Google has added a new tool to its Private Computing Toolkit. On August 14, Google staff software engineer Jeremy Kun introduced HEIR (Homomorphic Encryption Intermediate Representation) on the company's official blog — an open-source compiler toolchain and development platform for homomorphic encryption. Its core capability comes down to one thing: automatically converting an AI model trained to run on plaintext into one that runs on ciphertext.
The trade-off homomorphic encryption rewrites
The classic security dilemma is stark. Protect data with end-to-end encryption and the service provider can no longer offer features that depend on that data, such as spam or virus detection. Offer those features and the data has to be exposed to the server. In heavily regulated sectors like healthcare and finance, the conflict bites even harder.
Homomorphic encryption (FHE) fundamentally alters this. Because computation runs directly on ciphertext, a server can process encrypted inputs and return encrypted results without ever seeing the information inside. A cloud service could, for instance, serve content recommendations without knowing the user's features. There is still a cost overhead, but as Google frames it, the question has shifted from privacy-versus-capability to one of cost — and that cost is falling fast.
The real problem HEIR solves — usability
Performance was never the only obstacle. Efficiently porting an existing program to FHE has required a team of cryptographers doing the conversion by hand. HEIR targets exactly that usability barrier. A developer writes a program in Python and annotates which values are secret; HEIR compiles the rest. Under the hood it builds on the MLIR compiler infrastructure to represent and scale complex models across multiple dialects, and it generates code for standard FHE libraries such as OpenFHE and Lattigo.
Google says that since announcing its intentions in 2023, the homomorphic-encryption community has embraced HEIR. It has become a research platform as well as a tool: cryptographers can focus on their own optimizations while reusing existing infrastructure for testing, benchmarking, and comparison. To date, four peer-reviewed publications have been built on HEIR.
What it is Open-source homomorphic-encryption compiler toolchain and dev platform
Foundation MLIR · targets OpenFHE and Lattigo libraries
Demo applications 4 (latency measured on single-threaded CPU)
Peer-reviewed papers built on HEIR 4
Project intentions announced 2023
Four working applications
To show "how far homomorphic encryption has come," Google shared four private-inference applications compiled with HEIR. Source code for all of them is in the GitHub repository.
| Application | Collaboration | What it protects |
|---|---|---|
| Deep Learning Recommendation Model (DLRM) | Belfort Labs · LG · NYU | Serves recommendations without exposing user features |
| Credit-card fraud detection | Niobium · hardshell.ai | Flags fraud while hiding the underlying transaction |
| Network intrusion detection (Kitsune) | Niobium | Detects anomalies without revealing packet contents |
| Hotword detection | Belfort Labs | Recognizes wake words while protecting audio privacy |
Latency for all four is reported on a single-threaded CPU. Google says it is working with homomorphic-encryption hardware-accelerator companies — Belfort, Niobium, Cornami, and Optalysys — and plans to demonstrate their latency benefits separately in the near future.
What's left, and where it goes
It would be premature to say HEIR has reached its "one-click encrypted inference" vision. FHE's compute overhead is still large, and the latency figures are single-threaded-CPU numbers — some distance from large-scale production. But the direction is clear. As FHE's bottleneck shifts from feasibility to cost, an automated compiler layer meshing with dedicated accelerators pulls the practical arrival of privacy-preserving AI closer. That Google released this in the open also reads as a play for standards and ecosystem leadership.
- Google open-sourced HEIR, a homomorphic-encryption compiler (Aug 14), that converts trained AI models to run inference on encrypted inputs.
- Developers write Python and annotate secret values; HEIR compiles the rest. MLIR-based, with OpenFHE and Lattigo backends.
- Four working demos — recommendations, fraud detection, intrusion detection, hotword spotting — with source published (single-threaded CPU).
- Collaborating with FHE accelerator firms Belfort, Niobium, Cornami, Optalysys. The bottleneck is moving from "possible" to "cheap."