Cross-Subspace Alignment (CSA) Codes

• The paper establishes that CSA codes align undesired interference into a common lower-dimensional subspace while preserving the resolvability of desired symbols.
• CSA codes are leveraged in XSTPIR and distributed computation, offering optimal capacity, reduced download costs, and secure, private data retrieval.
• The codes' algebraic foundations extend through Cauchy–Vandermonde constructs, algebraic-geometry methods, and even quantum lifting, promising broader applications.

Searching arXiv for recent and foundational papers on Cross-Subspace Alignment and AG-code realizations. Cross-Subspace Alignment (CSA) codes are coding constructions and, in the original formulation, a coding design principle for arranging desired symbols and undesired terms so that the desired components remain resolvable while interference collapses into a lower-dimensional common subspace. In the foundational $X$-secure, $T$-private information retrieval (XSTPIR) work, CSA is described not as a separate, universally named algebraic code family like Reed–Solomon or MDS codes, but as the mechanism of “introducing a subspace dependence between Reed-Solomon code parameters” so that undesired terms align without causing the desired terms to align among themselves (Jia et al., 2018). Subsequent work used the label “CSA codes” more concretely for Cauchy–Vandermonde constructions in coded distributed batch computation (Jia et al., 2019), then reinterpreted and generalized the same principle through algebraic-geometry (AG) codes on curves of genus $0$, genus $1$, and, later, the Hermitian curve (Makkonen et al., 2024, Ghiandoni et al., 26 Aug 2025).

1. Definitional scope and core mechanism

The term “Cross-Subspace Alignment” has two closely related meanings in the literature. In the asymptotic XSTPIR paper, it denotes a design principle inside achievability schemes: one chooses storage and query structures so that many interference terms do not merely pairwise coincide, but collapse into a low-dimensional common subspace while the desired terms remain linearly independent (Jia et al., 2018). In distributed computation, the term “CSA codes” is then used for explicit code families whose defining algebra is a Cauchy–Vandermonde matrix structure, with desired computations occupying Cauchy coordinates and interference occupying a Vandermonde subspace (Jia et al., 2019).

The common algebraic pattern is that desired quantities are assigned basis elements that remain distinguishable, whereas undesired quantities share a structured ambient span. In the original XSTPIR intuition, choosing identical Reed–Solomon parameters would make desired symbols align among themselves, while choosing parameters too independently would let interference occupy too many dimensions. CSA occupies the middle ground by coupling symbol-layer parameters through common affine structure such as

$\beta=1+\alpha,\qquad \gamma=2+\alpha,$

so that interference vectors lie in the span of a small polynomial basis in $\alpha$ while desired vectors remain resolvable (Jia et al., 2018).

A recurrent misconception is to identify CSA codes with subspace codes in the Grassmannian sense. The subspace-code survey literature defines subspace codes as subsets of $\mathcal{P}_q(n)$ or $\mathcal{G}_q(n,k)$ equipped with subspace distance

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$

but explicitly does not discuss “Cross-Subspace Alignment (CSA) codes” as a named class (Kurz, 2021). Likewise, the coset-construction literature develops constant-dimension subspace codes without introducing CSA terminology (Heinlein et al., 2015). In CSA for PIR and coded computation, “subspace” refers to aligned signal/noise subspaces inside evaluation-code or polynomial constructions, not to a classical Grassmannian code family.

2. Foundational role in $X$-secure, $T$0-private PIR

The canonical CSA setting is XSTPIR with $T$1 distributed servers, $T$2 independent messages, message entropy $T$3 $T$4-ary symbols, storage security threshold $T$5, and user-privacy threshold $T$6. Correctness, $T$7-security, $T$8-privacy, and rate $T$9 are defined information-theoretically, and the asymptotic capacity is

$0$0

The achievability scheme that establishes the nonzero branch is the setting in which CSA emerges as the optimal alignment mechanism (Jia et al., 2018).

In the asymptotically optimal construction, one sets

$0$1

groups message symbols as $0$2, and introduces storage-noise vectors $0$3 and query-noise vectors $0$4. For distinct $0$5 and

$0$6

server $0$7 stores rows of the form

$0$8

and receives query blocks proportional to

$0$9

The answer is one scalar,

$1$0

The resulting answer vector has desired directions

$1$1

while all interference terms can be rewritten inside the span of

$1$2

Thus a large family of undesired terms is compressed into an $1$3-dimensional interference subspace, leaving exactly $1$4 useful dimensions (Jia et al., 2018).

The decoding matrix is invertible when the $1$5 are distinct, and privacy and security follow from Vandermonde invertibility in the storage and query masks. The paper’s worked example with $1$6, $1$7, $1$8 illustrates the defining phenomenon: five interference vectors

$1$9

collapse into the $\beta=1+\alpha,\qquad \gamma=2+\alpha,$0-dimensional span of $\beta=1+\alpha,\qquad \gamma=2+\alpha,$1 when $\beta=1+\alpha,\qquad \gamma=2+\alpha,$2 and $\beta=1+\alpha,\qquad \gamma=2+\alpha,$3. That collapse is precisely what the paper calls cross-subspace alignment (Jia et al., 2018).

One of the central conceptual lessons of the XSTPIR theory is that artificial security noise should generally be aligned rather than decoded. For $\beta=1+\alpha,\qquad \gamma=2+\alpha,$4, a secure-storage MDS-PIR approach that decodes the artificial noise yields asymptotically at best

$\beta=1+\alpha,\qquad \gamma=2+\alpha,$5

strictly below the XSTPIR asymptotic capacity

$\beta=1+\alpha,\qquad \gamma=2+\alpha,$6

CSA is therefore not merely a convenient construction trick; it is the achievability mechanism behind the asymptotic capacity formula (Jia et al., 2018).

3. Cauchy–Vandermonde CSA codes for distributed batch computation

The distributed-computation literature turned CSA from a PIR mechanism into a family of explicit coding schemes for coded distributed batch matrix multiplication (CDBMM), distributed $\beta=1+\alpha,\qquad \gamma=2+\alpha,$7-linear batch computation, and distributed multivariate polynomial batch evaluation (Jia et al., 2019). Here the objective is to distribute a computation across $\beta=1+\alpha,\qquad \gamma=2+\alpha,$8 servers so that the response from any $\beta=1+\alpha,\qquad \gamma=2+\alpha,$9 servers suffices to recover the desired outputs, where $\alpha$0 is the recovery threshold.

For matrix multiplication, the sources hold batches

$\alpha$1

with $\alpha$2 and $\alpha$3, and the user wants

$\alpha$4

CSA introduces batching parameters $\alpha$5 and $\alpha$6 with

$\alpha$7

The $\alpha$8 products are reorganized into $\alpha$9 groups of size $\mathcal{P}_q(n)$0, and the encoding at server $\mathcal{P}_q(n)$1 uses factors

$\mathcal{P}_q(n)$2

together with Cauchy coefficients $\mathcal{P}_q(n)$3. The server returns

$\mathcal{P}_q(n)$4

The decisive algebraic object is the Cauchy–Vandermonde matrix

$\mathcal{P}_q(n)$5

which is invertible when the $\mathcal{P}_q(n)$6 and $\mathcal{P}_q(n)$7 are distinct and $\mathcal{P}_q(n)$8. Desired terms contribute nonzero Cauchy coordinates, whereas undesired cross-products align into the Vandermonde span $\mathcal{P}_q(n)$9. For CSA matrix multiplication, the theorem states

$\mathcal{G}_q(n,k)$0

$\mathcal{G}_q(n,k)$1

$\mathcal{G}_q(n,k)$2

with

$\mathcal{G}_q(n,k)$3

and fast structured encoding and decoding complexities (Jia et al., 2019).

The construction strictly generalizes Lagrange Coded Computing (LCC). Setting $\mathcal{G}_q(n,k)$4 yields LCC with recovery threshold $\mathcal{G}_q(n,k)$5, so LCC is the single-sub-batch special case of CSA. For fixed total batch size $\mathcal{G}_q(n,k)$6, CSA gives

$\mathcal{G}_q(n,k)$7

which reduces the download cost relative to LCC when $\mathcal{G}_q(n,k)$8. The paper emphasizes that this improvement is most relevant in download-limited settings (Jia et al., 2019).

Generalized CSA (GCSA) then combines batch processing with EP-style matrix partitioning. With partitioning parameters $\mathcal{G}_q(n,k)$9, GCSA achieves

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$0

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$1

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$2

and

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$3

The corresponding algebra uses confluent Cauchy–Vandermonde matrices, with desired EP coefficients appearing along confluent-Cauchy coordinates and interference again aligned into a Vandermonde tail (Jia et al., 2019).

The $d_S(U,W)=\dim(U+W)-\dim(U\cap W),$4-CSA generalization extends the same principle to $d_S(U,W)=\dim(U+W)-\dim(U\cap W),$5-linear maps

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$6

For $d_S(U,W)=\dim(U+W)-\dim(U\cap W),$7, it achieves

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$8

$d_S(U,W)=\dim(U+W)-\dim(U\cap W),$9

$X$0

All undesired mixed multilinear terms align into a Vandermonde span of dimension

$X$1

which explains the threshold formula (Jia et al., 2019).

4. Algebraic-geometry reinterpretation and higher-genus generalizations

A major shift in the subject was the observation that the original Jia–Sun–Jafar CSA scheme is an AG-code construction on the genus-$X$2 curve $X$3, and that the same alignment mechanism can be formulated abstractly inside an $X$4-algebra $X$5 using subspaces

$X$6

together with an algebra homomorphism

$X$7

The desired space is

$X$8

and the noise space is

$X$9

If the desired spaces add directly, $T$00, and $T$01 is injective on $T$02, then there exists a secure and private PIR scheme of rate

$T$03

In this language, CSA is the statement that many products of storage, query, privacy, and security spaces are all forced into one common low-dimensional ambient space (Makkonen et al., 2024).

On $T$04, taking

$T$05

with

$T$06

$T$07

recovers the original CSA construction as a Reed–Solomon/GRS evaluation-code scheme. The information divisor is

$T$08

the common noise divisor is

$T$09

and taking

$T$10

gives

$T$11

The limitation is a rational-point constraint: $T$12 That field-size bottleneck motivated the move to higher-genus curves (Makkonen et al., 2024).

For genus $T$13, the construction uses an elliptic curve $T$14, chooses

$T$15

and works with paired affine points $T$16 above $T$17. A custom interpolation-type basis of $T$18 is chosen: $T$19 so that all basis elements satisfy the common divisor bound

$T$20

With

$T$21

$T$22

the resulting PIR scheme has

$T$23

For fixed $T$24, this rate is lower than genus $T$25, but the key tradeoff is that an elliptic curve may have up to

$T$26

rational points, which can allow larger feasible $T$27 and $T$28 at fixed field size. The paper’s explicit example with $T$29, $T$30 gives genus $T$31

$T$32

whereas the elliptic curve $T$33 with $T$34 supports

$T$35

about a $T$36 improvement (Makkonen et al., 2024).

The Hermitian-curve extension pushes this AG viewpoint further by using the maximal curve

$T$37

over $T$38, which has genus

$T$39

a unique point at infinity $T$40, and

$T$41

rational points, thereby attaining the Hasse–Weil upper bound (Ghiandoni et al., 26 Aug 2025). The paper studies replicated-storage XSTPIR and realizes CSA by carefully chosen Riemann–Roch spaces

$T$42

so that

$T$43

have the required direct-sum and trivial-intersection structure.

The decisive technical novelty is a nonstandard basis for

$T$44

adapted to CSA. After multiplying by

$T$45

the basis functions $T$46 satisfy the uniform divisor bound

$T$47

independent of $T$48. This keeps the aligned noise divisor

$T$49

independent of $T$50, which is exactly what preserves a favorable rate (Ghiandoni et al., 26 Aug 2025). Under the theorem’s rational-point hypothesis, the construction yields

$T$51

$T$52

Although the additive overhead $T$53 is larger than in genus $T$54 or genus $T$55, the Hermitian curve’s $T$56 rational points allow much larger admissible $T$57 and $T$58 over fixed field size, which is the basis for the paper’s claim of higher retrieval rates than schemes based on genus $T$59, genus $T$60, and hyperelliptic curves of arbitrary genus in the stated parameter regimes (Ghiandoni et al., 26 Aug 2025).

5. Security, privacy, and noise alignment

Across the literature, CSA separates three roles of randomness. Storage security randomness protects the data against colluding servers, query privacy randomness protects the requested index, and their mixed products create interference terms that must be compressed rather than decoded. In the AG framework, privacy and security are tied to dual distances of evaluation codes: the abstract theorem gives $T$61 security and $T$62 privacy in fragment $T$63 (Makkonen et al., 2024). In the Hermitian construction this becomes

$T$64

which yields $T$65-security and $T$66-privacy (Ghiandoni et al., 26 Aug 2025).

The secure coded multi-party batch matrix multiplication work extends this logic to a stricter model in which the master must learn nothing beyond the target products. Its construction, GCSA-NA, begins from GCSA and adds aligned server-generated noise to mask every coefficient that would otherwise reveal more than the desired outputs (Chen et al., 2020). For parameters $T$67 with

$T$68

Theorem 1 states that GCSA-NA achieves

$T$69

$T$70

$T$71

$T$72

together with explicit normalized encoding, server-computation, and decoding complexities (Chen et al., 2020).

The answer structure preserves the CSA/GCSA decomposition. Desired EP coefficients occupy shifted singular subspaces indexed by $T$73, while cross-instance interference, source-noise interactions, and residual terms align into a polynomial subspace in $T$74. The aligned server-side noise is then inserted in exactly the same singular and polynomial bases: $T$75 This masking does not enlarge the decoding space, because it occupies the already aligned subspaces. The paper uses this to obtain $T$76-security against colluding servers, strong security of all inter-server communication, and master privacy beyond the desired outputs (Chen et al., 2020).

A further practical consequence is that the inter-server communication can be independent of the data. In the paper’s model, one server generates the aligned noise values and sends them to the others, so the communication graph need only be connected. This is contrasted with polynomial sharing, which the paper states does not satisfy strong security because

$T$77

for its inter-server messages (Chen et al., 2020). The broader conceptual point is unchanged from XSTPIR: CSA succeeds when nuisance terms are geometrically compressed into aligned spaces rather than treated as additional payload to be decoded.

6. Quantum lifting, related formalisms, and open directions

CSA has also been lifted to an entanglement-assisted quantum multiple-access setting. In the quantum construction, a classical CSA instance is written as

$T$78

where the classical CSA matrix is Cauchy–Vandermonde. Using the $T$79-sum box abstraction of a quantum multiple-access channel, the paper constructs weighted QCSA matrices from dual generalized Reed–Solomon weights and shows that two classical CSA instances can be decoded “over-the-air” using only $T$80 qudits. The resulting quantum rate law is

$T$81

so the construction achieves maximal superdense coding gain whenever $T$82 (Lu et al., 2023). This quantum work preserves the algebraic essence of CSA: desired terms remain on the Cauchy part, interference remains on the Vandermonde part, and the innovation lies in the communication substrate rather than in redefining alignment itself.

The literature also clarifies what CSA is not. Surveys of subspace codes define constant-dimension and mixed-dimension codes in $T$83, study Grassmannians $T$84, and emphasize subspace and injection distances, but explicitly do not discuss CSA as a named code class (Kurz, 2021). The coset construction for subspace codes similarly develops block-structured constant-dimension codes of the form

$T$85

without introducing CSA terminology (Heinlein et al., 2015). This does not make the two domains unrelated, but it does mean that “CSA codes” in PIR and coded computation should not be conflated with Grassmannian subspace-code families.

Several open directions recur across the subject. In XSTPIR, exact capacity for arbitrary finite $T$86, the role of field size in finite-$T$87 capacity, symmetric XSTPIR for general $T$88, storage-constrained or coded-storage variants, and multi-message retrieval remain open (Jia et al., 2018). In the AG line of work, maximal curves are identified as strong candidates but not proven universally optimal, and extending the Hermitian methods to other maximal curves such as Suzuki and Ree curves is proposed as a natural next step (Ghiandoni et al., 26 Aug 2025). In the quantum direction, extending QCSA beyond the ideal noiseless entanglement-assisted model to erased or lost qudits, i.e. straggler-like settings, is singled out as an open problem (Lu et al., 2023).

Taken together, these works establish CSA as a unifying algebraic idea rather than a narrow one-off construction. In PIR, it is the mechanism that realizes the asymptotically optimal split between $T$89 desired dimensions and $T$90 interference dimensions. In coded distributed computation, it becomes a Cauchy–Vandermonde code family that unifies and generalizes LCC, GCSA, and $T$91-CSA. In AG language, it is a divisor-engineered evaluation-code phenomenon in which Riemann–Roch spaces are chosen so that all noise products share a common divisor bound while desired symbols remain linearly separated. And in the quantum setting, it survives as the same Cauchy-versus-Vandermonde separation implemented through an entanglement-assisted multiple-access channel (Jia et al., 2018, Jia et al., 2019, Makkonen et al., 2024, Ghiandoni et al., 26 Aug 2025, Lu et al., 2023).