Google released the open-source compiler HEIR on August 14, 2026. The software transfers pre-trained AI models so that they can compute directly on encrypted data – servers process sensitive content without ever seeing it in plaintext. Four demo applications show, according to Google, that the approach can be used from fraud detection to speech recognition.
Compiler translates models for encrypted computation
HEIR stands for Homomorphic Encryption Intermediate Representation and is built on the compiler framework MLIR, which Google also uses for other developer tools. The software automatically converts already trained models into a version that works with fully homomorphic encryption – a cryptographic method that allows computation operations directly on encrypted values without decrypting them in between. As Google explains in its blog post, servers should be able to deliver results without ever viewing the underlying content in plaintext. The compiler supports, according to the GitHub repository, several encryption schemes via the backends OpenFHE and Lattigo for the BGV, BFV, and CKKS methods as well as tfhe-rs and Jaxite for Boolean circuits. Developers can integrate HEIR optionally via the build system Bazel, a Python package, or as a command-line tool. The project is licensed under the free Apache-2.0 license, but is explicitly not considered an officially supported product by Google itself. Initial plans for HEIR were publicly outlined by lead Google engineer Jeremy Kun in 2023; since then, it has become an actively developed open-source project.
Four test cases demonstrate practical applications
Google demonstrates the compiler on four applications. Together with Belfort Labs, LG, and New York University, a recommendation system based on a deep learning model ran completely encrypted. With the security company Niobium Microsystems and the provider hardshell.ai, the team tested credit card fraud detection on ciphertext data. A third application detects network attacks using the established Kitsune system, while a fourth identifies signal words in audio recordings without disclosing the recording itself – also developed with Belfort Labs. The examples thus range from financial services to IT security to speech processing. Meanwhile, Google is working with hardware manufacturers Belfort, Niobium, Cornami, and Optalysys on specialized accelerators that are intended to speed up the computational operations required for homomorphic encryption. HEIR thus fits into Google’s so-called Private Computing Toolkit, which also includes differential privacy, private set membership tests, and secure hardware enclaves. According to the company, four peer-reviewed publications based on HEIR have already been produced by academic partners, involving universities from Georgia Tech to Carnegie Mellon to Tsinghua University in Beijing.
High computational effort hinders widespread use
The announcement sparked lively interest in the developer community: the discussion post on Hacker News quickly gathered around 480 upvotes and about 280 comments. Several commentators pointed out the high computational effort of fully homomorphic encryption, which they estimated to be about a thousand times that of a computation on plaintext data – unverified independently, but a commonly cited benchmark in the cryptography community. The additional effort is, according to Google, non-trivial, but the costs are rapidly decreasing – also thanks to collaborations with hardware manufacturers. The initiative is part of a series of Google security projects in recent weeks and months: just recently, the company closed 1,072 security vulnerabilities in Chrome with AI agents, after previously using the government-only Gemini 3.5 Flash Cyber model to hunt for vulnerabilities. While there, AI actively searches for vulnerabilities, HEIR takes the opposite approach: data should not be processed unprotected in the first place. Some commentators in the discussion also doubted whether Google’s own data protection practices in other products can keep up with the claims of the new tool.
It will be crucial whether cloud providers actually integrate HEIR into production systems or whether the high computational effort restricts the tool to niches such as health or financial data, where data protection weighs particularly heavily. Google does not provide a timeline for integration into its own services like Gemini or Workspace; HEIR remains, for the time being, a tool for developers who must integrate it into their own applications.
