How can Private Set Intersection enable joint research without exposing raw lists?

WHAT THIS TESTS: This question tests whether you understand secure multi-party computation and privacy-preserving cryptography well enough to apply it to a real business scenario. The interviewer wants to see that you know PSI is not just encryption but a specific protocol for computing set intersections without revealing the full datasets. They are looking for familiarity with threat models, the distinction between cryptographic privacy and procedural privacy, and the practical constraints of implementing such systems.

A GOOD ANSWER COVERS: First, describe the standard server-client PSI flow where each party holds a set of user identifiers. Both parties encrypt or blind their sets using cryptographic primitives such as homomorphic encryption or oblivious transfer. The protocol then computes the intersection mathematically on the encrypted values so that neither party can infer the others non-matching elements. In the most common setup, only the client learns the final intersection set while the server learns nothing. Second, list the technical prerequisites: both parties must agree on a common identifier format and cryptographic protocol, establish secure key exchange infrastructure, and provision significant compute resources because operations on encrypted data are orders of magnitude slower than plaintext. Third, acknowledge scalability limits; fully homomorphic encryption can be prohibitively expensive for country-scale populations, so partially homomorphic schemes or specialized hardware may be needed. Fourth, mention that PSI protects against honest-but-curious adversaries, and stronger threat models may require additional protections.

COMMON WRONG ANSWERS: A major red flag is suggesting that anonymization, pseudonymization, or salted hashing is sufficient. These methods do not provide cryptographic guarantees and can often be reversed or linked. Another mistake is conflating PSI with standard encryption in transit or at rest; TLS and database encryption protect data from third parties but do not prevent the partner from seeing raw values once received. Candidates also err by ignoring computational cost and suggesting homomorphic encryption is a free abstraction, or by proposing legal NDAs as a technical prerequisite rather than a compliance layer.

LIKELY FOLLOW-UPS: The interviewer may ask how you would handle a malicious party rather than an honest-but-curious one. They might probe the performance difference between oblivious transfer and homomorphic encryption approaches, or ask how to perform a cardinality check without revealing the actual intersecting IDs. Another common follow-up is how to prevent leakage from the size of the intersection or from repeated queries over time.

ONE CONCRETE EXAMPLE: Suppose Company A and Company B each have ten million user emails and want to know how many overlapping users they share for a joint wellness study. Using a PSI protocol based on oblivious transfer, Company A acts as the client and Company B as the server. Company B encrypts its email set with a private key and sends the encrypted bloom filter or encrypted items to Company A. Company A uses oblivious transfer to query its own emails against Company B's encrypted set without revealing the emails it is testing. The protocol returns only the matching encrypted identifiers, which Company A can verify. Company B never learns which emails matched or even the size of Company A's set. The study proceeds with the overlapping cohort without either company exposing raw user lists.

Source: openmined.org