SafeSpace: Bounded Operational Regions

• SafeSpace is a concept defining bounded operational regions across multiple domains, ensuring safety, privacy, and utility by clearly limiting what can be released or accessed.
• It integrates diverse approaches—from mixed reality spatial generalization and interactable subspace allocation to certified safe sets in control theory—with concrete mechanisms like plane budgets and safety filters.
• SafeSpace frameworks enable practical deployment of safety-preserving barriers in digital and physical systems, facilitating secure mixed reality experiences, robust telepresence, and reliable control systems.

SafeSpace is a recurrent research name applied to systems that restrict, reorganize, or certify an admissible space so that safety, privacy, comfort, or compliance constraints are preserved without eliminating utility. In the surveyed literature, the name refers most directly to conservative plane releasing for spatial privacy in mixed reality (Guzman et al., 2020), spatial affordance-aware interactable subspace allocation for mixed reality telepresence (Kim et al., 2024), an integrated web application for digital safety and emotional well-being (Fatmi et al., 22 Aug 2025), and aggregation of certified safe sets from backup control barrier functions under input constraints (Ong et al., 4 Apr 2026). In adjacent work, the term is also used descriptively for safety-oriented representational subspaces, oracle-filtered recommendation spaces, speech-context safety envelopes, interoperable blocking policies, and isolated secure computing environments (Zhang et al., 16 Oct 2025, Assogba et al., 12 Feb 2026, Hao et al., 3 Mar 2026, Wang et al., 16 Apr 2026, Ranjan et al., 12 Jun 2025, Scheerman et al., 2021).

1. Scope and recurring meanings

The published record does not define a single standardized SafeSpace framework. Instead, it uses the name for several domain-specific mechanisms that all place explicit bounds on what may be released, aligned, recommended, inferred, or safely reached.

Domain	SafeSpace formulation	Core mechanism
Mixed reality privacy	Conservative plane releasing	Surface-to-plane generalization plus accumulated plane budget
MR telepresence	SA-ISA shared environment	Host-space perception plus per-user interactable subspaces
Digital safety platform	Unified web application	Toxicity detection, safety ping/SOS, reflective questionnaire
Nonlinear control	Aggregated safe sets	Generalized combinatorial CBFs with backup-set aggregation
Related safety-space uses	Safety-preserving subspace or enclave	Null-space projection, sparse latent steering, oracle filtering, CRML propagation, secure virtual clusters

Across these uses, SafeSpace denotes a bounded operational region rather than an abstract ethical slogan. In mixed reality, the bounded region is a released geometric representation; in telepresence, it is the per-user interactable subspace; in web safety, it is a coordinated socio-technical workflow; and in control, it is a provably forward-invariant safe set under input constraints (Guzman et al., 2020, Kim et al., 2024, Fatmi et al., 22 Aug 2025, Ong et al., 4 Apr 2026). This suggests a family resemblance centered on constrained admissibility: each system preserves a limited space of allowed action while suppressing unsafe leakage or behavior.

2. Spatial privacy in mixed reality

The earliest paper in the set, "Conservative Plane Releasing for Spatial Privacy Protection in Mixed Reality" (Guzman et al., 2020), studies mixed reality platforms that must capture high-resolution, high-frequency 3D spatial information to anchor virtual content. The paper identifies four privacy exposures in such data: environmental structure, place identity, the user’s location within the space, and temporal behavior. Its threat model assumes an adversary $J$ with access to historical 3D maps and attack pipelines that remain effective on generalized plane representations.

The core SafeSpace mechanism has two components. First, spatial generalization replaces surface geometry with planes fitted via RANSAC. A plane is represented as

$ax + by + cz + d = 0,$

with point-to-plane distance

$$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$

Second, conservative plane releasing limits the number of planes released over time as the user moves. The mechanism is formalized as

$$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$

subject to a subsumption constraint, a budget constraint $|\{\tilde{\Pi}_j\}|\le k$, and an update policy based on salience. The privacy metrics are the inter-space misclassification rate,

$\Pi_1 = 1 - P(\text{correct}),$

and the intra-space mean localization error,

$\Pi_2 = E[d(c_{S^*},c_S)].$

Utility is measured by a mean transformation error $Q(S^{\sim};S)$ using nearest-neighbor pairing with $\alpha=\beta=0.5$ (Guzman et al., 2020).

The evaluation uses seven spaces captured with Microsoft HoloLens: work space, reception, office pantry/kitchen, apartment, driveway, hallway, and stairwell. The combined floor area is approximately $899.9\ \mathrm{m}^2$, the combined surface area is approximately $ax + by + cz + d = 0,$0, and the raw point clouds total $ax + by + cz + d = 0,$1 MB. Two attacks are instantiated: NN-matcher, based on spin images and structural consistency checks, and PointNetVLAD, trained on $ax + by + cz + d = 0,$2 m radius submaps with $ax + by + cz + d = 0,$3 points. The main reported findings are parameterized by reveal radius $ax + by + cz + d = 0,$4 and plane budget $ax + by + cz + d = 0,$5: with $ax + by + cz + d = 0,$6 m, releasing no more than $ax + by + cz + d = 0,$7 generalized planes ensures average inter-space privacy $ax + by + cz + d = 0,$8, so the adversary fails at least $ax + by + cz + d = 0,$9 of the time; with $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$0 m, up to $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$1 generalized planes can be released while maintaining $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$2 and improving utility. Conservative releasing also allows up to $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$3 successive partial releases with $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$4 while sustaining $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$5. The average utility error for generalized planes is reported as $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$6 over $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$7 m, with moderate positive correlation $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$8 between $$\delta(p,\Pi)=\frac{|ax+by+cz+d|}{\sqrt{a^2+b^2+c^2}}.$$9 and $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$0 (Guzman et al., 2020).

A frequent misconception is that plane abstraction alone solves privacy. The paper explicitly shows progressive leakage under successive releases without the conservative budget policy: for $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$1 m, average $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$2 falls below $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$3 after approximately $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$4 releases under NN-matcher, and for $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$5 m it drops below $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$6 immediately after the first release. SafeSpace therefore combines representation reduction with temporal throttling rather than relying on generalization in isolation (Guzman et al., 2020).

3. Mixed reality telepresence and interactable subspace allocation

In "Spatial Affordance-aware Interactable Subspace Allocation for Mixed Reality Telepresence" (Kim et al., 2024), SafeSpace refers to the creation of safe, spacious, and comfortable shared MR environments through Spatial Affordance-aware Interactable Subspace Allocation (SA-ISA). The central distinction is between a mutual perceivable space, which all users see, and a per-user interactable subspace, within which each user can safely touch and move. In SA-ISA, all users perceive the AR host’s environment, while each remote user receives a different interactable subspace aligned to the affordances near that user’s actual location.

The formal model introduces a host space $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$7, remote spaces $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$8, transformations $$G:\{\Pi_i\}\times (r,k,\epsilon,\theta)\rightarrow \{\tilde{\Pi}_j\},$$9, and affordance labels $|\{\tilde{\Pi}_j\}|\le k$0. A geometric mutual space in general terms is

$|\{\tilde{\Pi}_j\}|\le k$1

but SA-ISA avoids collapsing collaboration to this intersection. Instead, it extracts

$|\{\tilde{\Pi}_j\}|\le k$2

around an optimal user position. The alignment objective is

$|\{\tilde{\Pi}_j\}|\le k$3

with context-specific weights. For SA-Table, $|\{\tilde{\Pi}_j\}|\le k$4; for SA-Wall, $|\{\tilde{\Pi}_j\}|\le k$5; for SA-Floor, $|\{\tilde{\Pi}_j\}|\le k$6. User instantiation enforces a minimum personal-space radius $|\{\tilde{\Pi}_j\}|\le k$7 m, candidate positions sampled at $|\{\tilde{\Pi}_j\}|\le k$8 m, and $|\{\tilde{\Pi}_j\}|\le k$9 m offsets from table or wall boundaries. Interactable subspaces are extracted via four markers with initial length $\Pi_1 = 1 - P(\text{correct}),$0 m, thickness $\Pi_1 = 1 - P(\text{correct}),$1 m, and $\Pi_1 = 1 - P(\text{correct}),$2 m expansion steps (Kim et al., 2024).

The evaluation covers $\Pi_1 = 1 - P(\text{correct}),$3 host-client combinations with two, four, and six remote spaces, using $\Pi_1 = 1 - P(\text{correct}),$4 host spaces and $\Pi_1 = 1 - P(\text{correct}),$5 client spaces. The principal baselines are Semantic Total Intersection (S-TI), which defines mutual space through geometric intersection, and Semantic Interactable Subspace Allocation (S-ISA), which uses only geometric terms. The reported results show that S-TI collapses rapidly as the number of users increases: in H1-C6, its user-instantiation success rate is $\Pi_1 = 1 - P(\text{correct}),$6 in all conditions. By contrast, SA-ISA remains viable, although success is limited by physical affordance length in table- and wall-centric settings. For H1-C6, SA-Table achieves $\Pi_1 = 1 - P(\text{correct}),$7, SA-Wall $\Pi_1 = 1 - P(\text{correct}),$8, $\Pi_1 = 1 - P(\text{correct}),$9, or $\Pi_2 = E[d(c_{S^*},c_S)].$0 depending on host condition, and SA-Floor $\Pi_2 = E[d(c_{S^*},c_S)].$1. In the same setting, total interactable area reaches $\Pi_2 = E[d(c_{S^*},c_S)].$2 for SA-Table, $\Pi_2 = E[d(c_{S^*},c_S)].$3 for SA-Wall, $\Pi_2 = E[d(c_{S^*},c_S)].$4 for SA-Floor, and $\Pi_2 = E[d(c_{S^*},c_S)].$5 for S-ISA, while S-TI is not applicable because it fails entirely. Mean per-client interactable area remains at or above $\Pi_2 = E[d(c_{S^*},c_S)].$6 in most six-user settings, whereas S-TI produces approximately $\Pi_2 = E[d(c_{S^*},c_S)].$7 of non-interactable obstacles per client in smaller settings (Kim et al., 2024).

The key conceptual departure from intersection-based approaches is explicit: SA-ISA does not define safety or spaciousness as maximal common overlap. It preserves a coherent visual stage by making the host space the mutual perceivable space, then distributes interaction through tailored subspaces $\Pi_2 = E[d(c_{S^*},c_S)].$8. This yields a directly usable account of proxemics, obstacle avoidance, and affordance alignment in multi-user MR telepresence (Kim et al., 2024).

4. Digital safety, emergency escalation, and emotional well-being

"SafeSpace: An Integrated Web Application for Digital Safety and Emotional Well-being" (Fatmi et al., 22 Aug 2025) uses the name for a unified, privacy-conscious web application that integrates three modules normally deployed in isolation: toxicity detection in chats and screenshots, a configurable safety ping system with missed-check-in and SOS escalation, and a reflective questionnaire assessing relationship health and emotional resilience. The paper situates the system against online toxicity, grooming, manipulation, and associated emotional and safety risks.

The architecture is modular and client-server based. A Flask backend coordinates the application logic, Firebase Firestore stores user settings, emergency contacts, and alert history, Google’s Perspective API provides toxicity-related scores, SMTP dispatches emergency emails, and OCR preprocesses screenshots. Toxicity analysis supports direct text entry and image uploads; chat inputs are processed transiently and not persisted. The Perspective API returns category-specific scores including insult, identity attack, threat, and severe toxicity. The safety ping module allows users to configure check-in intervals, captures live latitude and longitude on missed check-ins or manual SOS, and sends structured alerts via SMTP-based email. Offline caching queues alerts during connectivity loss. The reflective questionnaire uses a weighted rubric and categorizes outcomes as “Healthy,” “Needs Reflection,” or “Unhealthy,” with results and module actions logged in a history dashboard (Fatmi et al., 22 Aug 2025).

The reported evaluation emphasizes functional correctness rather than benchmark-style model comparison. Toxicity detection achieves approximately $\Pi_2 = E[d(c_{S^*},c_S)].$9 precision, a false positive rate under $Q(S^{\sim};S)$0, and an average response time of $Q(S^{\sim};S)$1 seconds. A representative abusive input, “You’re such a loser. I hate you.”, is correctly flagged with highlighted phrases including “loser” and “hate.” Safety alerts achieve $Q(S^{\sim};S)$2 reliability in emulator tests, with latency from missed check-in to delivery under $Q(S^{\sim};S)$3 seconds; one white-box case reports alert triggering in under $Q(S^{\sim};S)$4 seconds. Questionnaire scoring reaches $Q(S^{\sim};S)$5 alignment between automated and manual scoring. The paper also reports a peer-survey usability rating of $Q(S^{\sim};S)$6, with “smooth on Android + Desktop browsers” for device compatibility (Fatmi et al., 22 Aug 2025).

The paper is explicit about limitations. Detailed dataset composition, confusion matrices, recall, $Q(S^{\sim};S)$7, ROC/AUC, and confidence intervals are not reported. Multilingual support is planned rather than deployed, and dependence on internet and email infrastructure remains a failure mode despite offline caching for alerts. The authors also state that the platform complements rather than replaces professional counseling or emergency services. In this formulation, SafeSpace is less a geometric or control-theoretic object than an integrated workflow joining detection, protection, and reflection under minimal persistence and modular privacy controls (Fatmi et al., 22 Aug 2025).

5. Safe-set aggregation in control theory

"SafeSpace: Aggregating Safe Sets from Backup Control Barrier Functions under Input Constraints" (Ong et al., 4 Apr 2026) develops a control-theoretic SafeSpace for control-affine systems with bounded inputs,

$Q(S^{\sim};S)$8

where $Q(S^{\sim};S)$9 is polytopic. The paper begins from a task-level safety specification $\alpha=\beta=0.5$0, then seeks a certified subset $\alpha=\beta=0.5$1 that is forward invariant under a safety filter. The stated motivation is that single-CBF certificates become conservative under tight input bounds, even when multiple smaller safe sets can be certified independently around different equilibria or backup controllers.

The paper refines the combinatorial CBF framework by introducing an auxiliary variable $\alpha=\beta=0.5$2 and a positive definite function $\alpha=\beta=0.5$3. For a family of CBFs $\alpha=\beta=0.5$4 and order-statistic composition $\alpha=\beta=0.5$5, it imposes

$\alpha=\beta=0.5$6

This yields a generalized combinatorial CBF when the family is conjunctively compatible on $\alpha=\beta=0.5$7, meaning there exists an admissible input that simultaneously satisfies the active barrier inequalities. The corresponding safety filter is a CBF-based quadratic program,

$\alpha=\beta=0.5$8

Under conjunctive compatibility and Slater’s condition, the paper shows that the QP solution is continuous over the aggregated safe region (Ong et al., 4 Apr 2026).

The framework is then extended to multiple implicit safe sets generated by backup CBFs. For each primitive set and backup controller, a finite-horizon discretized implicit safe set is formed; these are aggregated as

$\alpha=\beta=0.5$9

with

$899.9\ \mathrm{m}^2$0

The resulting QP enforces trajectory-level and terminal constraints for each backup expansion and yields a continuous safety filter over the aggregated region (Ong et al., 4 Apr 2026).

Two spacecraft examples demonstrate the method. In safe attitude control with underactuation and bounded torque, five primitive safe sets are built from geometric PD backup controllers stabilizing to different target directions, and the aggregated implicit CBF-QP expands the effective envelope near the boundary of the allowed cone. In planar asteroid station keeping with keep-out and keep-in constraints, SafeSpace yields the largest control-invariant certified set among the compared constructions, enabling the best orbit-tracking performance while maintaining $899.9\ \mathrm{m}^2$1 and respecting bounded actuation. Here SafeSpace is a mathematically certified safe operating region assembled from smaller certified pieces rather than a heuristic safety wrapper (Ong et al., 4 Apr 2026).

6. Extended uses: safety-preserving subspaces, envelopes, and enclaves

Several later papers do not use SafeSpace as their formal title, but their summaries explicitly invoke the term to describe a protected subspace, envelope, or operating layer. In LLM alignment, "A Guardrail for Safety Preservation: When Safety-Sensitive Subspace Meets Harmful-Resistant Null-Space" (Zhang et al., 16 Oct 2025) proposes GuardSpace, which decomposes pre-trained weights through covariance-preconditioned SVD into safety-relevant and safety-irrelevant components, freezes the former, initializes low-rank adapters from the latter, and right-multiplies updates by a null-space projector $899.9\ \mathrm{m}^2$2 so outputs on harmful prompts remain invariant. On Llama-2-7B-Chat fine-tuned on GSM8K, GuardSpace reduces the harmful score from $899.9\ \mathrm{m}^2$3 to $899.9\ \mathrm{m}^2$4 relative to AsFT while improving accuracy from $899.9\ \mathrm{m}^2$5 to $899.9\ \mathrm{m}^2$6. In jailbreak mitigation, "Sparse Autoencoders are Capable LLM Jailbreak Mitigators" (Assogba et al., 12 Feb 2026) describes Context-Conditioned Delta Steering (CC-Delta) as constructing a sparse safety-oriented subspace in SAE latent space: paired harmful/jailbreak prompts are compared tokenwise, features are selected by one-sided Wilcoxon signed-rank tests with Benjamini–Hochberg FDR correction, and inference-time mean-shift steering is applied only along the selected sparse feature axes. The paper reports comparable or better safety-utility tradeoffs than dense latent-space baselines and clear gains on out-of-distribution jailbreaks.

A similar safety-space logic appears in recommendation and speech. "SafeCRS: Personalized Safety Alignment for LLM-Based Conversational Recommender Systems" (Hao et al., 3 Mar 2026) formalizes user-specific safety constraints through explicit traits and Safety Oracles, then combines Safe-SFT with Safe-GDPO. On SafeMovie, Llama-3.1-8B + SafeCRS reports $899.9\ \mathrm{m}^2$7 with competitive Recall@10 and NDCG@10, corresponding to a relative safety reduction of $899.9\ \mathrm{m}^2$8 versus GPT-5.2’s $899.9\ \mathrm{m}^2$9 violation rate. "VoxSafeBench: Not Just What Is Said, but Who, How, and Where" (Wang et al., 16 Apr 2026) connects SafeSpace to speech LLMs operating in shared, multi-user environments. It introduces a Two-Tier benchmark separating content-centric from audio-conditioned risks and identifies a speech grounding gap: models often recognize cues such as child voice, anger, intoxication-like prosody, or bystander speech in intermediate probes, yet fail to act on them appropriately. The reported child-voice gap is particularly stark: text references reach approximately $ax + by + cz + d = 0,$00–$ax + by + cz + d = 0,$01 Safety Awareness Rate, whereas some audio models remain near $ax + by + cz + d = 0,$02–$ax + by + cz + d = 0,$03.

Outside AI model alignment, SafeSpace also appears as an infrastructural or ecosystem-level protection layer. "Single Block On" (Ranjan et al., 12 Jun 2025) proposes interoperable, identity-based blocking across applications through configurable similarity rules, SSO/LDAP/REST integration, and a Contact Rule Markup Language (CRML), thereby creating a user-controlled safety envelope that propagates blocking decisions across integrated platforms. "Secure Platform for Processing Sensitive Data on Shared HPC Systems" (Scheerman et al., 2021) describes the ODISSEI Secure Supercomputer as creating isolated secure computing environments on traditional multi-tenant HPC clusters through PCOCC, SLURM, Open vSwitch, SR-IOV, dedicated Lustre filesystems, VPN ingress, and centralized logging; the detailed summary explicitly characterizes these per-project virtual clusters as “SafeSpaces” on shared HPC. A related systems-level use appears in "SPACE: Swarm Pheromone Fields for Adaptive Collision-Aware Exploration" (Que et al., 28 Jun 2026), whose design guidance includes recommendations for a “SafeSpace” swarm system that monitors inter-robot contact rate, uses frontier, explore, and density fields, and achieves four- to seventeen-fold fewer contacts than a greedy nearest-frontier planner while keeping coverage time within about two percent of that near time-optimal baseline.

Taken together, these extensions show that SafeSpace has become a portable research idiom for bounded admissibility. Depending on the field, the bounded object may be a geometric release set, an interactable subspace, a certified invariant region, a latent steering subspace, a recommendation list, an interoperable block policy, or a secure virtual enclave. The common structure is not nominal identity but the explicit shaping of what may safely pass through a system under utility, privacy, or control constraints.