Google open-sources HEIR, a compiler that runs AI inference on encrypted data

Google has open-sourced HEIR (Homomorphic Encryption Intermediate Representation), a compiler that converts pre-trained AI models to run inference directly on encrypted data without decrypting it. The company detailed the release in a blog post on August 14, 2026.

Homomorphic encryption lets a computer run calculations on ciphertext and get an encrypted result, so the data is never exposed in the clear. The hard part has always been making it practical: converting a model to run under encryption has typically required a dedicated cryptography team. Google says HEIR removes that step by handling the conversion automatically.

In Google’s security blog post, credited to staff software engineer Jeremy Kun, the company demonstrated four applications built with academic and industry partners: a deep-learning recommendation model, credit-card fraud detection, the Kitsune network-intrusion-detection system, and a hotword detector for audio privacy. Google is also releasing a broader Private Computing Toolkit.

The demonstrations do not settle the open question with homomorphic encryption, which is speed. Running models on encrypted data remains far more computationally expensive than running them in the clear, and Google’s post shows working applications rather than production-scale latency or throughput benchmarks. Whether HEIR closes that gap enough for real-time services is unproven from the announcement alone, and the work rests on a single first-party source.

Still, open-sourcing the compiler lowers the barrier for other teams to try encrypted inference on their own models, which is the practical bottleneck the release is aimed at.