What does Google's HEIR compiler change for private AI inference?

Google announced HEIR on August 14, 2026. The tool comes from Jeremy Kun, a staff software engineer on the security team.

What homomorphic encryption actually does

Standard encryption protects data while it sits or moves. Homomorphic encryption protects data while it is being used. A server can take ciphertext, run a computation, and return an encrypted result. The server never learns the inputs or the outputs. The blog post calls this a fundamental shift in the capability and privacy trade-off. The cost overhead is real but decreasing rapidly.

How HEIR fits into the picture

Converting an existing program to use homomorphic encryption efficiently used to require a team of cryptographers. HEIR removes that barrier. It is a compiler toolchain and development platform. HEIR takes pre-trained AI models that operate on plaintext and rewrites them to operate on encrypted inputs. The vision is a one-click solution for non-experts. Google first signaled this direction in 2023.

Four demos compiled with HEIR

Four private inference applications are shared in the post. Each was compiled with HEIR. Latency numbers reflect a single-threaded CPU.

A deep learning recommendation model serves private content recommendations. The work involves Belfort Labs and LG. New York University also collaborated. A credit card fraud detector was compiled together with Niobium and hardshell.ai. The Kitsune system detects anomalies in encrypted network traffic. Niobium collaborated on that one. A hotword detection model could let an audio-triggered AI agent recognize trigger words while protecting the privacy of recordings. Belfort Labs partnered on the hotword demo.

Source code for all examples lives in a GitHub repository.

Hardware accelerators and research partners

Partnerships with companies building hardware accelerators for homomorphic encryption include Belfort and Niobium. Cornami and Optalysys are also partners. Latency benefits from these accelerators will be demonstrated in the near future.

The compiler has also become a research platform. Cryptographers can focus on specific optimizations while using existing infrastructure for testing and benchmarking. Collaborations span Georgia Tech and Carnegie Mellon. UC Santa Barbara is also involved. Illinois Institute of Technology and Purdue are also involved. The University of Edinburgh participates as well. Tsinghua University rounds out the list. Four peer-reviewed publications have been built on HEIR so far. More are in preparation. The post notes numerous citations but does not give a count.

Where the explanation stops

Latency figures for any of the four demos are not shared in the post. The post does not say when HEIR will reach a stable release. Licensing terms for the open-source release are not described. How model owners protect their intellectual property when shipping compiled models to untrusted environments is not explained. The post mentions that shipping proprietary AI to a device risks leaking the model but does not detail how HEIR addresses that risk for the model itself versus the user data.