Google Open-Sources HEIR for Private AI Inference
Google published details of HEIR on Aug. 14, 2026, an open-source compiler toolchain for running AI inference on homomorphically encrypted data. According to Google's security blog and related reporting, HEIR can convert pretrained models built for unencrypted inputs into programs that process ciphertexts, while its public GitHub repository provides an MLIR-based toolchain and Python package. The project targets a major usability barrier in fully homomorphic encryption development.
Google has published details of HEIR, the Homomorphic Encryption Intermediate Representation, an open-source compiler toolchain intended to support AI inference on encrypted data. In an Aug. 14, 2026, security blog post, Google described HEIR as the latest addition to its Private Computing Toolkit and said it can convert pretrained models designed for unencrypted inputs into models that process encrypted inputs.
Homomorphic encryption permits computation directly on ciphertexts, allowing a server to return an encrypted result without accessing the underlying data. Google describes this as an alternative to the usual trade-off between protecting user data and providing server-side functions such as spam detection, recommendations, or fraud analysis. The company also notes that homomorphic encryption carries substantial computational overhead, although it says costs have been declining.
A compiler layer for FHE development
HEIR is built on MLIR, LLVM's multi-level intermediate representation framework. The public google/heir repository describes it as an MLIR-based toolchain for homomorphic-encryption compilers, with command-line tools including heir-opt and heir-translate, as well as a Python package.
According to Google's post and Help Net Security's reporting, the project is intended to give application developers, compiler engineers, hardware designers, and cryptography researchers shared infrastructure for compiling, testing, benchmarking, and comparing homomorphic-encryption programs. Help Net Security reports that HEIR has been under development since Google announced plans for the project in 2023 and that Google cited four peer-reviewed publications built on the platform.
The accompanying 2025 HEIR paper describes a unified compiler approach that aims to support mainstream homomorphic-encryption techniques, major software libraries, and hardware accelerators. Its authors argue that HEIR's abstraction layers make it easier to implement and compare optimizations that have historically been difficult to combine across separate FHE toolchains.
From Python programs to encrypted execution
Google and Help Net Security describe HEIR as supporting multiple FHE schemes, libraries, and front-end languages. The repository documents several installation paths, including use of the Python package and direct integration of generated backend code. Google also identifies code generation for accelerators such as GPUs, TPUs, FPGAs, and custom ASICs as a project goal.
Reported demonstration areas include:
- •Private recommendation systems
- •Credit-card fraud detection
- •Network-intrusion detection
- •Hotword recognition
These are examples of workloads where the input itself can be sensitive and computation can occur without exposing its contents. They do not remove FHE's computational overhead, but they make compiler performance relevant to whether a workload is deployable.
The relevant technical development for ML and systems practitioners is less a new model capability than a common compilation and benchmarking layer. In comparable privacy-preserving ML stacks, reusable intermediate representations can reduce the cost of evaluating different encryption schemes, packing strategies, approximation methods, and hardware targets. Performance claims still need to be established per model and workload, particularly because encrypted inference can differ sharply from plaintext execution in latency, throughput, and numerical constraints.
Google's public repository provides source code for evaluation, while the HEIR paper frames the project as infrastructure for continuing compiler and cryptographic research rather than a claim that fully homomorphic encryption is broadly cost-free today.
Key Points
- 1Google's HEIR provides an MLIR-based compiler layer for encrypted AI inference, addressing the specialized engineering required to build FHE applications.
- 2The toolchain targets Python front ends, multiple FHE schemes, and potential accelerator backends, widening the design space for privacy-preserving ML experiments.
- 3HEIR's paper emphasizes benchmarking because FHE overhead varies materially by workload, encryption parameters, and hardware target.
Scoring Rationale
HEIR is notable open-source infrastructure for teams researching or deploying privacy-preserving inference, especially in regulated data settings. It does not eliminate the computational costs of fully homomorphic encryption, but a common compiler and benchmarking layer can improve experimentation and portability across FHE backends.
Sources
Primary source and supporting public references used for this report.
Practice with real Ad Tech data
90 SQL & Python problems · 15 industry datasets
250 free problems · No credit card
See all Ad Tech problems
