Security of the Goldreich–Goldwasser– Halevi (GGH) Scheme
If you look at the GGH paper, they explicitly say that they reduce to a random instance of CVP. At the end of the paragraph on CVP in Section 2.1, it explicitly says: &quot;As we explain in Section 3, an attack against our trapdoor function amounts to finding an exact solution for some random instance of CVP.&quot; Peikert is referring to worst-case guarantees (i.e., hardness for any instance of CVP) whereas GGH considered an average-case problem (when the instance is generated at random).