Entity Alignment

Entity alignment is not a simple database join; it is a cryptographic protocol. The core mechanism is Private Set Intersection (PSI), which allows two or more parties to compute the intersection of their private identifier sets (e.g., customer IDs, device serial numbers) without revealing any identifiers not in the intersection. This ensures only the aligned subset of entities is used for training, with no leakage about non-overlapping records.

• Example: A bank (Party A) and a retailer (Party B) use PSI to find their shared customers. The protocol confirms Customer X exists in both datasets, but Party A learns nothing about Customer Y who shops only at the retailer, and vice-versa.

Entity alignment is a one-time, pre-processing step executed before the federated training loop begins. Its output is a cryptographically secured agreement on the aligned entity indices. The subsequent split neural network training operates only on this aligned subset. This separation is crucial for system design, as the alignment protocol's computational and communication costs are incurred upfront, not in every training round.

• Key Distinction: Alignment establishes which samples to use; the VFL protocol defines how to compute over the features of those samples.

Alignment operates exclusively on entity identifiers, not on the feature data itself. Parties share or compute over encrypted hashes of IDs (e.g., user IDs, transaction IDs), not the actual features (e.g., account balance, purchase history). This strict separation preserves the core privacy promise of VFL: feature data never leaves its owner.

• Security Boundary: A robust alignment protocol ensures that even the distribution or entropy of the non-intersecting IDs is protected from other participants.

Alignment strategies vary based on data quality:

• Deterministic Matching: Used when unique, stable keys exist across all parties (e.g., government ID numbers, global device UUIDs). PSI protocols are most efficient here.
• Probabilistic Matching: Required in absence of common keys. Uses secure entity resolution techniques, which may compare encrypted quasi-identifiers (e.g., name, date of birth, address) with fuzzy matching to estimate record linkage probability, all within a multi-party computation (MPC) framework. This is more complex and computationally intensive.

The communication overhead of entity alignment is a primary engineering challenge. Naïve PSI implementations have quadratic cost. Modern efficient PSI protocols (e.g., based on Oblivious Transfer, Homomorphic Encryption, or Bloom Filters) reduce this to linear or near-linear complexity relative to dataset size. The chosen protocol directly impacts the feasibility of aligning large-scale datasets (e.g., millions of records) across organizational boundaries with practical bandwidth.

The design of the alignment protocol hinges on the adversarial threat model. In semi-honest (honest-but-curious) settings, parties follow the protocol but try to learn extra information. Most PSI protocols are designed for this model. For malicious settings where parties may deviate, more robust but costly verifiable PSI or MPC protocols are required. The choice dictates the cryptographic primitives used and the necessary consensus mechanisms.

Multiple financial institutions hold different financial attributes for the same corporate clients (e.g., Bank A has loan history, Bank B has transaction data). Entity alignment via Private Set Intersection (PSI) allows them to identify shared corporate entities without revealing their full client lists. This enables the collaborative training of a superior credit risk model using a broader feature set, while each bank's proprietary customer relationships remain confidential.

A hospital holds patient lab results and imaging data, while a research institute holds genomic sequences. Secure entity resolution aligns patient records across these entities using anonymized identifiers, enabling the training of a multimodal diagnostic model that correlates genetic markers with clinical outcomes. This accelerates precision medicine research while maintaining strict HIPAA/GDPR compliance, as raw patient records never leave their original custodians.

An e-commerce platform holds user purchase history, while a digital advertiser holds user browsing behavior and demographic data. Entity alignment matches users across these platforms based on hashed identifiers. This allows for the federated training of a next-product-to-buy model with vastly enriched features, leading to highly personalized recommendations and ad targeting. The process ensures user privacy is preserved, as neither party learns the specific browsing habits or purchase history of the other's users.

Different municipal departments or utility companies hold sensor data for the same geographic areas (e.g., traffic cameras, energy meters, air quality sensors). Entity alignment matches data streams by location and timestamp, enabling the joint training of models for predictive traffic flow, energy load forecasting, or pollution source identification. This creates a unified intelligence layer for urban management without centralizing sensitive operational data from each department.

An original equipment manufacturer (OEM), its component suppliers, and logistics partners each hold partial data about production batches and shipments. Entity alignment links records for the same physical components or shipments across the supply chain using shared order IDs or serial numbers processed through a secure multi-party computation (MPC) protocol. This enables collaborative models that predict delays, optimize inventory, and identify quality issues root causes, while protecting each company's proprietary operational data.

Different payment processors, merchants, and credit bureaus observe fragments of potentially fraudulent transaction patterns. Privacy-preserving entity alignment allows these parties to securely determine if suspicious activities in their separate systems refer to the same underlying actor or card. By aligning entities without exposing legitimate customer transactions, they can collaboratively train a more robust and generalized fraud detection model that identifies sophisticated, cross-platform attack patterns earlier.

A vertical data partition is the specific data structure where different features (columns) describing the same set of entities (rows) are held by different, non-colluding organizations. This is the structural prerequisite for VFL and defines the problem entity alignment solves.

• Key Characteristic: Entities (rows) are aligned, but features (columns) are split. For example, a hospital holds medical history features, while an insurer holds billing code features for the same patients.
• Contrast with Horizontal FL: In horizontal FL, parties have the same feature sets for different entities. Vertical FL requires alignment of entities across different feature sets.

Secure entity resolution is a broader privacy-preserving data management process for identifying records that refer to the same real-world entity across multiple, distinct databases. It encompasses PSI but can also handle fuzzy matching (e.g., aligning "Jon Doe" with "John Doe") using secure techniques.

• Scope: Often involves record linkage and deduplication across databases with potentially noisy or inconsistent identifiers.
• VFL Role: Provides a more robust alignment layer when entity identifiers are not perfectly consistent across parties, ensuring higher-quality sample alignment before model training commences.

These are the two primary roles in a VFL system, defined by the data they hold in the vertically partitioned schema.

• Feature Owner: A participant that possesses a subset of the input features (e.g., transaction history, sensor readings) for the aligned entities. They compute the initial layers of a split neural network.
• Label Owner: The participant that holds the target values or labels (e.g., loan default flag, diagnostic outcome) for the aligned entities. This party typically initiates the training process, computes the loss, and coordinates backpropagation.

The relationship and trust model between these roles dictate the vertical training protocol design.

A split neural network is the model architecture used in VFL, where the neural network is divided into multiple segments hosted by different parties according to the vertical data partition.

• Cut Layer: The specific layer where the model is split. The feature owner computes the forward pass up to this layer, producing an intermediate output or embedding.
• Information Flow: This intermediate output is securely sent to the label owner, who completes the forward pass, calculates the loss, and initiates vertical backpropagation.
• Privacy-Utility Trade-off: The location of the cut layer is critical; earlier cuts preserve more privacy but may reduce model utility.

Vertical secure aggregation refers to cryptographic protocols used to combine model updates (e.g., gradients from feature owners) in VFL without revealing any single participant's contribution. It protects against privacy inference attacks during training.

• Common Techniques: Leverages Secure Multi-Party Computation (MPC) or homomorphic encryption to allow a coordinator (often the label owner) to compute the sum of gradients while each gradient remains encrypted or secret-shared.
• Purpose: Prevents a curious label owner from learning sensitive information about a specific feature owner's data by inspecting their individual gradient updates, complementing the privacy provided by entity alignment.