Google's HEIR Compiler Brings Homomorphic Encryption to Private AI Inference

Google is making the case that private AI can be practical. In a post published August 14, 2026 on the company's Security blog, staff software engineer Jeremy Kun showcased HEIR, an open-source compiler that unlocks cryptographically secure private AI inference, now the latest tool in Google's Private Computing Toolkit.

HEIR — short for Homomorphic Encryption Intermediate Representation — can convert pre-trained AI models that operate on unencrypted data to operate on encrypted inputs. Google's stated vision is to make HEIR a one-click solution that lets non-experts incorporate encrypted inference into production applications.

The Privacy Trade-off Homomorphic Encryption Breaks

The post lays out the core dilemma. Standard protections like end-to-end encryption present a trade-off: user data can be protected from breaches, but then the service provider cannot offer features that depend on that data — spam filtering and virus detection being the canonical examples. Critical sectors like healthcare and finance are even more averse to these risks, with strict regulations limiting data sharing across institutions.

The alternatives have their own limits. Local processing on a user's device is constrained by hardware capabilities, and shipping a provider's proprietary AI model to a device risks leaking the model itself — the intellectual property walks out the door.

Homomorphic encryption changes the equation by allowing computations to be performed directly on encrypted data. Servers process ciphertexts and return encrypted results without ever exposing the underlying information. A cloud service could, for instance, provide content recommendations without being able to see the user's features — a scenario Google says is no exaggeration, because one of the demos in the post does exactly that.

The technology is not free: homomorphic encryption carries a nontrivial cost overhead. But as Kun notes, it shifts the capability-versus-privacy trade-off into a question of cost — and that cost is rapidly decreasing. For readers tracking the intersection of AI and security, AI Buzz Wire covers these developments as they happen.

What HEIR Actually Does

The reason homomorphic encryption has remained niche is usability: manually converting an existing program to use it efficiently, Google says, requires a team of cryptographers. HEIR is Google's answer — a full open-source compiler toolchain and development platform for homomorphic encryption.

The project has been building momentum since Google first announced its intentions in 2023. Since then, the company has observed the homomorphic encryption community embrace the tool, including partnerships with companies building hardware accelerators for the technology: Belfort, Niobium, Cornami, and Optalysys. Google says it plans to demonstrate the latency benefits of these accelerators in the near future.

HEIR has also become a productive research platform. Because cryptographers can build on its existing infrastructure for testing, benchmarking, and comparisons, the project has attracted collaborations with Georgia Tech, Carnegie Mellon, UC Santa Barbara, Illinois Institute of Technology, Purdue, the University of Edinburgh, and Tsinghua University, among others. To date, four peer-reviewed publications have been built on HEIR, with more in preparation.

Four Working Demonstrations

To show how far the technology has come, Google shared four private inference applications, each compiled with HEIR, with latency numbers presented for single-threaded CPUs and source code available in its GitHub repository:

1. Private content recommendations

A Deep Learning Recommendation Model for serving private recommendations — joint work with Belfort Labs, LG, and New York University. This is the demo that serves recommendations without the provider seeing user features.

2. Credit card fraud detection

Together with Niobium and hardshell.ai, Google compiled a credit card fraud detector that can score transactions without exposing sensitive financial data.

3. Threat intrusion detection

With Niobium, the team compiled the Kitsune system for anomaly detection of encrypted network traffic — allowing a service provider to detect anomalies without revealing the contents of network packets.

4. Hotword detection

With Belfort Labs, Google compiled a hotword detection model that could let an audio-triggered AI agent recognize wake words while protecting the privacy of the audio recordings.

The breadth matters: recommendation systems, fraud, security monitoring, and voice activation span most of the touchpoints where consumers actually encounter AI — suggesting Google is thinking about encrypted inference as infrastructure, not a lab curiosity.

A Lineage of Privacy Engineering

Google places HEIR in a longer tradition of privacy technology innovation — differential privacy, private set membership, private information retrieval, and secure enclaves on Google Cloud. Unlike hardware-based approaches, homomorphic encryption's guarantees are purely cryptographic, resting on math rather than on trusting a chip.

As the software industry adapts to security and privacy expectations in the AI era, Google's research team says it is working to make homomorphic encryption easy to develop, fast to run, and ubiquitous across industry. With HEIR lowering the expertise barrier and hardware partners accelerating the math, the gap between "cryptographically private" and "practically deployable" is narrowing.

Stay Ahead of AI

For more coverage of AI security research and the technologies protecting user data, bookmark AI Buzz Wire and follow our AI research coverage.

Read more AI news →