Competing pharma companies jointly query a federated knowledge graph without exposing proprietary data
Competing pharmaceutical companies routinely hold complementary, non-overlapping evidence — off-target toxicity signals, rare adverse events, target-validation failures — that no single organization can see in isolation. A federated knowledge-graph consortium lets members query across this collective evidence base while every byte of proprietary data stays on-premises, governed by a single multilateral agreement rather than a thicket of bilateral data-sharing deals.
Pooling proprietary compound, target, and trial data into a central warehouse is a non-starter for competing companies: whoever controls the warehouse effectively gains visibility into every member's pipeline. A federated architecture inverts this — the knowledge graph is logically unified but physically distributed, with each member's partition never leaving their own infrastructure.
This mirrors the design principle behind large distributed research networks: keep data at rest, move only the question and the answer. The consortium's query broker never stores a persistent copy of any member's graph, and no member ever receives direct read access to another member's systems. What is shared is a common schema, a common query protocol, and a common trust framework — not the underlying facts themselves.
The governance model treats the consortium as a legal entity with its own charter, distinct from any single member, similar in spirit to how the GA4GH (Global Alliance for Genomics and Health) coordinates federated genomic data access across hundreds of institutions without any of them centralizing patient-level data.
Before a single query can run, the consortium establishes a machine-readable governance layer. Each member tags portions of their local graph with GA4GH Data Use Ontology (DUO) codes — standardized terms such as "general research use," "no commercial use restriction," or "collaboration required" — so that eligibility can be checked automatically rather than negotiated per query.
Identity federation is handled through standard enterprise protocols (SAML 2.0 / OAuth2 / OIDC) issued by a consortium-operated identity provider, so members authenticate against their own directory while the broker only ever sees a federated, pseudonymous identity token. Query policy documents define which classes of question are pre-approved (e.g., cross-pipeline toxicity signal detection) versus which require a governance-board vote (e.g., anything touching unreleased clinical endpoints).
A single multilateral master agreement replaces what would otherwise be N(N−1)/2 bilateral contracts — for a 6-member consortium that is 1 document instead of 15, and for a 12-member consortium it is 1 instead of 66.
The federated-query pattern is not new to pharma — it is the same architecture underlying several production-scale health data networks. The OHDSI collaborative runs standardized OMOP Common Data Model queries against dozens of independently governed hospital databases worldwide, returning only aggregate statistics. The FDA Sentinel Initiative queries claims and EHR data held by 18+ partner organizations using a distributed database model, never centralizing patient records. The European Health Data Space (EHDS) regulation codifies a similar federated secondary-use model at a continental scale.
The pharma consortium adapts this precedent to a competitive-intelligence context: the threat model shifts from patient privacy to trade-secret protection, but the underlying architectural answer — bring the query to the data, not the data to the query — remains the same.
Before a member's knowledge graph can participate in any federated query, it must be hardened at rest: node and edge data encrypted, keys held exclusively by the originating member, and access scoped so tightly that not even consortium administrators can read raw content. Encryption here is not a formality — it is the technical backstop behind the legal governance layer.
Encrypting incompatible graphs would make federation impossible — a query cannot join what it cannot recognize. Before hardening, each member maps their internal identifiers onto a shared ontology: compounds to ChEMBL/PubChem IDs, targets to UniProt/HGNC identifiers, and clinical concepts to standard terminologies such as MedDRA and SNOMED CT. This harmonization step, performed entirely inside the member's own infrastructure, produces a locally-encrypted graph whose structure is queryable by the consortium's federated engine even though its content remains opaque.
Without this common schema layer, even a successful cryptographic protocol would return meaningless results, since "target X" in one member's internal taxonomy might not correspond to the same molecular entity in another's.
Standard AES-256-GCM protects data at rest against unauthorized disk or backup access, but the consortium's later computation stages need more: numeric edge weights (binding affinities, adverse-event frequencies, trial hazard ratios) are additionally encoded in formats compatible with partially homomorphic and secret-sharing schemes — Paillier-style additive encryption or CKKS-style approximate arithmetic — so that later aggregation steps can operate on encrypted or secret-shared values without ever decrypting them locally.
This dual-layer approach means a member's graph is protected twice: once against passive exposure (AES-256-GCM at rest) and once against active computation leakage (homomorphic-ready numeric encoding used only during live federated queries).
Because edge weights are pre-encoded for homomorphic aggregation, no member ever needs to export a decrypted value during a federated query — the only operations performed on raw plaintext happen entirely within the originating member's own perimeter.
Encryption alone does not prevent misuse if keys are broadly accessible. Each member enforces role- and attribute-based access control (RBAC/ABAC) scoped so that only the consortium query broker — not individual employees, not IT administrators, not the consortium's own operators — can trigger a federated computation against the encrypted graph, and even then only through the pre-authorized query interface.
All key material is held in hardware security modules (HSMs) under the sole custody of the originating member, rotated on a fixed 90-day schedule, with every access attempt logged to an immutable audit trail. This "zero-trust" posture assumes that the network, the broker, and even other consortium members may at some point be compromised or adversarial, and designs the system so that no single point of failure can expose raw proprietary data.
Once every member's graph is encrypted and access-controlled, the consortium can begin answering questions. A query originates with one member — for instance, "has any other pipeline observed an unexpected hepatotoxicity signal for compounds sharing this scaffold?" — and is broadcast to all members simultaneously, structured so that neither the originator's identity nor the specific compound of interest is disclosed to competitors.
The consortium operates a central query broker whose sole functions are routing and protocol enforcement — it never stores plaintext data and never learns the analytic content of a query beyond its pre-approved template ID. To prevent the broker itself (or a compromised member acting as relay) from linking a query to its originator, requests pass through an onion-routed mix layer: the query is wrapped in successive encryption layers addressed to each hop, so that any single relay node knows only its immediate predecessor and successor, never the full path.
Every member therefore receives the same structurally identical broadcast at effectively the same moment (median latency 340 ms across a 6-member ring), with no member able to infer from broadcast order or timing which of its competitors triggered the question.
To prevent the federated interface from becoming a fishing expedition into competitors' pipelines, the consortium restricts executable queries to a governance-board-approved template library — parameterized questions such as "aggregate adverse-event rate for scaffold class X across all members" rather than free-form graph traversal. Templates are versioned, reviewed for information-leakage risk (could the answer alone reveal which member holds the underlying data?), and statistically bounded so that a single query cannot isolate one member's contribution.
Because every query that reaches a member's island has already passed this template check, 0% of federated queries require ad-hoc manual approval at the point of execution — approval happens once, at template design time, not per query.
Restricting the query surface to vetted templates is the single largest control against inference attacks: an unrestricted federated interface, however well encrypted underneath, can still leak information through the pattern of questions asked, not just their answers.
Each broadcast query is accompanied by a cryptographic commitment — a hash binding the exact query parameters and timestamp — that every member signs upon receipt before beginning local computation. This serves two purposes: it prevents the broker from silently altering a query mid-flight to different members (ensuring all islands answer the identical question), and it creates a non-repudiable audit trail proving which query template produced any given aggregate result, without revealing who asked it.
The commitment scheme is deliberately lightweight compared to the heavier cryptography used in the aggregation stage that follows — its job is integrity and accountability, not confidentiality, which is handled downstream by secure multi-party computation.
This is where federation earns its name: each member computes a partial answer entirely within their own infrastructure using secure multi-party computation (SMPC), and what leaves the island is not the partial answer itself but a cryptographic secret share of it. No member, and no coordinating party, ever observes another member's raw contribution — only the final sum of all shares is ever reconstructable, and only at the aggregation point.
Each member computes their local partial answer (for example, the count of hepatotoxicity events matching the query template within their own trial data) as a plaintext number that never leaves their perimeter. That number is then split using Shamir's (t,n) threshold secret sharing into n fragments, distributed one to each cooperating party, such that any t or more fragments can reconstruct the sum, but fewer than t reveal nothing whatsoever — not even a probabilistic hint — about the original value.
The consortium's aggregation protocol only ever reconstructs the final sum across all members' shares, never an individual member's intermediate value. This is the mathematical guarantee, not merely a policy promise: it is information-theoretically impossible to recover one member's raw contribution from the shares alone below the threshold t.
Secret sharing protects the computation, but the final aggregate result itself can still leak information if it is queried repeatedly with slightly different parameters (a differencing attack). To close this gap, calibrated noise — drawn from a Laplace or Gaussian mechanism — is injected into the aggregate before release, governed by a privacy budget ε that bounds the maximum information any single query (or sequence of queries) can reveal about an individual member's data.
A smaller ε means more noise and stronger privacy guarantees, but a noisier — and therefore less confident — aggregate result. A larger ε sharpens the signal but narrows the consortium's privacy margin. This ε is a governance-board-set parameter, not a per-query choice, precisely because it trades off confidentiality against utility for the whole consortium at once.
At ε = 1.0 (a commonly cited "strong privacy" operating point in differential-privacy literature), the aggregate insight confidence for a 6-member consortium typically lands in the 82–90% band — climbing toward the mid-90s only as ε is relaxed toward 4–5.
Real consortium networks are not perfectly reliable — a member's system can go offline mid-computation. The aggregation protocol, modeled on the secure-aggregation approach popularized by Bonawitz et al. (2017) for federated learning, is explicitly dropout-robust: as long as at least t of n members successfully submit their shares, the aggregate can still be reconstructed, and the protocol reveals nothing extra about members who dropped out.
This matters operationally — a consortium cannot require 100% uptime from every member for every query without becoming fragile. Honest-majority threshold schemes (t < n/2) let the federation tolerate a minority of unavailable or even actively malicious members while still producing a correct, private aggregate for the rest.
| Product | Indication | Trial Design | Key Result |
|---|---|---|---|
| Secure Multi-Party Computation (SMPC) | Shamir secret sharing across members | Local values split into shares; only threshold-combined sums are reconstructable | No raw data or single-party intermediate value ever leaves the island |
| Homomorphic Encryption | Paillier (additive) / CKKS (approximate) | Computation performed directly on ciphertext without decryption | Broker can aggregate encrypted values with zero visibility into plaintext |
| Differential Privacy | Laplace / Gaussian noise mechanisms | Calibrated noise added to released aggregates, bounded by budget ε | Protects against differencing/inference attacks across repeated queries |
| Trusted Execution Environment (TEE) | Intel SGX / AMD SEV-SNP enclaves | Hardware-isolated enclave computes on decrypted data in protected memory | Fast native-speed computation with hardware-attested confidentiality |
The federated query concludes with a single deliverable: one aggregate insight, released identically to every member at the same moment, with no informational advantage to the originator or to any individual contributor. Raw partial shares are cryptographically erased the instant the aggregate is finalized, leaving only an auditable record that the query ran and what template produced the answer.
Once t-of-n secret shares are combined (Stage 4) and differential-privacy noise is applied, the result is one number, one confidence interval, or one aggregated signal — never a breakdown by member. Where the underlying query concerned, for example, a pooled adverse-event rate across pipelines, the delivered insight states the pooled rate and its uncertainty band, but structurally cannot be decomposed back into which member contributed how much, because that decomposition was never computed anywhere in the pipeline.
This is a stronger guarantee than "we promise not to disclose individual contributions" — the individual contributions are mathematically unrecoverable from the final artifact, by design of the threshold secret-sharing scheme used upstream.
The compute environment that briefly holds reconstructed intermediate values (during the final combination step) is provisioned per-query and torn down immediately after the aggregate is emitted. Session keys used for that specific computation are destroyed, and any memory pages that touched intermediate values are zeroed. What persists afterward is only: the query template ID, the timestamp, the cryptographic commitment from Stage 3, and the final aggregate — never the reconstructed per-member terms.
This "compute, deliver, erase" cycle means that even a full forensic compromise of the aggregation node after the fact would recover nothing about individual member contributions — there is simply nothing left to find.
Across the consortium's pilot phase, 1,240+ federated queries have been completed with zero recorded instances of a member's raw data being reconstructed or inferred from a delivered aggregate — the strongest practical validation of the "compute, deliver, erase" model to date.
A subtle but important design choice: the member who originated the query receives the exact same aggregate payload, at the exact same time, as every other member — including competitors who had no idea the query had even been asked. This symmetry is deliberate. It removes any incentive for a member to game the query template library to extract asymmetric intelligence, because doing so would only ever hand the same answer to everyone, including direct competitors.
This "everyone learns the same thing, or no one learns anything" property is what ultimately makes competing companies willing to participate at all — the consortium provides a net information gain (rare signals become visible in aggregate) without any single party gaining a differential edge over the others.
Early pilot results have detected pooled safety signals — for instance, an elevated hepatotoxicity co-occurrence across structurally related compounds from three different member pipelines — that no single company's dataset had sufficient statistical power to flag independently. This mirrors the value proposition already demonstrated by OHDSI's federated observational network and the FDA Sentinel Initiative, both of which rely on distributed querying to detect signals invisible to any single contributing database.
Regulators have taken note: both the EMA and FDA have expressed interest in federated real-world-evidence networks as a template for future post-market surveillance, and GA4GH's federated-analysis working groups have begun documenting the pharma consortium's SMPC-plus-differential-privacy stack as a candidate reference architecture for cross-industry federated knowledge graphs beyond genomics.