Filtered Vector Search (FVS)

• Filtered Vector Search (FVS) is a technique that retrieves the top‑k nearest vectors subject to metadata constraints, merging similarity search with predicate filtering.
• It employs diverse execution strategies—pre-filtering, post‑filtering, and runtime filtering—to intelligently manage trade-offs between selectivity, recall, and system overhead.
• Current research focuses on cost modeling, advanced indexing architectures, and adaptive query planning to optimize performance across varying hardware and workload conditions.

Searching arXiv for papers on filtered vector search to ground the article. Filtered Vector Search (FVS), also called filtered approximate nearest neighbor search and filtered nearest neighbor search, is the problem of retrieving the top-$k$ nearest vectors to a query subject to a metadata predicate over the indexed objects. Common formulations model a filtered query as $(Q,P,k)$, or as top-$k$ search over $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$; more general treatments pair each point $x_p$ with an attribute $a_p$ and search over points satisfying $g(a_p,f_q)=1$ (Gan et al., 20 Feb 2026, Ye et al., 31 Oct 2025, Xu et al., 10 Feb 2026). Recent work treats FVS as a systems problem spanning graph traversal, partitioned indexes, relational predicate evaluation, SSD I/O, GPU execution, and query planning, because the presence of a predicate changes both the effective search space and the execution order that is optimal for a given workload (Song et al., 5 Jan 2026, Lu et al., 24 Mar 2026).

1. Formal models and predicate semantics

The formal core of FVS is stable across papers even when notation differs. In one formulation, a filtered ANN query is the triple $(Q,P,k)$, where $Q$ is the query vector, $P$ is a predicate over metadata, and $(Q,P,k)$0 is the number of desired results (Gan et al., 20 Feb 2026). In another, the dataset is $(Q,P,k)$1, the query is $(Q,P,k)$2, and the exact target is $(Q,P,k)$3 with $(Q,P,k)$4 (Ye et al., 31 Oct 2025). JAG states the objective as

$(Q,P,k)$5

which makes explicit that vector similarity is evaluated only on filter-satisfying points (Xu et al., 10 Feb 2026).

The supported predicate families are broader than simple label equality. JAG formalizes four filter families—Label, Range, Subset, and Boolean—and defines them through corresponding attribute domains $(Q,P,k)$6, filter domains $(Q,P,k)$7, and binary match functions $(Q,P,k)$8 (Xu et al., 10 Feb 2026). The learning-based query-planning framework supports categorical/keyword predicates, numeric range predicates, and mixed predicates containing both (Gan et al., 20 Feb 2026). PipeANN-Filter treats predicates through an is_member abstraction that supports label predicates, range predicates, and Boolean compositions such as AND and OR (Guo et al., 18 May 2026). Compass presents arbitrary conjunctions, disjunctions, range predicates, and multi-attribute predicates as the intended scope of “general filtered search” (Ye et al., 31 Oct 2025).

A security-framed special case is policy-aware vector search, where the predicate is an authorization condition rather than an application-level filter. In that setting, FGAC policies are represented as $(Q,P,k)$9, with object constraints $k$0, subject constraints $k$1, and action $k$2; the authorized search space is $k$3 (Yalamarthi et al., 18 Jun 2026). This is still FVS, but the filter semantics are security-critical rather than merely preference-oriented.

2. Selectivity, correlation, and structural difficulty

The dominant workload variable in FVS is selectivity, usually defined as the fraction of indexed points satisfying the predicate. NaviX writes global selectivity as

$k$4

where $k$5 is the selected subset (Sehgal et al., 29 Jun 2025). Curator defines filter selectivity as $k$6 for a qualifying set $k$7 (Jin et al., 3 Jan 2026). JAG emphasizes that high-selectivity queries admit many valid points, while low-selectivity queries admit few, and that the difficult regime is the middle one, where the valid subset is too large for cheap exact pre-filtering but too sparse for efficient post-filtering (Xu et al., 10 Feb 2026).

Correlation between query geometry and predicate satisfaction is a second structural variable. NaviX defines

$k$8

with $k$9 derived from the overlap between the query’s nearest neighbors and the selected subset; $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$0 indicates no correlation, $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$1 positive correlation, and $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$2 negative correlation (Sehgal et al., 29 Jun 2025). A system-oriented alternative is Global-Local Selectivity (GLS), which compares global selectivity

$$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$3

to local selectivity

$$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$4

forms $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$5, and then maps it to

$$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$6

to measure enrichment or depletion of valid points in the query neighborhood (Amanbayev et al., 11 Feb 2026).

Low selectivity is difficult because it changes the topology of the effective search space. Curator calls this graph connectivity breakdown: if the search is logically restricted to the subgraph induced by qualifying vectors, the induced subgraph becomes sparse and fragmented as selectivity decreases (Jin et al., 3 Jan 2026). RACORN-1 makes the same point in ACORN-style traversal with the approximation that expected passing one-hop neighbors are $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$7 and expected passing two-hop neighbors are $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$8, so the frontier collapses as $$\mathcal D'=\{(v_i,a_i)\in \mathcal D \mid p(a_i)=\mathrm{true}\}$$9 becomes very small (Kim et al., 1 Jul 2026). GateANN expresses the storage consequence directly: if selectivity is $x_p$0, post-filtering wastes roughly a $x_p$1 fraction of SSD reads on nodes that are invalid as answers, so at $x_p$2 about 90% of reads can be wasted (Lee et al., 23 Mar 2026).

This combination of selectivity and correlation explains why FVS is not reducible to ordinary ANN plus a predicate. The valid subset can be small globally, depleted locally, disconnected in the graph, or badly aligned with storage layout. A plausible implication is that any robust FVS system must reason not only about the number of valid points, but also about where those points sit relative to query neighborhoods, partitions, and storage tiers.

3. Execution strategies and query planning

The standard execution taxonomy is pre-filtering, runtime- or inline-filtering, and post-filtering (Amanbayev et al., 11 Feb 2026). Pre-filtering applies the predicate first and then searches the surviving subset. Post-filtering runs ANN first and removes invalid results afterward. Runtime-filtering evaluates metadata lazily as candidates are touched during search. Production systems frequently add hybridization on top of these basic patterns, including exact fallback, candidate expansion, and planner-driven switching (Gan et al., 20 Feb 2026, Ye et al., 31 Oct 2025).

Strategy	Execution order	Typical consequence
Pre-filtering	filter first, then search filtered subset	can use brute-force KNN over survivors; preserves correctness but can be slow (Gan et al., 20 Feb 2026)
Post-filtering	ANN first, then apply predicate	operationally simple, but recall degrades under low selectivity unless the engine over-fetches (Gan et al., 20 Feb 2026)
Runtime / inline-filtering	interleave filtering with traversal	supports arbitrary predicates, but can pay substantial filter and system overheads (Lu et al., 24 Mar 2026)
Cooperative / planner-based execution	choose or combine plans per query	exploits selectivity, local pass rate, or learned signals to switch plans (Ye et al., 31 Oct 2025)

The trade-off between pre-filtering and post-filtering is explicit in the learned planning framework. Pre-filtering can be advantageous when only a small fraction of the corpus passes the filter, but constructing high-performance indexes such as HNSW on each filtered subset is prohibitively expensive; the implementation therefore uses brute-force KNN after filtering and reports that pre-filtering with an HNSW index could take more than 4000 seconds end-to-end, versus 850 seconds with brute-force search, due to index construction cost (Gan et al., 20 Feb 2026). Post-filtering avoids per-predicate index construction by reusing a global ANN index, but it may waste computation and lose recall under low selectivity; the described implementation retrieves $x_p$3 candidates, filters them, and doubles $x_p$4 if fewer than $x_p$5 valid results remain (Gan et al., 20 Feb 2026).

Several systems elevate plan choice to a first-class problem. The learning-based planner is a binary model that chooses between pre-filtering and post-filtering from features including dimensionality, corpus size, a vector distribution measure, and estimated filter selectivity, and reports up to $x_p$6 acceleration while maintaining $x_p$7 recall (Gan et al., 20 Feb 2026). Compass instead uses cooperative execution: a graph index remains the main driver, but clustered B+-trees inject predicate-satisfying candidates when the local neighborhood passrate falls below a threshold, using default $x_p$8 for that handoff (Ye et al., 31 Oct 2025). Policy-aware vector search studies the same choice space under authorization constraints and compares pre-filtering, post-filtering, iterative post-filtering, parallel post-filtering, and hybrid filtering as enforcement strategies (Yalamarthi et al., 18 Jun 2026).

4. Indexing and traversal designs

A large part of the literature redesigns navigation rather than only execution order. JAG introduces attribute distance $x_p$9 and filter distance $a_p$0, replacing binary filter checks with continuous navigational guidance, and then constructs a Joint Attribute Graph by combining multiple thresholded attribute neighborhoods in one graph (Xu et al., 10 Feb 2026). NaviX evaluates the selection subquery first, materializes the subset $a_p$1, and then uses adaptive-local traversal, selecting among onehop-s, directed, and blind heuristics from local selectivity in the HNSW neighborhood (Sehgal et al., 29 Jun 2025). FAVOR retains a standard HNSW graph but changes the effective distance seen by the search through an exclusion distance,

$a_p$2

so non-target data remain traversable but are pushed away from the query; low-selectivity queries are routed to pre-filtering brute-force when estimated selectivity falls below $a_p$3 (Song et al., 8 May 2026). RACORN-1 extends ACORN-1 with Adaptive Search Fallback, repurposing filter-failing nodes as transient bridges when passing two-hop candidates are insufficient, and RACORN-1+ adds Adaptive Exact Fallback for the extreme-low-selectivity regime (Kim et al., 1 Jul 2026).

A second line of work treats FVS as physical design. SIEVE argues that constraining traversal is the wrong direction for many workloads and instead builds many indexes, each serving different predicate forms, then uses a three-dimensional analytical model of index size, search time, and recall both during construction and at query time; the abstract reports up to $a_p$4 speedup, as low as 1% build time versus other indexes, and less than $a_p$5 memory of a standard HNSW graph (Li et al., 16 Jul 2025). Curator proposes a dual-index architecture: use a graph-based ANN index for high-selectivity queries and a partition-based index for low-selectivity queries, with label-specific buffers embedded in a shared hierarchical clustering tree and Bloom filters guiding traversal; integrated with ACORN, Curator reduces low-selectivity query latency by up to $a_p$6 relative to ACORN plus pre-filtering fallback while adding only 5.5% construction-time overhead and 4.3% memory overhead (Jin et al., 3 Jan 2026). Compass occupies another design point: it avoids new fused indexes entirely and coordinates HNSW or IVF with clustered B+-trees through a shared candidate queue, preserving generality across conjunctions, disjunctions, and range predicates (Ye et al., 31 Oct 2025).

A third line pushes filtering into geometry. FCVI transforms each vector by

$a_p$7

preserves distances exactly for items with identical filters, and reports $a_p$8–$a_p$9 higher throughput than pre-filtering while maintaining comparable recall (Heidari et al., 19 Jun 2025). FusedANN uses a related transformation

$g(a_p,f_q)=1$0

and reranks with $g(a_p,f_q)=1$1, where $g(a_p,f_q)=1$2 is attribute distance and $g(a_p,f_q)=1$3 is content distance; unlike strict Boolean filtered search, part of the paper explicitly broadens the semantics to relaxed hybrid retrieval when exact matches are insufficient (Heidari et al., 24 Sep 2025). This suggests a split inside FVS between strict predicate enforcement and geometric relaxation of metadata constraints.

5. Storage architecture, SSD systems, and GPU execution

Storage architecture changes which FVS bottlenecks dominate. The tutorial on vector search architectures argues that memory-resident systems are mainly constrained by computation and navigational efficiency, whereas heterogeneous memory–SSD systems are dominated by random I/O and the placement of “lightweight structures for routing and coarse pruning” versus “space-intensive raw vectors and fine-grained indexes” (Song et al., 5 Jan 2026). For FVS, the tutorial explicitly points to Filtered-DiskANN as a graph-based heterogeneous-storage method supporting FANN, and to Hybrid-IVFFlat, which colocates vector identifiers and filterable attributes within posting-list entries so filtering and candidate pruning can happen in a single sequential pass (Song et al., 5 Jan 2026).

Two SSD-native designs illustrate how strongly filtering interacts with I/O. GateANN decouples graph traversal from vector retrieval: if a node fails the predicate, the system does not read its SSD record but instead tunnels through it using an in-memory neighbor store and PQ distances, preserving graph connectivity without SSD I/O for non-matching nodes (Lee et al., 23 Mar 2026). PipeANN-Filter makes a different trade-off, using speculative filtering over a no-false-negative superset of valid vectors, with Bloom filters for labels and 1-byte quantized buckets for ranges, then verifying attributes only after reranking; the design routes among speculative pre-filtering, speculative in-filtering, and post-filtering using a cost model that weights I/O by $g(a_p,f_q)=1$4 and compute by $g(a_p,f_q)=1$5 (Guo et al., 18 May 2026).

GPU work shows that the same FVS problem can lead to a different index decomposition. VecFlow builds a label-centric inverted structure in which each label defines a posting list $g(a_p,f_q)=1$6, then routes large lists to label-local graph search and small lists to brute-force scan on an interleaved GPU layout (Xi et al., 1 Jun 2025). On SIFT-1M, it reports 5M QPS at 90% recall for $g(a_p,f_q)=1$7, and on YFCC-10M it reaches 2.6M QPS at 90% recall; persistent kernels improve small-batch performance by $g(a_p,f_q)=1$8 average QPS on SIFT and $g(a_p,f_q)=1$9 on YFCC (Xi et al., 1 Jun 2025). The GPU setting therefore does not remove the FVS trade-off; it changes which partitions and execution kernels are effective.

6. Empirical patterns and recurrent misconceptions

One recurring misconception is that minimizing vector distance computations is the dominant objective. The PostgreSQL study rejects that premise directly, arguing that in a production-grade database system the optimal algorithm is not dictated by the cost of distance computations alone, because system-level overheads from both distance computations and filter operations—such as page accesses and data retrieval—play a significant role (Lu et al., 24 Mar 2026). The same study shows that graph-based methods can incur prohibitive numbers of filter checks and system-level overheads, and that clustering-based ScaNN can outperform graph approaches by $(Q,P,k)$0–$(Q,P,k)$1 on low-dimensional datasets inside PostgreSQL-compatible execution (Lu et al., 24 Mar 2026).

A second misconception is that graph-based filtered search is uniformly superior. The vector-database study reports that partition-based indexes (IVFFlat) outperform graph-based indexes (HNSW) for low-selectivity queries, and that Milvus achieves superior recall stability through hybrid approximate/exact execution rather than through raw HNSW behavior alone (Amanbayev et al., 11 Feb 2026). The same paper shows that pgvector’s cost-based optimizer frequently selects suboptimal execution plans, often preferring approximate index scans even when exact sequential scans would yield perfect recall at comparable latency (Amanbayev et al., 11 Feb 2026). In other words, engine behavior and plan selection can dominate the nominal index family.

A third misconception is that one static strategy suffices across workloads. The learned query planner reports up to $(Q,P,k)$2 acceleration with $(Q,P,k)$3 recall by choosing between pre-filtering and post-filtering on a per-query basis (Gan et al., 20 Feb 2026). RACORN-1 identifies a “sweet spot” of roughly 1%–0.3% selectivity for bridge-augmented graph search, while RACORN-1+ switches to exact fallback in the extreme-low-selectivity tail and reports recall 1.00 with $(Q,P,k)$4–$(Q,P,k)$5 speedup at 1M scale for $(Q,P,k)$6 selectivity, and $(Q,P,k)$7 speedup at 40M scale for 0.01% selectivity (Kim et al., 1 Jul 2026). Curator’s central lesson is even more explicit: the low-selectivity regime deserves its own index design rather than further graph densification (Jin et al., 3 Jan 2026).

These results jointly imply that FVS should be understood as a workload-adaptive search problem. Selectivity, query–filter correlation, vector dimensionality, requested $(Q,P,k)$8, storage architecture, and DBMS execution overhead all change the preferred design point. This suggests that comparisons that isolate only one of these variables are structurally incomplete.

7. Open problems and research directions

Several open directions recur across the literature. One is cost modeling. PipeANN-Filter notes that distribution-aware cost models remain future work, because current analysis assumes approximate uniform distribution of valid vectors (Guo et al., 18 May 2026). Compass says its relational-side planning is heuristic rather than cost-based and that clustered B+-tree predicate evaluation for arbitrary Boolean combinations is not yet fully optimized (Ye et al., 31 Oct 2025). The PostgreSQL study similarly points to the need for optimizer rules that reason jointly about selectivity, exact-scan cost, and filtered ANN behavior inside a production engine (Lu et al., 24 Mar 2026).

A second direction is updates, drift, and workload shift. The learning-based planner is trained independently per dataset and may require retraining when distributions shift (Gan et al., 20 Feb 2026). VecFlow identifies index construction efficiency for many labels as future work and does not study multi-GPU scaling (Xi et al., 1 Jun 2025). PipeANN-Filter duplicates attributes in row-wise and column-wise forms and leaves maintenance of Bloom filters, quantized summaries, and duplicated indexes under frequent writes as an open issue (Guo et al., 18 May 2026). FCVI explicitly identifies separate indexes per filter field combination as a main limitation (Heidari et al., 19 Jun 2025).

A third direction is semantics. Policy-aware vector search asks for a formal contract for approximate but policy-compliant top-$(Q,P,k)$9 retrieval and highlights soundness, security, and maximality as criteria that need reinterpretation for vector databases (Yalamarthi et al., 18 Jun 2026). FusedANN, by contrast, intentionally broadens strict filtering into relaxed hybrid retrieval in part of the paper, which sharpens the distinction between exact predicate enforcement and soft metadata-aware ranking (Heidari et al., 24 Sep 2025). A plausible implication is that future FVS systems will need clearer semantic tiers: strict filtered ANN, approximate filtered ANN with exact verification, and relaxed hybrid retrieval.

A fourth direction is architecture-aware co-design. The storage tutorial identifies tier-aware index co-design, adaptive and predictive caching, efficient querying from object storage, elasticity and auto-scaling, and cost optimization as open research opportunities for future large-scale vector retrieval systems (Song et al., 5 Jan 2026). FVS adds a further requirement: the placement of vectors, metadata, summaries, and traversal structures must align with predicate selectivity and query locality, not only with vector similarity. This suggests that the next generation of FVS research will be shaped as much by storage architecture and query optimization as by ANN data structures themselves.