Google HEIR Makes Private AI Practical with Homomorphic Encryption

On August 14, 2026, Google unveiled HEIR, an open-source compiler that lets AI models run inference directly on encrypted data. Private AI is no longer a research-lab problem.

The Trade-off HEIR Breaks

End-to-end encryption protects data from breaches, but it forces a trade-off: the provider can't run features that need to read the data — spam filtering, fraud detection, content recommendations. Healthcare and finance hit the same wall, with regulations that restrict data sharing across institutions.

Homomorphic encryption breaks this stalemate. A server processes ciphertext and returns an encrypted result without ever seeing the raw data. Unlike Trusted Execution Environments (TEEs) or hardware enclaves, its guarantee is purely mathematical — no trust in the chip vendor required.

What HEIR Actually Is

HEIR stands for Homomorphic Encryption Intermediate Representation. It's a compiler toolchain and development platform for homomorphic encryption, and its core trick is converting a pre-trained model that runs on plaintext into one that runs on encrypted inputs.

Doing this by hand once required a team of cryptographers. Google's stated goal is a one-click path for non-experts to add encrypted inference to production apps.

Four Demos, Measured on a Single CPU Thread

To show how far the technology has come, Google published four private-inference applications, all compiled with HEIR and benchmarked on a single-threaded CPU — no GPU, no accelerator:

• Private recommendations — a Deep Learning Recommendation Model, built with Belfort Labs, LG, and NYU. The cloud recommends content without seeing user features.
• Credit card fraud detection — with Niobium and hardshell.ai.
• Network intrusion detection — the Kitsune system compiled to flag anomalies in encrypted traffic.
• Hotword detection — with Belfort Labs, for voice-triggered agents that keep recordings private.

All four are open source on GitHub, in the google/fully-homomorphic-encryption repo.

An Ecosystem, Not a Demo

Google isn't building alone. Four hardware-accelerator companies — Belfort Labs, Niobium, Cornami, and Optalysys — are partnered. On the research side, HEIR anchors collaborations with Georgia Tech, CMU, UC Santa Barbara, Purdue, Edinburgh, and Tsinghua, and four peer-reviewed papers have been built on it.

The accelerator angle matters most. Compute cost is the biggest remaining barrier to homomorphic encryption, and dedicated hardware is how that cost comes down. The question shifts from "is it feasible?" to "what does it cost?"

What This Means for Developers

No cryptography PhD required. The compiler abstracts the hard part — you work at the model level, not the ciphertext level.

Regulated industries open up. A hospital could run a diagnostic model on patient data from multiple institutions without any of them exposing raw records.

A different security model. Homomorphic encryption's guarantee is mathematical, unlike confidential computing, which trusts the chip vendor.

There's a subtler shift here too: homomorphic encryption inverts the "privacy or features" zero-sum. A provider can compute on data it can't read — two goals that used to exclude each other now go together. That's why healthcare and finance have been waiting for this.

But don't rip out your stack. Homomorphic encryption still carries real overhead, and the published demos run on a single CPU thread — not high-throughput inference. This is a tool for data-sensitive workloads, not a drop-in replacement for plaintext inference.

Key Takeaways

• HEIR is an open-source compiler that converts plaintext models to run on encrypted data.
• Four real demos: recommendations, fraud detection, intrusion detection, hotword detection.
• The security guarantee is mathematical, not hardware-based.
• Dedicated accelerators are coming, which means cost keeps falling.
• Overhead remains — it's for sensitive workloads, not everything.

Homomorphic encryption used to be cryptography for cryptographers. HEIR is the signal that it's becoming a developer tool. The question is no longer "can it be done?" but "what will you build with it?"

---

Content assisted by AI (Amy 🌸). Reviewed by the author.