HNSW with Accuracy Guarantees Using Graph Spanners

Abstract: Hierarchical Navigable Small World (HNSW) graphs serve as the industry standard due to their logarithmic complexity and strong empirical performance. However, HNSW relies on greedy graph traversal, a heuristic that provides no theoretical guarantees of correctness. In this paper, we propose a novel "Certify-then-Rectify" framework that bridges the gap between the speed of heuristic search and the rigor of exact retrieval. Rather than discarding HNSW, our approach first employs a distribution-free statistical certifier to dynamically evaluate the quality of a standard HNSW search with minimal overhead. If certification indicates that the retrieved neighbors are of low quality, the framework safely escalates to a rigorous exact recovery algorithm. To make this exact recovery computationally feasible, we reinterpret the HNSW graph as a geometric spanner and utilize Extreme Value Theory to stochastically estimate its maximum empirical stretch factor. This allows us to mathematically bound the maximum distance of true nearest neighbors. Extensive evaluations on benchmark datasets demonstrate that our tiered framework delivers the average-case speed of HNSW while ensuring the worst-case correctness of exact search and outperforming other applicable approaches.

• The paper introduces a Certify-then-Rectify (CTR) framework that rigorously certifies HNSW outputs using graph spanner theory and Extreme Value Theory.
• It employs statistical certification and stretch-bounded expansion to balance sublinear search latency with exact top-k nearest neighbor recovery.
• Empirical results show dramatic reductions in distance computations and guarantee high recall across datasets like SIFT1M, DEEP1M, and GIST1M.

Certifiable HNSW: Accuracy Guarantees for Graph-Based Nearest Neighbor Search

Introduction and Motivation

Hierarchical Navigable Small World (HNSW) graphs are the empirical standard for Approximate Nearest Neighbor (ANN) search in high-dimensional spaces, powering retrieval in domains from embeddings in LLM retrieval to molecular search. However, HNSW uses greedy, heuristic graph traversal, providing no a priori or instance-level correctness guarantees—critical for settings demanding exact top-$k$ retrieval. The absence of such guarantees has driven application-specific parameter tuning and ad hoc recall boosting, which remain fundamentally heuristic and cannot rule out pathologies such as local minima or connectivity failures.

This work introduces a framework that wraps the high-performance HNSW index in a rigorous Certify-then-Rectify (CTR) pipeline. This pipeline uses novel graph-spanner-theoretic insights, statistical extremes, and conformal risk control, enabling sublinear average latency with certified worst-case correctness. The key contributions are a rigorous statistical certifier for HNSW output and a tractable exact recovery algorithm based on graph spanner stretch bounds, with generalization to filtered search and disk-based settings.

Graph Spanner Theory and Stochastic Stretch Estimation

The centerpiece of the technical framework is the reinterpretation of the bottom-layer HNSW graph as a geometric spanner. The key parameter here is the stretch $t$, bounding the worst-case ratio between HNSW graph shortest-path distance and true metric distance. Although HNSW is not constructed as a classical $t$-spanner, the empirical stretch of any given instantiation is finite and can be stochastically estimated.

The authors introduce a sampling protocol grounded in Extreme Value Theory (EVT): blocks of random node pairs $(u,v)$ are sampled and the ratio $\frac{d_G(u, v)}{\text{dist}(u, v)}$ is recorded, focusing on the maxima per block. The distribution of these maxima converges to a Generalized Extreme Value (GEV) distribution. The confidence threshold $\beta$ is used to select a stretch $t^*$, certifying with $1-\beta$ confidence that the true empirical stretch does not exceed $t^*$. The protocol is efficient—requiring only a vanishing fraction of all possible distance computations per block.

Figure 2: Stretch estimation as a function of block count $m$ and EVT confidence $t$0, showing convergence and safe conservatism with higher $t$1 and larger $t$2.

The effect of HNSW construction parameters ($t$3, $t$4) on the empirical stretch is also quantified.

Figure 4: Increased HNSW connectivity ($t$5, $t$6) reduces stretch, reflecting improved navigability and reduced path distortion.

Stretch-Bounded Exact Rectification

For rectification, if the certifier deems a query result unreliable, the pipeline escalates to a subgraph expansion algorithm with theoretical guarantees. Two approaches are grounded in spanner theory:

• SBE-NN (Stretch-Bounded Expansion from Nearest Neighbor): Expands from the closest returned candidate $t$7 within a radius proportional to $t$8, guaranteeing inclusion of all true top-$t$9 vectors.
• SBE-Q (Stretch-Bounded Expansion from Query): Expands from the query $t$0 within radius $t$1, after virtually adding the query to the graph. SBE-Q yields a search region strictly contained in that of SBE-NN.

Metric Bound Verification (MBV) further prunes the candidate set during traversal by leveraging triangle inequality-derived lower bounds, and elliptical pruning that adaptively shrinks the search space as true candidate bounds improve.

Conformal Certification of HNSW Output

To avoid expensive exact recovery on every query, the framework first certifies each HNSW output using a statistical, distribution-free certifier built via Conformal Risk Control (CRC) and Learn-then-Test (LTT). The certifier leverages a feature vector computed from the HNSW search trace (distance geometry, path instability, search trace size) and uses logistic regression for scoring.

• CRC guarantees that the expected per-query recall shortfall among certified outputs is bounded by $t$2 for target recall $t$3 and risk parameter $t$4.
• LTT further certifies with per-query confidence, controlling the probability that a certified output falls below the recall target.

The calibrated threshold $t$5 (Figure 5) governs the certify/escalate split, modulating the correction/latency trade-off.

Figure 7: Alpha-sweeps on benchmark datasets. As $t$6 decreases, compliance rate increases at higher runtime overhead; both CRC and LTT exhibit monotonic trade-off curves.

Figure 1: Tau-sweep showing compliance rate and runtime cost as recall strictness $t$7 increases.

Figure 3: LTT threshold surface: higher thresholds select stricter certification, increasing fraction escalated to exact rectification.

System Results and Empirical Guarantees

Strong numerical outcomes include:

• With $t$8, $t$9, SBE-Q+MBV achieves reduction in distance computations by up to $(u,v)$020 compared to SBE-NN, with exact top-$(u,v)$1 recovery at recall 1.0.
• On datasets SIFT1M, DEEP1M, and GIST1M, the probability of failing to recover the true $(u,v)$2-NN can be driven arbitrarily low with increased sample size and confidence parameters.
• Scalability: For 10M and 100M vector corpora, expansion fraction drops as dataset size grows due to shrinking $(u,v)$3; rectification remains sublinear relative to corpus size.
• Comparison: CTR dominates ConANN in compliance-throughput Pareto frontier (Figure 9).

  Figure 6: Repeated-certification policy: expanding HNSW beam width incrementally when certification fails can recover compliance with lower cost on easy datasets but fails on hard queries as in GIST1M.

  

  Figure 8: Tau ablation demonstrates sublinear scaling in exact rectification overhead for 10M and 100M datasets.

  

  Figure 5: CTR achieves higher compliance than ConANN across all throughput levels.

Extension to Filtered and Disk-Based Search

The methodology generalizes to filtered search (FANNS): filtered versions of SBE-Q and MBV guarantee recall for predicates of arbitrary selectivity, even when filters disconnect the graph topology. The statistical certification/rectification trade-off curves transfer naturally, maintaining the tunable compliance-runtime tradeoff.

The approach is also integrated with disk-based graph indexes (e.g., DiskANN), enabling correctness-certified search even in scenarios where the entire graph cannot be memory-resident.

Implications and Future Directions

This work closes the gap between the empirical success of HNSW and the need for formal correctness guarantees in high-stakes retrieval. The blending of spanner-theory, EVT, and uncertainty quantification frameworks yields an operational regime interpolating between sublinear, high-throughput ANN and exact $(u,v)$4-NN recovery at a fraction of the brute-force cost. The pipeline's end-to-end guarantee is formally decomposed into two distributions, yielding strong statements on both expected and worst-case recall rates, and can be tuned via intuitive parameters.

Implications for AI systems are immediate: certified vector retrieval means downstream logic, data mining, and LLM augmentation pipelines can be made robust to ANN failures, with strong safety and audit properties. The techniques open avenues for distributable, delta-certified search in dynamic or streaming databases, as well as predicate-optimized transformation for domains with heterogeneous filter constraints.

Potential future work includes local stretch modeling, workload-adaptive certification, robustness improvements for dynamic graphs, and extensions to other graph-based or hybrid ANN architectures.

Conclusion

By rigorously bridging the heuristic HNSW architecture with algorithmic certification and sublinear exactification strategies, this work establishes a robust methodology for certified high-dimensional similarity search. The Certify-then-Rectify paradigm enables practitioners to trade off correctness, latency, and throughput in a principled, controllable manner, with broad applicability to both real-time and batch retrieval scenarios across massive datasets. The approach is broadly extensible and addresses a critical accuracy gap for ANN systems in data-driven AI infrastructures (2607.02338).