Google has released HEIR (Homomorphic Encryption Intermediate Representation), an open-source compiler that automatically converts pretrained AI models to run inference directly on homomorphic encryption-protected data, Google staff software engineer Jeremy Kun said in a blog post published August 14. The decades-old cryptography technique lets a server compute on encrypted inputs and hand back an encrypted result that only the data’s owner can unlock — without the server ever seeing the plaintext.
Homomorphic encryption has long been considered impractical outside research settings, because converting an existing model to use it efficiently required a team of cryptographers, according to Google. HEIR, part of the company’s Private Computing Toolkit for privacy-preserving AI, is meant to automate that conversion; Google frames its long-term goal as a “one-click” way for developers without cryptography expertise to add encrypted inference to production systems.
Four working demos
To show the approach works outside a lab, Google and outside partners built four applications on HEIR: a deep-learning recommendation model made with Belfort Labs, LG and NYU; a credit-card fraud detector built with Niobium and hardshell.ai; a network-traffic anomaly detector based on the open-source Kitsune system; and a hotword-detection model built with Belfort Labs. Source code for all four is published on GitHub.
Google said four peer-reviewed papers have already relied on HEIR, and it is now working with chip makers Belfort, Niobium, Cornami and Optalysys, which build hardware accelerators for the heavy math homomorphic encryption requires, along with seven university research groups, including Carnegie Mellon and Tsinghua.
Still a work in progress
Google acknowledges homomorphic encryption still carries “nontrivial cost overhead” versus ordinary computation, though it says that gap is narrowing as compilers and hardware improve. HEIR’s GitHub page also describes it as “not an officially supported Google product” — an open, community-run project rather than a finished managed service. The toolchain is released under an Apache 2.0 license and can be installed via Bazel or as a Python package.
The release lands as AI providers face rising scrutiny over how they handle sensitive data, from security incidents to concerns about services like ChatGPT Health storing medical records. Techniques like homomorphic encryption sit alongside other emerging safeguards, such as post-quantum cryptography, that researchers are racing to make practical before regulation or real-world attacks force the issue.