Abstract: Various techniques and mechanisms for sharing remote resources among a trusted group are disclosed. A credential management agent utilizes a resource credential for a first user to access a secure resource corresponding to the first user for a second user by at least validating a second user and validating a consent of the first user to allow the second user to access the secure resource using the resource credential for the first user. The secure resource resides on a remote server system accessible via one or more application program interfaces (APIs). A platform management agent provides an interface for shared resource-agnostic credential sharing. The platform management agent validates credentials for the second user as belonging to a trusted group and forwards a request for access to the secure resource for the second user to the credential management agent.

Abstract: Techniques are disclosed relating to multi-tenant database systems with underlying key/value storage. In some embodiments, a computing system generates first logical table information for a first portion of a multi-tenant dataset corresponding to a first tenant and second logical table information for a second portion of the dataset corresponding to a second tenant. The system may store the first and second logical tables using non-relational key/value data structures in one or more storage elements, including: storing entries from the first logical table across a first set of multiple key/value store buckets and storing entries from the second logical table across a second set of multiple key/value store buckets. Disclosed techniques may reduce performance issues due to hotspots while allowing efficient data access for a given tenant by limiting the number of buckets per tenant, relative to traditional techniques.

Abstract: Embodiments described herein provide visual-and-language (V+L) systems and methods for learning vision and language representations. Specifically, a method may comprise receiving a training dataset comprising a plurality of image samples and a plurality of text samples; encoding the plurality of image samples into a plurality of encoded image samples and the plurality of text samples into a plurality of encoded text samples; computing a first loss objective based on the plurality of encoded image samples and the plurality of encoded text samples; encoding a first subset of the plurality of encoded image samples and a second subset of the plurality of encoded text samples into a plurality of encoded image-text samples; computing a second loss objective based on the plurality of encoded image-text samples; and updating the V+L model based at least in part on the first loss objective and the second loss objective.

Abstract: Embodiments described herein adopts a k nearest neighbor (kNN) mechanism over a model's hidden representations to identify training examples closest to a given test example. Specifically, a training set of sequences and a test sequence are received, each of which is mapped to a respective hidden representation vector using a base model. A set of indices for each sequence index that minimizes a distance between the respective hidden state vector and a test hidden state vector is then determined A weighted k-nearest neighbor probability score can then be computed from the set of indices to generate a probability distribution over labels for the test sequence.

Abstract: Systems, devices, and techniques are disclosed for cryptographic key migration. A tenant host may determine a first Key Management Service (KMS) indicated as storing a cryptographic key associated with the tenant host from a new KMS mapping. The tenant host may send a request for the cryptographic key associated with the tenant host to the first KMS. The tenant host may receive an indication from the first KMS that the first KMS does not store the cryptographic key. The tenant host may determine a second KMS indicated as storing the cryptographic key associated with the tenant host from an original KMS mapping. The tenant host may receive the cryptographic key associated with the tenant host from the second KMS. The tenant host may send a request to the second KMS that the cryptographic key associated with the tenant host be replicated from the second KMS to the first KMS.

Abstract: A method receives an input file. The input file includes a plurality of entries where different entries are associated with a different characteristic. A selection of a guide for an entry is determined where a guide includes guidelines for formatting content in an entry in the plurality of entries. The method performs analyzing an image from the entry to generate image variations. Then, the method analyzes the image and the image variations to place text items from the entry in the image and the image variations where the text items in the image and the image variations are formatted based on the guidelines in the guide for the entry. A plurality of design variants is generated for the entry based on the image and the image variations that include text items.

Abstract: Connections among two different entities are identified by processing a collection of documents to identify one or more documents that contain co-occurring mentions of each of the two different entities. This relationship may be graphically displayed in a user interface with an icon or the like for each of the two entities, along with a graphical link interconnecting the entities. The graphical link can be an active element of the user interface that responds to user interactions by providing access to evidence within the collection of documents that substantiates the connection between the two entities. In one aspect, a search input form field in a user interface may be used to explicitly request documents that substantiate a relationship between two entities. In another aspect, a user may ground entity mentions by explicitly selecting documents that mention an entity of interest.

Abstract: Systems and methods may include obtaining data identifying a plurality of cancelled health-related appointments for a plurality of patient records stored in a database, the cancelled health-related appointments associated with a shared health event; associating each of the plurality of patient records with a risk category from a plurality of risk categories ranging from a lowest risk to a highest risk; communicating with a client computing device associated with a patient having a cancelled health-related appointment to schedule a return appointment based at least on a risk category, the communicating including receiving current health condition information of the patient; based on the current health condition information of the patient showing symptoms consistent with symptoms associated with the shared health event, identifying the patient as a potential infected patient; and performing contact tracing based at least on people that the patient has contact with while experiencing the symptoms.

Abstract: Embodiments described herein provide a multi-modal search-and-summarize tool for message platforms. Specifically, the multi-modal search-and-summarize tool may monitor conversational content of different formats, e.g., text, image, video, etc., and use multi-modal summarization models to generate a summary of the conversation channel. The summarization may be conducted via a search-and-summarize process in response to a specific user query, e.g., a user may enter “what did John and Josh say about the presentation tomorrow?” The multi-modal summarization model would first search for relevant conversation messages between user John and user Josh, identify communication files of different format (e.g., text messages, emojis, multimedia attachments, etc.), and then input the communication files to respective text or image encoders to generate a summary of the communication content.

Abstract: The disclosed techniques automatically ingest new documents and store data extracted from the documents in a database for conversion into a different format. The disclosed techniques identify, via a backend API, newly released documents that include data for users and, based on the identifying, automatically ingest, via an ingestion call executed made by the backend API, the newly released documents. The disclosed techniques extract, using a computer vision model trained on different types of documents, a data from the newly released documents, where the extracting includes identifying locations within the documents from which to extract data. The disclosed techniques store the extracted data in the database storing data extracted from previously ingested documents for users in a text-based object format and convert, using a machine learning model trained on a plurality of metatags, data corresponding to a given user from the text-based object format to a queryable file format.

Abstract: System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.

Abstract: System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.

Abstract: System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.

Abstract: System and method for fine granularity control of data access and usage for across multi-tenant systems. A user makes a request to access a particular set of data from a particular remote data source for a specific purpose. The system authorizes the user to validate whether the user is qualified to make the request. The data source is checked to see if the particular data has been granted access for that particular purpose. A cloud neutral token is created and converted into a cloud specific token upon reaching the remote data source. The cloud specific token is used to create a temporary IAM role and IAM policy with a predetermined time to live. After the time to live expires, the IAM role and IAM policy are deleted.

Abstract: Dialogue summarization is challenging due to its multi-speaker standpoints, casual spoken language style, and limited labelled data. The embodiments are directed to a coarse-to-fine dialogue summarization model that improves abstractive dialogue summarization quality and enables granular controllability. A summary draft that includes key words for turns in a dialogue conversation history is created. The summary draft includes pseudo-labelled interrogative pronoun categories and noisy key phrases. The dialogue conversation history is divided into segments. A generate language model is trained to generate a segment summary for each dialogue segment using a portion of the summary draft that corresponds to at least one dialogue turn in the dialogue segment. A dialogue summary is generated using the generative language model trained using the summary draft.

Abstract: Apparatus and method for a scalable pricing engine. A scalable pricing engine is operable in a low-scale mode and a high-scale or scalable mode to process pricing data in response to pricing requests. The pricing engine operates in a first runtime environment in the low-scale mode in which it can service pricing requests up to a threshold number and in which the pricing data can be updated and tested. The pricing engine also operates in a second runtime environment which is a scalable runtime supporting pricing requests above the specified threshold. The scalable runtime and pricing engine rely on a scalable read-only data service which distributes a read-only copy of at least a portion of the pricing data from the primary database, a high-scale cache to reduce access latency, data processing and network resource allocations, and data reduction techniques when processing requests and responses.

Abstract: A system provides a framework for testing template code processed by a templating engine. A multitenant system may use template code for implementing Infrastructure as Code (IAC), for example, to generate pipelines for deploying software or provisioning resources for a datacenter configured in a cloud platform. The system sets the search path in a template engine environment object dynamically for each template file. The system allows testing of macros used by the template engine. The system converts the macros to callable entities that can be invoked by test cases. The system allows developers to finding code defects earlier and increase application availability. The system provides flexibility in testing and automation in running the tests. Furthermore, the system allows a separation of production code with unit tests.

Abstract: A method that includes receiving a first request for a data object associated with a communication process flow that controls electronic communications between a tenant and a set of users corresponding to the tenant. The first request may include a set of querying parameters and a set of triggering parameters. The method may further include querying, based on the set of querying parameters, a communication process flow management service for data associated with the communication process flow. The method may further include generating, based on the querying, the data object that includes the data associated with the communication process flow. The method may further include transmitting, to a communication platform in accordance with the set of triggering parameters, a second request that comprises the data object. The second request may cause posting of an entry of the data object into a communication channel of the communication platform.

Abstract: A computing device receives a user input to add a data visualization to a first visualization card in a first scene of an interactive presentation. In response to the user input, when the first scene is an initial scene to be added, the device computes, for each metric of a plurality of metrics, a respective parameter that measures the variability of values of the respective metric, and identifies a first subset of metrics based on the computed parameters. The device generates a respective data visualization for each metric. The device displays a plurality of the generated data visualizations. The device receives user selection of a first data visualization of the plurality of data visualizations, corresponding to a first metric of the subset of metrics. In response to the user selection, the device populates the first visualization card with the first data visualization.

Abstract: Techniques are provided for thwarting attackers in a computing system which uses network management interfaces (NMIs). Before submitting NMI form data, a user computing device queries a server using a user id to obtain a signature which defines a shuffling map and random data such as a random key. The NMI form data is divided into portions and the random data is appended to each portion to provide respective data units, or buckets of data. The data units are then shuffled according to the shuffling map before being transmitted to a server, with the signature or an identifier of the signature included in a header. At the server, the data units are unshuffled to recover the data units, and the random data is removed to recover the form data portions. The instructions of the form data can then be executed.

Abstract: Disclosed herein are system, method, and computer program product embodiments for providing asynchronous backend processing of complex, time consuming, and/or expensive jobs. A command line interface (CLI) provides a command interface between a user and a backend processing server. The CLI sends a job request to the backend server, which immediately replies to the request with a confirmation message that includes a job identifier. This response is sufficient to allow the CLI to end its wait for the job response. Meanwhile, the backend server carries out the job by parsing the job into component tasks according to a declaration file and assigns those different tasks to different work servers. The backend server functions as a master server, tracking the statuses of the different tasks and assigning out new tasks until the job is complete. An overall job status is provided to the CLI upon request by referencing the job identifier.

Abstract: A method and system for generating a digital access token consumable by a piggy-back service system has been developed. A request for a digital access token for a client is received. The digital access token is associated with a tenant. At least one standard claim associated with a client attribute of the client is generated. The digital access token includes a header, a payload, and a signature. The payload includes the at least one standard claim associated with the client attribute. The digital access token enables the piggy-back service system to independently authorize access by the client to at least one service at the piggy-back service system based on the at least one standard claim. The digital access token is transmitted to a first device associated with the client.

Abstract: Described herein is a system and method for capturing data associated with actions attempted by an automated agent. The system described herein captures data associated with the actions attempted by an automated agent during the messaging session between an automated agent and the user and present a summary of the actions in a messaging platform. In an embodiment, the automated agent uploads data associated with actions attempted during the messaging session to a server. The server captures the data associated with the actions and generates a description of each action that was attempted. The server generates a summary including the description of each action. The summary of the actions are rendered in the messaging platform.

Abstract: Disclosed are some implementations of systems, apparatus, methods and computer program products for implementing a bi-level subscription process. A server computing device subscribes to a global topic. The server computing device receives a discovery message published to the global topic, where the discovery message specifies an instance name, a data center, and an instance URL. The server computing device subscribes to a regional topic having the instance name. The server computing device receives a metadata message published to the regional topic having the instance name, where the metadata message includes a tenant identifier, source information pertaining to a source from which events are to be obtained, and destination information pertaining to a destination via which the events are to be transmitted. The server computing device stores the source information and destination information in association with the tenant identifier, obtains events from the source and transmits the events to the destination.

Abstract: Message moderation is described herein. In an example, a message posted to a virtual space of a communication platform can be flagged for review by a reviewer (e.g., an administrator or other user permissioned to review messages). In some examples, such a reviewer can review a flagged message and determine one or more actions to be performed. Such actions can include removing the message from presentation via the communication platform, modifying presentation of the message via a user interface of the communication platform, replying to the message (e.g., to suggest taking the conversation offline or to another virtual space), disabling interaction with the message, and/or the like. Message moderation, as described herein, can streamline resolution of conversations that become out of hand and/or off topic.

Abstract: Systems, devices, and techniques are disclosed for maintaining service availability. Files including code written using a Domain Specific Language (DSL) for network security may be received. A knowledge graph including connections between services may be generated from the code written using the DSL in the files. A service that will have an availability issue may be determined based on the connections between services in the knowledge graph. The service that will have the availability issue may be replicated. The replication of the service that will have the availability issue may occur before the service has the availability issue.

Abstract: A computer-implemented method is disclosed. The method includes receiving a request from a client device for a field value information in a view of a web client application that includes a web browser application. The method further includes generating a real value of the field value information that includes field value characters arranged in an original order, generating elements of the web browser application that includes several random characters and the field value characters, and assigning and positioning unique identity numbers within the elements. The method also includes arranging the elements in a random order different than the original order of the field value characters to form a protected text string, providing the protected text string and a protected rendering rule for rendering to the web browser application. The protected rendering rule causes the web client application to display the field value information for the intended user.

Abstract: An object interface for quick access to object(s) of a communication platform is described. Server(s) of the communication platform can receive, in association with a user interface of the communication platform, a request to associate an object with an object interface associated with a virtual space of the communication platform. The server(s) can cause one or more objects to be presented via the user interface and can receive a selection of a particular object from the one or more objects. The server(s) can cause, in response to the selection, a user interface element representative of the particular object to be associated with the object interface, wherein the user interface element is associated with an actuation mechanism that, when actuated, causes the particular object to be presented via the user interface. Notifications associated with the particular object can be indicated by annotation(s) to the user interface.

Abstract: Techniques are disclosed relating to a database recovery routine to start up a database system in response to a database failure. The database system accesses checkpoint information identifying a set of active database transactions that were active at a flush point that occurred before the database failure. As a part of the database recovery routine, the database system replays database transactions that occurred between a recovery point and the flush point. The database transactions include the set of active database transactions but exclude any committed or aborted database transactions that occurred between the recovery point and the flush point such that less than a total number of database transactions occurring between the recovery point and the flush point are replayed. The database system further replays, without excluding committed or aborted database transactions, database transactions occurring between the flush point and a recovery end point at which the database failure occurred.

Abstract: A method and system enables communications with a call center via SMS/MMS and provides an additional communications channel to communicate with the call center in addition to voice, Internet email/IM chat and fax. The call center obtains location information and images from a customer using SMS messages and web pages via a messaging hub.

Abstract: Method, apparatus and computer program product for seamless communication resource transition are described herein. A user may wish to share an external communication resource within a group-based communication system. Settings may be provided allowing the user to more effectively share the external communication resource. The user may select the appropriate settings such that the external communication resource can be transmitted to the group-based communication system for display in accordance with the selected settings.

Abstract: Methods, systems, and devices for data processing in a computing system are described. The computing system may receive a notification of an update to network security objects hosted in diverse substrates within the computing system. The computing system may retrieve a network security policy for a service instance impacted by the update. The computing system may update the network security policy for the service instance according to a network security configuration of the hosting substrate. The computing system may translate the updated network security policy into access control lists (ACLs) for network entities managing communications between service instances within the computing system. The computing system may store the ACLs in respective data repositories that are accessible to the network entities. The computing system may transmit a notification that the ACLs are available for deployment, thereby causing the network entities to retrieve the ACLs from the respective data repositories.

Abstract: A computing services environment may include a database system, a generative language model interface, a communication interface, and a messaging interface. The database system may store database records reflecting interactions between tenants of the computer services environment and individuals interacting with the tenants, and may determine an input description of a communication campaign between a tenant of the plurality of tenants and a corresponding segment of the individuals. The generative language model interface may determine a textual description of one or more elements of the communication campaign by completing a campaign brief generation prompt via a generative language model. The communication interface may transmit to a client machine authenticated to a database system account linked to the tenant an instruction to generate a graphical user interface at the client machine. The messaging interface may transmit messages based on the input description and the refinement.

Abstract: Disclosed herein are system, method, and computer program product embodiments for implementing global rate limiting of an API cluster capable of dynamically implementing updates without a restart of any instantiation within the API cluster. A local service includes an envoy and a customer resource definition. When an update is received, the customer resource definition identifies changes to be made to a global rate limiting service and dynamically injects those changes into the global rate limiting service. The changes can be instance-specific, with multiple different versions stored for the various instantiations within the cluster. The envoy also extracts and converts header information from a received request into one or more descriptor keys. The global rate limiting service determine global rate limiting based on a set of rules applied to the descriptor keys.

Abstract: Techniques are disclosed pertaining to migrating a database between different storage clusters. A computer system identifies a current state of the database that is managed by a database application that enables a client application to access data of the database stored at a first storage cluster. The computer system copies first particular data of the database that is associated with the current state from the first storage cluster to a second storage cluster. After the copying, the computer system transitions the database application into a read-only mode in which it processes read but not write traffic. The computer system copies, from the first storage cluster to the second storage cluster, second particular data of the database that was generated by the database application during the copying of the first particular data. The computer system may also instantiate another instance of the database application in association with the second storage cluster.

Abstract: A group-based communication platform is configured to ascertain the relatedness of various work objects shared among users of the group-based communication platform. Moreover, the group-based communication platform may further receive and process work objects originating from non-users of the group-based communication platform, thereby further expanding the utility of the determined relatedness between work objects. These work objects (or encrypted representations of these work objects) may be indexed and stored in association with the group-based communication platform, thereby enabling users to search for and retrieve work objects originating from a plurality of work object sources simultaneously, and based on various characteristics of those work objects and the determined interrelatedness between various work objects.

Abstract: A system is disclosed for acquiring and managing data regarding external IP (EIP) addresses of services offered in a trusted public cloud environment. The system monitors an application program interface of a service executing in a trusted public cloud environment for occurrence of an event that is related to an EIP of the service. When an event is detected, the system extract EIP related data and metadata of the service, generates a message with the extracted EIP data, and posts the message to a central message queue. The system monitors the message queue for the presence of a new message. Upon detecting a new message, the system processes the message, extracts EIP related data. metadata, and identifies an action. A central database that stores EIP related information of services executing in the trusted public cloud environment is updated based on the identified action.

Abstract: Natural language generation technology is disclosed that applies artificial intelligence to structured data to determine content for expression in natural language narratives that describe the structured data. A graph data structure is employed, where the graph data structure comprises a plurality of nodes. Each of a plurality of the nodes (1) represents a corresponding intent so that a plurality of different nodes represent different corresponding intents and (2) is associated with one or more links to one or more of the nodes to define relationships among the intents.

Abstract: Methods, computer readable media, and devices for dynamic personalized API assembly are provided. One method may include receiving a data query from a client by a CDN, parsing the data query to generate a modified data query, transmitting the modified data query to an origin server, receiving a content from the origin server, generating a modified content based on the content, and sending the modified content to the client. Another method may include receiving an API call by an origin server, generating an API response by creating a payload file and adding markup directives indicating whether content is cacheable, and transmitting the API response.

Abstract: Provided is a computing device of a group based communication system configured to initiate and execute a group-based communication browser session. An example computing device is configured to receive a group-based communication browser session initiation request. After receiving a group-based communication browser session initiation request, the example computing device will determine whether the computing is connected to an Internet. If the computing device is determined to be connected to the Internet, the example computing device determine whether a group-based communication service cache is available. If the group-based communication service cache is available, the example computing device will fetch a group-based application asset set from the group-based communication service cache. Then the example computing device will determine whether a group-based communication browser cache is available.

Abstract: Techniques are disclosed relating to automated operations management. In various embodiments, a computer system accesses operational information that defines commands for an operational scenario and accesses blueprints that describe operational entities in a target computer environment related to the operational scenario. The computer system implements the operational scenario for the target computer environment. The implementing may include executing a hierarchy of controller modules that include an orchestrator controller module at top level of the hierarchy that is executable to carry out the commands by issuing instructions to controller modules at a next level. The controller modules may be executable to manage the operational entities according to the blueprints to complete the operational scenario.

Abstract: First and second dashboards that provide a visual representation of respective intelligence information for a firewall may be generated. An indicator of correspondence between a first data element of the respective intelligence information for the first dashboard and a second data element of the respective intelligence information for the second dashboard may be displayed as an overlay of the first and second dashboards. Additionally, a guidance indicator that indicates an order to access respective values of the first dashboard, the second dashboard, and a third dashboard may be displayed based on an identifier of the first data element mapped to an identifier of the second data element and an identifier of the second data element mapped to an identifier of a third data element for the third dashboard. A summary window that provides a summary of intelligence dashboards of a user interface may be displayed.

Abstract: System and method for transformer-based adversarial active learning system. A machine learning system includes a generator, a transformer encoder, a classifier, and a discriminator all working in combination to generate and select unlabeled data points for labeling. The system utilizes a generative adversarial network paired with an active learning framework to optimize text embedding and feature encoding according to distribution of training data.

Abstract: A method and system for generating a privilege based segmented instruction prompt has been developed. Trusted instructions defining the trusted instructions as having a first privilege level, program instructions as having a second privilege level, and data instructions as having a third privilege level are received. The program instructions to implement tasks associated with the data instructions are received. The data instructions are received. The generated privilege based segmented instruction prompt includes the trusted instructions, the program instructions, and the data instructions. The privilege based segmented instruction prompt enables a generative LLM to determine whether the privilege based segmented instruction prompt is an instruction injection attack based on whether there is a conflict between the trusted instructions, the program instructions, and the data instructions in violation of the first, second, and third privilege levels.

Abstract: Methods, systems, apparatuses, devices, and computer program products are described. A virtual machine may receive, from an application associated with a tenant, a request to perform a cryptographic operation for the application at the virtual machine. Based on receiving the request, the virtual machine may determine that the tenant is limited to using a designated set of cryptographic operations in accordance with a cryptographic operation validation policy associated with the tenant. In some examples, the virtual machine may identify a designated version of the cryptographic operation, from the designated set of cryptographic operations, that corresponds to the cryptographic operation indicated by the request in satisfaction of the cryptographic operation validation policy. The virtual machine may execute the designated version of the cryptographic operation and return a result of the execution to the application.

Abstract: A message batching configuration may be determined for transmitting a message to recipients. The message batching configuration may include two or more message batches, a respective recipient count for each message batch, a respective time delay between each message batch, and a performance metric for evaluating the message. The message is transmitted in accordance with the message batching configuration. The transmission of subsequent message batches is halted when it is determined that the designated performance metric fails to meet a designated performance metric threshold.

Abstract: A method and system enables communications with a call center via SMS/MMS and provides an additional communications channel to communicate with the call center in addition to voice, Internet email/IM chat and fax. The call center obtains location information and images from a customer using SMS messages and web pages via a messaging hub.