1d:I[70616,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"Breadcrumb"] 1e:I[90762,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"ArticleGrid"] 1f:T10d3,

Google has released HEIR, an open-source compiler toolchain designed to make homomorphic encryption usable by developers who are not cryptographers. The project, detailed on the company's security blog, can take a pre-trained AI model built to operate on ordinary data and convert it to run on encrypted inputs instead.

Homomorphic encryption allows computation to be performed directly on ciphertext. A server can process encrypted data and return an encrypted result without ever seeing what it worked on. Google's framing is that this reshapes a familiar trade-off: rather than choosing between protecting user data and offering features that depend on it, the question becomes one of cost, and that cost is falling.

The Trade-Off HEIR Targets

Standard end-to-end encryption protects data from breaches but locks the provider out of features such as spam or virus detection. Regulated sectors including healthcare and finance are especially constrained, with rules limiting how institutions share data. Running models locally instead is capped by device capability and creates a second problem, since shipping a proprietary model to a handset risks leaking it.

The obstacle has been usability rather than theory. Converting an existing program to run efficiently under homomorphic encryption has historically required a team of specialists. HEIR, short for Homomorphic Encryption Intermediate Representation, aims to collapse that into a compiler pass. Google describes the goal as a one-click path that lets non-experts add encrypted inference to production systems.

Four Working Demonstrations

To show the technology's current state, Google published four private inference applications, all compiled with HEIR and measured on a single-threaded CPU, with source code in the project's GitHub repository.

A deep learning recommendation model, built with Belfort Labs, LG and New York University, that serves content recommendations without the provider seeing user features.
A credit card fraud detector developed with Niobium and hardshell.ai.
An adaptation of the Kitsune anomaly detection system, also with Niobium, which flags suspicious network traffic without exposing packet contents to the service provider.
A hotword detector built with Belfort Labs, allowing a voice-triggered agent to recognise its wake word while the underlying audio stays private.

An Ecosystem, Not Just a Tool

Since Google signalled its intentions in 2023, HEIR has attracted partners building dedicated hardware accelerators, including Belfort, Niobium, Cornami and Optalysys. The company says it plans to demonstrate the latency gains from that silicon in the near future.

It has also become a research substrate. By building on shared infrastructure for testing and benchmarking, cryptographers can concentrate on individual optimisations rather than rebuilding a toolchain each time. Collaborations span Georgia Tech, Carnegie Mellon, UC Santa Barbara, Illinois Institute of Technology, Purdue, the University of Edinburgh and Tsinghua University, and four peer-reviewed papers have been built on the project so far.

Where This Sits

HEIR joins a privacy portfolio that already includes differential privacy, private set membership, private information retrieval and secure enclaves on Google Cloud. The distinction the company draws is that homomorphic encryption's guarantees are purely cryptographic, unlike hardware-based approaches that ultimately depend on trusting a chip vendor's isolation.

Performance remains the open question. Encrypted inference still carries meaningful overhead, and the published figures come from single-threaded CPU runs rather than tuned production deployments. Independent write-ups of the toolchain describe compiling a small TensorFlow Lite model to run under encryption with inference measured in seconds, which is workable for narrow tasks and far from interactive for large ones.

The direction is nonetheless clear. With the compiler barrier lowered and accelerators arriving from four hardware partners, private inference is shifting from a cryptography research problem toward something an ordinary engineering team can realistically evaluate.

a:["$","div",null,{"className":"mx-auto max-w-7xl px-4 py-8 sm:px-6","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://ainewsway.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#homomorphic-encryption\",\"item\":\"https://ainewsway.com/tag/homomorphic-encryption\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ItemList\",\"@id\":\"https://ainewsway.com/tag/homomorphic-encryption#itemlist\",\"name\":\"#homomorphic-encryption Articles\",\"numberOfItems\":1,\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"url\":\"https://ainewsway.com/articles/google-open-sources-heir-a-compiler-that-runs-ai-models-on-encrypted-data-msu5mrbu\",\"name\":\"Google Open-Sources HEIR, a Compiler That Runs AI Models on Encrypted Data\"}]}"}}],["$","$L1d",null,{"items":[{"label":"# homomorphic-encryption"}]}],["$","h1",null,{"className":"mb-8 text-3xl font-bold text-zinc-900 dark:text-zinc-100","children":["#","homomorphic-encryption"]}],[["$","$L1e",null,{"articles":[{"id":"3d94be8c-92c5-4e73-a189-cbc8b9536d02","slug":"google-open-sources-heir-a-compiler-that-runs-ai-models-on-encrypted-data-msu5mrbu","title":"Google Open-Sources HEIR, a Compiler That Runs AI Models on Encrypted Data","subtitle":"Four working demos aim to move homomorphic encryption from cryptography research to ordinary engineering","content":"$1f","excerpt":"Google has open-sourced HEIR, a compiler that converts pre-trained AI models to run on encrypted data, alongside four working private-inference demos.","coverImage":"https://cdn.ainewsway.com/processed/v1/41e393e2-d77d-4537-b5a0-80ba34b1c3d5/original.webp","coverImageCaption":"Source code on screen, representing the HEIR compiler toolchain that rewrites AI models to operate on encrypted inputs","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-08-15T09:11:21.371Z","viewCount":31,"likeCount":0,"readingTime":3,"isFeatured":false,"isBreakingNews":false,"metaTitle":"Google HEIR: Open-Source Compiler for AI on Encrypted Data","metaDescription":"Google open-sourced HEIR, a compiler that converts pre-trained AI models to run on homomorphically encrypted inputs, with four private-inference demos.","metaKeywords":["Google","HEIR","homomorphic encryption","private inference","encrypted AI models","open source compiler","data privacy","ai-ml"],"ogImage":null,"aiSummary":"Google released HEIR, an open-source compiler toolchain that converts pre-trained AI models to run on homomorphically encrypted data so servers process ciphertext without seeing inputs. It published four working private-inference demos, including a recommendation model, a credit card fraud detector, a Kitsune network anomaly detector and a hotword detector, all measured on a single-threaded CPU. Hardware partners such as Belfort, Niobium, Cornami and Optalysys are building accelerators to lower the cost.","aiTags":[],"sentiment":null,"articleType":"NEWS","videoEmbed":null,"videoType":null,"seoScore":85,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-08-15T09:09:20.731Z","updatedAt":"2026-09-10T01:38:00.861Z","contentUpdatedAt":"2026-08-15T09:11:21.371Z","deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"e2b5fffc-de32-42aa-86fe-c75f219d6b4b","name":"AI & Machine Learning","slug":"ai-ml"}],"tags":[{"id":"09eb5399-3a10-4708-9092-4a4413b59ec3","name":"Google","slug":"google"},{"id":"a71db171-f2fe-4393-9285-e58f3a69f887","name":"Homomorphic Encryption","slug":"homomorphic-encryption"},{"id":"337d26a4-cca7-43bc-a215-60f07558422d","name":"Data Privacy","slug":"data-privacy"},{"id":"dbb28dbd-4512-4daa-9191-85e040c30141","name":"Open Source","slug":"open-source"},{"id":"a9083e67-1546-4fbe-9789-4e61748b6f9c","name":"AI Research","slug":"ai-research"}],"translations":[],"celebrities":[{"id":"5c572908-2f5b-47b3-95e2-13ed3e298bf7","nameKo":"구글","nameEn":"Google","slug":"google","profileImage":null}]}]}],"$L20"]]}]

#homomorphic-encryption

Google Open-Sources HEIR, a Compiler That Runs AI Models on Encrypted Data

Subscribe to Newsletter

#homomorphic-encryption

Google Open-Sources HEIR, a Compiler That Runs AI Models on Encrypted Data