digital assistants (PDAs), smartphones, tablet computers, ultrabooks, netbooks, laptop computers, multiprocessor systems, microprocessor-based or programmable consumer electronics, game consoles, set-top boxes, or any other communication device that a user can use to access the network.

[0188] "Communications network" means, for example, one or more parts of a network, which can be an ad hoc network, intranet, extranet, virtual private network (VPN), local area network (LAN), wireless LAN (WLAN), wide area network (WAN), wireless WAN (WWAN), metropolitan area network (MAN), the Internet, a part of the Internet, a part of the Public Switched Telephone Network (PSTN), a Common Old-Style Telephone Service (POTS) network, a cellular telephone network, a wireless network, a Wi-Fi® network, other types of networks, or a combination of two or more such networks. For example, a network or part of a network may include a wireless network or a cellular network, and the coupling may be a Code Division Multiple Access (CDMA) connection, a Global System for Mobile Communications (GSM) connection, or other types of cellular or wireless coupling. In this example, coupling can enable any data transmission technology of various types, such as single-carrier radio transmission technology (1xRTT), evolved data optimization (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rate GSM evolution (EDGE) technology, the 3rd Generation Partnership Project (3GPP) including 3G, fourth-generation wireless (4G) networks, Universal Mobile Telecommunications System (UMTS), High-Speed ​​Packet Access (HSPA), Global Microwave Access Interoperability (WiMAX), Long Term Evolution (LTE) standards, other data transmission technologies defined by various standards setting organizations, other long-distance protocols, or other data transmission technologies.

[0189] A “component” refers to a logical, device, or physical entity having boundaries defined by functional or subroutine calls, branch points, APIs, or other technologies that partition or modularize a particular processing or control function. A component can be combined with other components via its interface to perform machine processing. A component can be a packaged functional hardware unit designed for use with other components, or part of a program that typically performs a related function. A component can constitute a software component (e.g., code implemented on a machine-readable medium) or a hardware component. A “hardware component” is a tangible unit capable of performing certain operations and can be configured or arranged in some physical manner. In various examples, one or more computer systems (e.g., standalone computer systems, client computer systems, or server computer systems) or one or more hardware components (e.g., processors or processor groups) of a computer system can be configured by software (e.g., an application or application portion) to operate to perform certain operations as described herein. Hardware components can also be implemented mechanically, electronically, or in any suitable combination thereof. For example, a hardware component can include a dedicated circuit system or logic permanently configured to perform certain operations. Hardware components can be dedicated processors, such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs). Hardware components can also include programmable logic or circuit systems that are temporarily configured by software to perform certain operations. For example, a hardware component may include software executed by a general-purpose processor or other programmable processor. Once configured by such software, the hardware component becomes a specific machine (or a specific part of a machine) uniquely tailored to perform the configured function, and no longer a general-purpose processor. It will be appreciated that the decision to implement a hardware component mechanically in a dedicated and permanently configured circuit system or in a temporarily configured (e.g., software-configured) circuit system can be made for cost and time considerations. Therefore, the phrase "hardware component" (or "hardware-implemented component") should be understood to include tangible entities, i.e., entities physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain way or perform certain operations described herein. Consider the example of hardware components being temporarily configured (e.g., programmed), without requiring each of the hardware components to be configured or instantiated at any given time. For example, in cases where the hardware components include a general-purpose processor that is configured as a dedicated processor via software, this general-purpose processor can be configured at different times as its respective dedicated processor (e.g., including different hardware components). The software accordingly configures one or more specific processors to constitute a specific hardware component at one time and different hardware components at different times. Hardware components can provide information to and receive information from other hardware components. Therefore, the described hardware components can be considered communicatively coupled.In the presence of multiple hardware components, communication can be achieved through signal transmission between or among two or more hardware components (e.g., via appropriate circuitry and buses). In examples where multiple hardware components are configured or instantiated at different times, such communication between hardware components can be achieved, for example, by storing information in a memory structure accessible to the multiple hardware components and retrieving information from the memory structure. For example, a hardware component can perform an operation and store the output of that operation in a memory device communicatively coupled to it. Another hardware component can then access the memory device at a subsequent time to retrieve and process the stored output. Hardware components can also initiate communication with input or output devices and can operate on resources (e.g., collections of information). The various operations of the example methods described herein can be performed, at least in part, by one or more processors configured, either temporarily (e.g., by software) or permanently, to perform the relevant operations. Whether temporarily or permanently configured, such processors can constitute processor-implemented components that operate to perform one or more operations or functions described herein. As used herein, "processor-implemented component" refers to a hardware component implemented using one or more processors. Similarly, the methods described herein can be implemented at least in part by processors, where a particular processor or one or more processors are examples of hardware. For example, at least some of the operations of the methods can be performed by one or more processors or processor-implemented components. Furthermore, one or more processors can also operate to support the execution of related operations in a “cloud computing” environment or as a “Software as a Service” (SaaS) operation. For example, at least some of the operations can be performed by a group of computers (as an example of machines including processors), where these operations are accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs). The execution of some operations can be distributed among processors, not residing within a single machine, but deployed across multiple machines. In some examples, the processor or processor-implemented component can reside in a single geographic location (e.g., in a home environment, office environment, or server cluster). In other examples, the processor or processor-implemented component can be distributed across multiple geographic locations.

[0190] "Computer-readable storage medium" refers to both, for example, machine storage media and transmission media. Therefore, these terms include both storage devices / media and carrier / modulated data signals. The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" refer to the same thing and can be used interchangeably in this disclosure.

[0191] A "brief message" is a message that is accessible for a limited time, such as a short period of time. Brief messages can be text, images, videos, etc. The access time for a brief message can be set by the message sender. Alternatively, the access time can be a default setting or a setting specified by the recipient. Regardless of the setting method, the message is temporary.

[0192] "Machine storage medium" refers to, for example, a single or multiple storage devices and media (e.g., centralized or distributed databases, and associated caches and servers) that store executable instructions, routines, and data. Therefore, this term should be considered to include, but is not limited to, solid-state memory, as well as optical and magnetic media, including memory internal or external to the processor. Specific examples of machine storage media, computer storage media, and device storage media include: non-volatile memory, including, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), FPGAs, and flash memory devices; disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROMs and DVD-ROMs. The terms "machine storage medium," "device storage medium," and "computer storage medium" mean the same thing and may be used interchangeably in this disclosure. The terms "machine storage medium," "computer storage medium," and "device storage medium" expressly exclude carrier waves, modulated data signals, and other such media, at least some of which are covered by the term "signal medium."

[0193] "Non-transitory computer-readable storage medium" means, for example, a tangible medium capable of storing, encoding, or carrying instructions that can be executed by a machine.

[0194] "Signal medium" means any intangible medium capable of storing, encoding, or carrying instructions that can be executed by a machine, and includes digital or analog communication signals or other intangible media that facilitate the communication of software or data. The term "signal medium" should be considered to include any form of modulated data signal, carrier wave, etc. The term "modulated data signal" means a signal whose characteristics are set or altered in a manner that encodes information in the signal. The terms "transmission medium" and "signal medium" mean the same thing and may be used interchangeably in this disclosure.

[0195] "User equipment" means, for example, a device that is accessed, controlled, or owned by a user, with which the user interacts, performs actions, or engages in interactions (including interactions with other users or computer systems).

Claims

1. A generative artificial intelligence (AI) system, comprising: A generative AI model, which is configured to generate output based on a training dataset; A secure data vault system, comprising: A sandbox system that stores the generative AI model and is operatively coupled to the generative AI model to send inputs to generate the outputs from the generative AI model, wherein the sandbox system includes an execution environment configured to restrict the execution of the generative AI model to a predefined range of memory addresses; and A secure network service is communicatively coupled to the sandbox system and configured to authenticate connections to external systems and download update packages for the generative AI model from the external systems when the connection is authenticated.

2. The system of claim 1, further comprising an augmented reality (AR) system, the AR system including a display and a camera device, wherein, The sandbox system is operatively coupled to the camera device and configured to receive camera device data from the camera device, wherein, in operation of the AR system, the camera device only sends camera device data to the sandbox system, and wherein the sandbox system sends the camera device data as input to the generative AI model to be processed by the generative AI model to generate new images, videos, text, or combinations thereof as output to be displayed via the display, wherein the new images, videos, text, or combinations thereof are overlaid on real-world environment images provided by the AR system.

3. The system according to claim 1, comprising a virtual reality (VR) system, the VR system including a display and a camera device, wherein, The sandbox system is operatively coupled to the camera device and configured to receive camera device data from the camera device, wherein, in operation of the VR system, the camera device only sends camera device data to the sandbox system, and wherein the sandbox system sends the camera device data as input to the generative AI model to be processed by the generative AI model to generate new images, videos, text, or combinations thereof as output to be displayed via the display, wherein the new images, videos, text, or combinations thereof are displayed as part of a virtual environment provided by the VR system.

4. The system of claim 1, further comprising a hardware-based system configured to execute the sandbox system within a virtual machine.

5. The system according to claim 1, wherein, The generative AI model includes: a variational autoencoder (VAE) model configured to learn a probabilistic mapping between data and a latent space via the training dataset; a generative adversarial network (GAN) model including a generator and a discriminator trained in a competitive manner; a recurrent neural network (RNN) model that computes time steps dependent on previous time steps; a Transformer model for generating sequential data; an autoencoder model for data compression and generation by learning to reconstruct input data from a low-dimensional representation via the training dataset; or a combination thereof.

6. The system according to claim 1, wherein, The generative AI model is configured to partially obscure the real-world environment based on privacy information.

7. The system according to claim 1, wherein, The execution environment is configured to receive an identifier of the process of a subset of instructions included in the request execution process, and to verify, based on the identifier, that the process is permitted to execute the subset of instructions.

8. The system according to claim 7, wherein, The execution environment is configured to verify, based on the identifier and the data storage included in the secure data vault system, that the process is permitted to execute the subset of the instructions.

9. The system according to claim 8, wherein, The data storage includes a security compatibility matrix, which comprises multiple rows and multiple columns.

10. The system according to claim 9, wherein, The plurality of rows include a plurality of unique process identifier data, and wherein the plurality of columns include a plurality of instructions that can be executed by the corresponding process identified by the process identifier data.

11. The system according to claim 10, wherein, The plurality of instructions include functions, methods, classes, object-oriented objects, or combinations thereof.

12. The system according to claim 1, wherein, The execution environment is configured to isolate the execution of a program comprising multiple program instructions, such that a crash of the program does not affect other systems, including AR systems, VR systems, or combinations thereof, and wherein the generative AI system is included in the AR system, the VR system, or the combination thereof.

13. The system according to claim 12, wherein, The execution environment is configured to disallow the execution of any of the plurality of program instructions that access memory addresses outside of the specified memory address range included in the predefined memory address range.

14. The system according to claim 1, wherein, The update package includes computer instructions configured to update the generative AI model to a newer model version.

15. The system according to claim 14, wherein, The update package includes computer instructions configured to update the sandbox system to a newer version.

16. The system according to claim 15, wherein, The secure network service is configured to verify the validity of the update package based on the key used to encrypt the update package.

17. The system of claim 1, further comprising a display and rendering system operatively coupled only to the sandbox system and configured to display an image based solely on data received via the sandbox system.

18. The system according to claim 1, wherein, The secure data vault system includes a secure application programming interface (API) configured to authenticate access to the sandbox system and provide one or more programming interfaces for executing instructions via the sandbox system.

19. A method comprising: Generative AI models are stored in a secure data vault system that includes a sandbox system, and these generative AI models are configured to generate outputs based on a training dataset. Input is received via the secure data vault system; The input is sent to the generative AI model to generate the output from the generative AI model, wherein the sandbox system includes an execution environment configured to restrict the execution of the generative AI model to a predefined range of memory addresses; Connections to external systems are authenticated via secure network services coupled to the sandbox system; and When the connection is authenticated, an update package for the generative AI model is downloaded from the external system.

20. A non-transitory machine-readable medium storing instructions that, when executed by a computer system, cause the computer system to perform operations, the operations including: Generative AI models are stored in a secure data vault system that includes a sandbox system, and these generative AI models are configured to generate outputs based on a training dataset. Input is received via the secure data vault system; The input is sent to the generative AI model to generate the output from the generative AI model, wherein the sandbox system includes an execution environment configured to restrict the execution of the generative AI model to a predefined range of memory addresses; Connections to external systems are authenticated via secure network services coupled to the sandbox system; and When the connection is authenticated, an update package for the generative AI model is downloaded from the external system.

Images