Picture an airport where every suitcase arrives sealed in a tamper-proof box, so security can never see what's inside. To keep the line moving, sorting robots still send each box down one of a few hundred conveyor belts based on some hidden property of the contents. No one ever reads a luggage tag — but if you stand and watch which belt each box goes down, over and over, you can slowly reconstruct which bags cluster together, even though you never saw inside a single one. That's the exact tension this paper is built around: encrypt the query so the server never reads it, but the routing trick that makes billion-scale search fast leaks the shape of the sorting system itself. The committed claim: a fully homomorphic encryption (FHE) nearest-neighbor search system that hits genuine billion-vector scale — 1.39 billion CLIP embeddings from DataComp-1B, one billion from Deep1B — on a single GPU, at warm server-side latencies of 1.8 to 6 seconds per query. It does this by combining rank reduction (shrinking each vector's dimensionality before scoring) with a hierarchical index (routing to a small candidate set instead of scanning every row), with both steps executed entirely on ciphertexts. That's a real engineering first at this specific combination of scale, hardware footprint, and deployability — earlier FHE search work exists, but not at a billion rows on one GPU with seconds-level latency. Where it sits on the ladder is more mixed. There's no comparison against a named classical ANN library — no FAISS, no HNSW, no stated plaintext-search latency for scale. What the paper does show is that encryption doesn't cost accuracy: on Deep1B, FHE routing hits recall@10 of 0.9045 over 2000 queries against a plaintext baseline of 0.906, with the 96-to-128 zero-pad measured as exact (correlation 1.0). That's an honest, well-instrumented parity check — but it's the system compared to itself, not to the field's fastest unencrypted competitor. Architecturally, this is an encrypted hierarchical IVF-style index layered with dimensionality reduction, executed inside FHE ciphertexts, with a single GPU as the explicit compute constraint running through every result. The tradeoff is stated plainly throughout: speed comes from indexing structure, and indexing structure is exactly what leaks. And it does leak. An observer watching access patterns alone recovers 72% of the coarse-cell neighbor graph — meaning the routing structure gives away most of the database's internal geometry even though no vector content is ever exposed. The paper's own fix, seeded (fixed-group) padding, cuts that recovery by roughly 35x, down to about 2%. Naive padding, by contrast, is defeated outright by a simple repeated-query attack. Grading the homework here is mostly self-administered — public benchmarks (Deep1B, DataComp-1B) lend real weight, but there's no independent replication and no mention of pre-registered attack protocols. The honest gaps: the reported latencies exclude client-side decryption and network transfer, and the security analysis stops at a repeated-query attacker rather than a fully adaptive one probing the seeded padding scheme systematically. That reads like a scope decision under evaluation budget rather than a buried negative result — three corpora, a full protocol writeup, and a self-administered leakage attack is already a lot of surface area for one paper. The next number worth tracking is latency, not accuracy: sub-second warm response is the obvious threshold for real deployment, and the paper doesn't commit to when that lands. Until an adaptive attacker is tested against seeded padding and someone runs the classical-baseline comparison the paper skips, treat this as a strong proof of feasibility at scale — not yet a settled answer on cost or safety.
