Graph Neural Network (GNN)

The core computational mechanism where nodes iteratively aggregate feature information from their neighbors to update their own representations.

• Aggregation Function: A permutation-invariant operation (e.g., sum, mean, max) that collects embeddings from a node's local neighborhood.
• Update Function: A neural network (often a multi-layer perceptron) that combines the aggregated neighbor information with the node's previous state.
• Multi-Hop Propagation: Stacking multiple message-passing layers allows a node to receive signals from distant parts of the graph, capturing complex, indirect device-user associations.

The process of mapping discrete graph nodes (e.g., a device ID or hashed email) to dense, low-dimensional vector representations that encode their structural role and relational context.

• Structural Similarity: Nodes with similar local topologies (e.g., two mobile devices that frequently connect to the same Wi-Fi IPs) will have embeddings close in vector space.
• Feature Fusion: Node attributes like browser type, operating system, and behavioral patterns are concatenated with learned structural embeddings.
• Link Prediction: The primary downstream task; the dot product or cosine similarity between two node embeddings predicts the probability of an edge (a match) between them.

Identity graphs are inherently heterogeneous, containing multiple node types (user, device, email, IP address) and edge types (logged_in, browsed_from, synced_with). GNNs handle this natively.

• Type-Specific Projections: Each node and edge type can have its own learnable linear transformation matrix, projecting different feature spaces into a common latent dimension.
• Relation-Specific Aggregation: The message-passing logic can be parameterized per edge type, learning that a 'logged_in' relationship is a stronger identity signal than a 'shared_IP' relationship.
• Metapath Sampling: Training batches are constructed by following predefined sequences of node and edge types (e.g., User -> Device -> IP -> Device), ensuring the model learns semantically meaningful patterns.

An enhancement to basic message passing that allows a node to learn the relative importance of its neighbors, assigning dynamic weight coefficients rather than treating all connections equally.

• Attention Coefficients: A small shared neural network computes a scalar weight for each incoming edge based on the features of the source and target nodes.
• Softmax Normalization: Coefficients are normalized across all neighbors using a softmax function, ensuring comparability and stable gradients.
• Noise Suppression: The model can learn to down-weight weak probabilistic links (e.g., a fuzzy-matched name) while amplifying the signal from high-certainty deterministic matches (e.g., a passkey authentication event).

Unlike transductive methods that require the entire graph at training time, GNNs learn a function that can generate embeddings for previously unseen nodes without retraining the entire model.

• Parameter Sharing: The learned aggregation and update functions are shared across all nodes, making them agnostic to graph size.
• Cold Start Resolution: A new device fingerprint entering the network can be immediately embedded and linked to existing profiles by passing its features through the frozen GNN layers.
• Scalability: Enables identity resolution on massive, constantly evolving graphs with millions of new daily active users, as only the local subgraph of the new node needs to be processed.

An extension of static GNNs that incorporates the dimension of time, recognizing that identity relationships are dynamic and event-driven.

• Time-Encoded Edges: Edge features include a timestamp or a learned time encoding, allowing the model to distinguish a login from yesterday from a login from three years ago.
• Memory Module: A recurrent neural network (like a GRU) maintains a stateful memory vector for each node, updated asynchronously whenever a new interaction event occurs.
• Identity Decay Modeling: The architecture naturally learns the concept of identity decay, where the influence of an old, stale identifier on the current node state diminishes over time without fresh validation.