Google has released HEIR, an open-source compiler toolchain designed to make homomorphic encryption usable by developers who are not cryptographers. The project, detailed on the company's security blog, can take a pre-trained AI model built to operate on ordinary data and convert it to run on encrypted inputs instead.
Homomorphic encryption allows computation to be performed directly on ciphertext. A server can process encrypted data and return an encrypted result without ever seeing what it worked on. Google's framing is that this reshapes a familiar trade-off: rather than choosing between protecting user data and offering features that depend on it, the question becomes one of cost, and that cost is falling.
The Trade-Off HEIR Targets
Standard end-to-end encryption protects data from breaches but locks the provider out of features such as spam or virus detection. Regulated sectors including healthcare and finance are especially constrained, with rules limiting how institutions share data. Running models locally instead is capped by device capability and creates a second problem, since shipping a proprietary model to a handset risks leaking it.
The obstacle has been usability rather than theory. Converting an existing program to run efficiently under homomorphic encryption has historically required a team of specialists. HEIR, short for Homomorphic Encryption Intermediate Representation, aims to collapse that into a compiler pass. Google describes the goal as a one-click path that lets non-experts add encrypted inference to production systems.
Four Working Demonstrations
To show the technology's current state, Google published four private inference applications, all compiled with HEIR and measured on a single-threaded CPU, with source code in the project's GitHub repository.
- A deep learning recommendation model, built with Belfort Labs, LG and New York University, that serves content recommendations without the provider seeing user features.
- A credit card fraud detector developed with Niobium and hardshell.ai.
- An adaptation of the Kitsune anomaly detection system, also with Niobium, which flags suspicious network traffic without exposing packet contents to the service provider.
- A hotword detector built with Belfort Labs, allowing a voice-triggered agent to recognise its wake word while the underlying audio stays private.
An Ecosystem, Not Just a Tool
Since Google signalled its intentions in 2023, HEIR has attracted partners building dedicated hardware accelerators, including Belfort, Niobium, Cornami and Optalysys. The company says it plans to demonstrate the latency gains from that silicon in the near future.
It has also become a research substrate. By building on shared infrastructure for testing and benchmarking, cryptographers can concentrate on individual optimisations rather than rebuilding a toolchain each time. Collaborations span Georgia Tech, Carnegie Mellon, UC Santa Barbara, Illinois Institute of Technology, Purdue, the University of Edinburgh and Tsinghua University, and four peer-reviewed papers have been built on the project so far.
Where This Sits
HEIR joins a privacy portfolio that already includes differential privacy, private set membership, private information retrieval and secure enclaves on Google Cloud. The distinction the company draws is that homomorphic encryption's guarantees are purely cryptographic, unlike hardware-based approaches that ultimately depend on trusting a chip vendor's isolation.
Performance remains the open question. Encrypted inference still carries meaningful overhead, and the published figures come from single-threaded CPU runs rather than tuned production deployments. Independent write-ups of the toolchain describe compiling a small TensorFlow Lite model to run under encryption with inference measured in seconds, which is workable for narrow tasks and far from interactive for large ones.
The direction is nonetheless clear. With the compiler barrier lowered and accelerators arriving from four hardware partners, private inference is shifting from a cryptography research problem toward something an ordinary engineering team can realistically evaluate.
