Is homomorphic encryption the same as end-to-end encryption?

No. End-to-end encryption keeps data unreadable while it’s stored or in transit, but a server still has to decrypt it to process it. Homomorphic encryption lets a server compute on the data while it stays encrypted the entire time.

How is homomorphic encryption different from federated learning?

Federated learning keeps raw data on the user’s device and only shares model updates; homomorphic encryption lets data leave the device but stay encrypted the entire time it’s processed. They address overlapping privacy goals in different ways, and are sometimes combined.

Yes — HEIR is open source under the Apache-2.0 license, and Google describes it as part of its Private Computing Toolkit rather than a paid product.

Does homomorphic encryption slow AI down a lot?

Yes, significantly — encrypted computation is still orders of magnitude slower than plaintext computation, which is why it’s used selectively for high-sensitivity workloads rather than as a default.

Can a developer try HEIR themselves?

Yes. HEIR’s getting-started guide walks through installing the toolchain and compiling a simple encrypted computation.

What Is Homomorphic Encryption — and How Does AI Use It?

Homomorphic encryption is a form of cryptography that lets a computer run calculations directly on encrypted data and produce an encrypted result — one that, once decrypted, matches exactly what the calculation would have produced on the original, unencrypted data. Applied to AI, it means a model can process a request, generate a prediction, or answer a question without the server running it ever seeing the underlying data in readable form.

What makes encryption “homomorphic”

Ordinary encryption protects data at rest or in transit: a file is unreadable until someone with the right key opens it, at which point it becomes fully exposed to whoever computes on it. Homomorphic encryption is different — it preserves the mathematical structure of the data through encryption, so operations like addition and multiplication performed on the encrypted version (the “ciphertext”) produce the same result, still encrypted, as if they had been performed on the original data.

Cryptographers distinguish a few levels of it. Partially homomorphic schemes support only one type of operation — addition or multiplication, not both. Somewhat homomorphic schemes support both, but only for a limited number of operations before mathematical “noise” makes the result unreadable. Fully homomorphic encryption (FHE) — first shown to be possible by cryptographer Craig Gentry in 2009 — supports unlimited combinations of operations, which is what makes it usable for something as computation-heavy as an AI model.

How AI computes on data it can’t read

In a private-inference setup, the client encrypts its input — a medical scan, a financial record, a search query — before it ever leaves the device. The AI provider’s server receives only ciphertext, runs the model’s operations on that ciphertext, and sends back an encrypted result. Only the client, holding the decryption key, can read the answer; the server that did the computing never had access to the readable data at any point.

The catch is that neural networks lean heavily on non-linear functions — the steps that decide which signals a network passes forward — and those don’t translate cleanly into the addition and multiplication operations FHE supports. Making them work usually means approximating them with polynomials, which adds both engineering complexity and computational cost.

Why Google built a compiler for it

That complexity is the main reason homomorphic encryption has stayed a research curiosity rather than a mainstream tool: writing FHE code by hand requires cryptography expertise most application developers don’t have. Google’s response, released as open source under the Apache-2.0 license, is HEIR — a compiler, built on the LLVM project’s MLIR framework, that takes a program written with secret-data annotations and automatically generates its encrypted equivalent, targeting several FHE schemes and backend libraries. The goal is similar to what ordinary compilers solved for regular software: let developers write in a familiar way and leave the low-level cryptographic optimization to the tool. Developers curious to try it can follow HEIR’s own getting-started guide, which walks through compiling a simple encrypted computation end to end.

Why it matters

Homomorphic encryption is one of a handful of techniques — alongside the approaches to protecting user data covered elsewhere and hardware-based confidential computing — aimed at letting organizations get value from AI on sensitive data without handing that data over in the clear. A hospital could run diagnostic AI on encrypted patient scans; a bank could screen encrypted transactions for fraud; a government agency could analyze encrypted records — all without the AI provider, or anyone who breaches its servers, ever seeing the raw information. It’s the kind of guarantee regulated industries and privacy-conscious users increasingly ask for, and it sits alongside other security work like post-quantum cryptography, which protects encrypted data against future decryption rather than the computation itself.

The trade-off: speed

None of this is free. Computing on encrypted data is still, even with recent schemes, orders of magnitude slower than computing on plaintext, and every non-linear approximation adds more overhead. That’s why homomorphic encryption remains rare in production AI systems today — it tends to show up first in narrow, high-stakes use cases where the privacy guarantee is worth the performance cost, while faster but weaker alternatives handle everything else. Tools like HEIR are aimed squarely at closing that gap, but “practical” so far means “usable for real workloads,” not “as fast as normal AI inference.”

In the news

Google’s release of HEIR is a recent step toward making this practical for ordinary developers — see our report on Google open-sourcing HEIR.